The U.S. Small Business Administration says the Department of War has suspended Phase II of the Cybersecurity Maturity Model Certification program, and that is not just federal alphabet soup.
For the small businesses that sell into defense supply chains, this is a real pause with real money attached. The SBA says the requirement was scheduled to start on November 10, 2026, and that the current framework was pushing many qualified small firms toward costly assessments and away from defense work altogether. SBA release
The headline number is worth sitting with. In the SBA’s release, the agency says compliance costs can reach about $593,800 for small firms needing a third-party assessment and about $388,600 for firms eligible for self-assessment. SBA also says more than 100,000 small businesses could be affected.
That means two things for owners.
First, this is a contract review moment, not a victory lap. If you sell to prime contractors or directly into the defense industrial base, you should know exactly which contracts mention CMMC, what data you handle, and whether your customer is still expecting the same timing after this pause.
Second, the pause is a budgeting opportunity. If your team already started paying consultants, tooling vendors, or compliance advisers, stop and separate the sunk cost from the next dollar. Do not keep funding a certification path on autopilot just because the paperwork already started.
The practical checklist for this morning:
- inventory every defense-related contract and note which ones mention CUI or FCI
- ask primes whether they expect the same CMMC timing after the suspension
- compare the cost of self-assessment work against the cost of waiting
- document any controls you already have, so you are not rebuilding from zero later
- hold off on expensive extras until the final path is clear
This is also a reminder that cybersecurity in federal contracting is a business decision, not only an IT one. The right framework can protect your data and keep you eligible for work. The wrong or rushed one can price you out before you ever bid.
The useful move today is simple: treat this suspension as a chance to renegotiate your compliance plan before it turns into a bill.
Owner takeaway
If you are a small defense contractor, use the pause to verify scope and costs now. Waiting may be the cheapest decision if the rule changes again.