Should you book a C3PAO assessment during the CMMC pause?

Can you still get a C3PAO assessment while CMMC Phase 2 is suspended?

Yes. The suspension stopped the Department of War from requiring a Level 2 (C3PAO) certification as a condition of award. It did not shut down the assessment system, and certified third-party assessment organizations are still conducting Level 2 certification assessments.

On July 13, 2026, the department announced the immediate suspension of Phase 2, which had been set to begin on November 10, 2026. Two days later, the Cyber AB, which accredits assessors, stated that all CMMC program elements "remain operational and available," and listed C3PAO Level 2 certification assessments first.

So the question for a design firm on defense work has shifted. Booking a slot before November no longer matters. Deciding whether a certificate is worth paying for now, while the government is not asking for one, does.

What did the suspension change for contractors?

It changed what DoD can put in a solicitation. The CIO's implementing memo says program managers and requiring activities "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period," and that "the allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self)." It also says "no waivers shall be granted during the review of the program."

Core obligations stayed. The memo keeps the cybersecurity requirements in DFARS 252.204-7012 in effect, and that clause still requires contractors to report cyber incidents to DoD within 72 hours of discovery. Level 2 (Self) still applies where Controlled Unclassified Information is involved, which means a NIST SP 800-171 self-assessment, a score in the Supplier Performance Risk System (SPRS), and an annual affirmation under 32 CFR 170.16.

As of mid-October 2026, the CIO's CMMC page still describes the suspension and a comprehensive program review, and shows no new Phase 2 start date. The memo says further guidance will follow the review.

For a fuller list of the obligations the suspension left in place, see what still applies after the CMMC Phase 2 suspension.

Who might still want a C3PAO certificate now?

Firms whose customers still ask for one, and firms that expect certification to return. The memo governs DoD solicitations and contracts. It does not address what a prime contractor may ask of its subconsultants under its own subcontract terms, so for many AEC firms the answer sits in their teaming agreements and subcontracts.

Three situations make a voluntary assessment worth a serious look:

• A prime or teaming partner has written a C3PAO certificate into a subcontract, a teaming agreement, or a supplier questionnaire, and has not withdrawn it since July.
• Your firm already did the preparation work for a fall assessment, and the evidence is current. Waiting means paying later to rebuild evidence that has gone stale.
• Defense work is a growth market for your firm, and you want an independent result to show primes regardless of how the review ends.

If none of those apply, a Level 2 (Self) assessment that is accurate and current covers what DoD can require today.

What does a certificate earned during the pause actually give you?

A recorded, independent result with a defined life. Under 32 CFR 170.17, a C3PAO submits assessment results into the CMMC instance of eMASS, which transmits them to SPRS. A passing score produces a Final Level 2 (C3PAO) status. A result with open items that qualify for a plan of action and milestones (POA&M) produces a Conditional status, and those items must be closed out by a C3PAO "within 180 days of the CMMC Status Date," or the conditional status expires.

The rule requires a new certification assessment within three years and an affirmation of continuing compliance "at the time of each assessment" and "annually thereafter." Those obligations come with the certificate whether or not a contract requires it.

What a certificate cannot do is tell you what the review will produce. If DoD changes the program, there is no published guidance yet on how certificates issued during the suspension will be treated. Any firm that books an assessment now is making a business decision under uncertainty, and should say so internally.

Is a Level 2 self-assessment less risky than a C3PAO assessment?

No, not on the risk that matters most. A SPRS score is a representation to the government, and the annual affirmation is signed by a named official at your firm. The Department of Justice launched its Civil Cyber-Fraud Initiative in 2021 to use the False Claims Act against contractors that misrepresent their cybersecurity practices. The suspension did not change that exposure.

The difference is who has checked the work. A self-assessment rests on your own reading of the 110 requirements in NIST SP 800-171 Rev 2. A C3PAO assessment puts an outside assessor between your firm and the score. For some leadership teams, that independent check is the main reason to proceed.

How should a firm decide this quarter?

Start with your contracts, then your evidence, then the calendar. Five steps give a managing principal enough to make the call:

• Ask each prime you subcontract to, in writing, whether it still requires a C3PAO certificate from subconsultants, and file the answers.
• Pull your SPRS record. Confirm the assessment date, the score, and the date of the last affirmation, and calendar the next one.
• Compare your self-assessment against the evidence an assessor would request: policies, network diagrams, the CUI boundary, access reviews, and logs. Gaps here are self-assessment problems whether or not you certify.
• If you have an assessment booked, ask your C3PAO about rescheduling terms and what happens to the fee if you postpone.
• Set a decision date after the next expected guidance from the CIO, so the choice is made once, on current facts.

For many design firms, the most useful result of this exercise is a clearer map of where CUI sits, often in more places than the self-assessment assumed: project shares, email attachments, plotter queues, and files sent to subconsultants.

How does s90 help?

s90 runs IT for architecture, engineering, and construction firms in Los Angeles and Orange County, including firms that handle CUI on defense projects. We maintain the NIST SP 800-171 controls behind a Level 2 assessment, keep the evidence organized between affirmations, and follow the CMMC review so your team can make the certification decision on facts. If you want a second look at your SPRS score or your assessment readiness, we are glad to talk it through.