It depends on who you sell to. If you already have a CMMC Level 2 self-assessment posted, the July 2026 pause means DoD has stopped adding C3PAO requirements to contracts for now. If a prime is asking for certification, get assessed now. If you sell directly to the government with no such ask, you can usually wait, but stay audit-ready.

Atomus works with 150+ companies on CMMC Level 2. When the Department of War suspended CMMC Phase 2 on July 13, 2026, a number of them had assessments on the calendar. Within a week we’d spoken with every customer due for an assessment in the following 60 days, and given each the same choice: keep your date, or postpone with no penalty or added cost. Roughly 75% chose to go ahead. The rest chose to wait. Both were reasonable calls, and the deciding factor was nearly always the same.

This post is for companies in that position: your controls are in place, your Level 2 self-assessment is in SPRS, and you’re deciding whether a third-party assessment is worth doing now.

What the Pause Changed, and What It Didn’t

The pause moved the deadline for third-party certification. It didn’t touch the work you’ve already done.

Still required: DFARS 252.204-7012, the 110 controls in NIST SP 800-171 Rev 2, your SPRS score, the annual affirmation by a senior official, and 72-hour incident reporting. Your Level 2 self-assessment stays in force.

Paused: CMMC Phase 2, which would have made a C3PAO certification a condition of contract award starting November 10, 2026. Contracting officers have been told to remove those requirements from solicitations and existing contracts. Until your contract is actually modified, its current terms still bind you.

Still unknown: how and when verification comes back. DoD’s Reform Task Force finished its review in September, and its recommendations haven’t been published.

The requirement isn’t going away. The open question is how it gets checked.

That’s how we explain it to customers. Third-party audits may come back in the same form, or primes may run their own checks, or the government may verify directly. Whichever it is, a company that already meets the 110 controls is in the best position to pass. So the real question is narrower: is a C3PAO certificate worth having now?

When It Makes Sense to Get Assessed Now

Get assessed now if a customer is asking for it, or if being certified early gives you something you’d otherwise lose.

1. Your prime is asking for it. This is the biggest single factor. Most of the customers who went ahead did so because a prime was still pushing certification. Large primes worried well before the pause that too few suppliers would be certified in time, and they still want a certified supply base, whatever DoD’s timeline. Ask your prime in writing whether a self-assessment meets your subcontract terms. If they say no, the decision is made.
2. You’re ready, and you’d rather be certified under Revision 2. Today’s assessments measure against NIST SP 800-171 Rev 2. Revision 3 tightens many controls, and we expect a messy stretch while assessors work out how they read it. A Level 2 certification lasts three years. Certified under Rev 2 now, you skip being among the first assessed under Rev 3.
3. You want to be early in the queue. When a requirement suddenly appears, every affected company asks for an assessor at once. We saw that before the pause, when a single new contract requirement sent a wave of companies into line together. Booking now is easier than booking in the rush that follows any reinstatement.
4. The certificate helps you win work. Customers tell us primes ask “are you C3PAO certified?” early in the conversation. A certificate answers that in one line.
5. Your award is easier to defend. Where a contract makes CMMC status a condition of award, a losing bidder can protest the award by arguing the winner wasn’t compliant. Government contracts lawyers expect bid protests to become one of the main ways the industry polices CMMC. A protester needs specific evidence, and a self-assessment rests on your own word. A C3PAO certificate is an independent assessor’s finding, recorded for SPRS, and a much harder record to attack. The same record backs up the score your senior official affirms each year.

When It Makes Sense to Wait

Waiting is reasonable if nobody in your contract chain is asking for certification this year.

1. You sell directly to the government, and no contract requires it. The customers who paused were mostly smaller companies selling straight to DoD. Their reasoning: the audit requirement will probably come back, but likely months out, and nothing they’re bidding on needs it today.
2. Your near-term pipeline doesn’t call for it. If the contracts you’re most likely to win this year don’t require a Level 2 certification, a few months’ delay costs little.
3. Budget timing matters. Assessments cost real money, and assessors set their own prices. Atomus doesn’t control them. We’re generally seeing the high end at about $50,000, depending on scope, and simpler environments cost less. For some companies, the next budget year is the right time.

Waiting doesn’t mean stopping. Your self-assessment, SPRS score and affirmation still carry legal weight. If anything, they carry more while third-party checks are paused. Keep your evidence running and your System Security Plan current, so you can still pass when the call comes.

If You’re an Atomus Customer

Your assessment support is the same whichever you choose. If you assess now, we run the readiness review with you, check your documentation through our internal quality control, and sit with you through assessment week. If you wait, we keep your environment, evidence and SSP assessment-ready so that restarting is a scheduling call, not a project. Either way, tell your Atomus team which way you’re leaning, and we’ll write the plan down so nothing is left to memory.

Frequently Asked Questions

I already have a Level 2 self-assessment. Do I need a C3PAO assessment right now?

Not for DoD, unless your contract already requires one and hasn’t been modified. The government has stopped adding C3PAO requirements to contracts during the pause. A prime can still require certification in your subcontract, so check with them in writing.

If I get certified now, will it still count later?

A CMMC Level 2 certification is valid for three years, and C3PAOs are still authorized to certify during the pause. A significant change to the environment that was assessed can require a new assessment, so keep your scope stable.

Does waiting put my self-assessment at risk?

No, as long as your score stays accurate. Your SPRS score and annual affirmation are still legal statements to the government. With third-party checks on hold, they’re the main way your compliance is judged.

How long does it take to get an assessment once I decide?

At our recent pace, about 60 to 90 days from signing with an assessor to assessment week. That includes readiness checks and scheduling. This can vary significantly with how many companies are going through assessment at the same time. If you’re an Atomus customer, contact your Atomus team for a real-time view of how long it’s taking from signing with an assessor to assessment week.

What does a C3PAO assessment cost?

Assessors set their own prices, and Atomus doesn’t control them. We’re generally seeing the high end at about $50,000, depending on scope, and simpler environments cost less.

Can a competitor protest my award by challenging my CMMC compliance?

Yes. Where a contract makes CMMC status a condition of award, an unsuccessful bidder can argue at GAO or the Court of Federal Claims that the winner wasn’t eligible. An independent C3PAO assessment gives you a much stronger record to answer with than a self-assessment alone. We have seen anecdotal stories of this in higher priority acquisition areas over the last 3 months.