With CMMC Phase II Paused, Shadowbear Lays Out What Subcontractors Still Owe

The third-party assessment requirement due Nov. 10 is on hold, but NIST SP 800-171 self-assessments, SPRS scores, and annual affirmations still apply

ASHBURN, VA, UNITED STATES, November 10, 2026 /EINPresswire.com/ — Today was the day the Department of War’s Cybersecurity Maturity Model Certification (CMMC) program was due to enter Phase II, when third-party assessments would have become a standard condition of award for many contracts involving controlled unclassified information. That phase remains suspended. Shadowbear, a veteran-owned managed cybersecurity provider that serves as the outsourced security team for businesses without one, today published a checklist for Northern Virginia subcontractors on what the suspension did not change.

Kirsten Davies, the department’s chief information officer, suspended Phase II on July 13, 2026, and directed a CMMC Reform Task Force to review the program within 60 days. As of Nov. 9, the task force’s findings had not been published and no new start date had been set.

The suspension did not withdraw the CMMC rule or change the clauses already in most defense contracts. Phase I, in effect since Nov. 10, 2025, still requires Level 1 and Level 2 self-assessments where a contract calls for them, a score posted in the Supplier Performance Risk System (SPRS), and an annual affirmation by a senior company official. DFARS clause 252.204-7012 still requires contractors that handle covered defense information to implement the 110 security requirements of NIST SP 800-171 Revision 2 and to report cyber incidents to the department within 72 hours. Prime contractors can also set supplier deadlines of their own.

Three steps for subcontractors

1. Confirm what your contracts require. Check each contract and subcontract for DFARS 252.204-7012, DFARS 252.204-7021, and any CMMC level, and ask each prime in writing what it expects from you this year.

2. Make the SPRS score accurate and current. Score the company against all 110 NIST SP 800-171 requirements, update the system security plan and the plan of action and milestones, and post the result (scores run from -203 to 110) before the annual affirmation comes due.

3. Keep the evidence current all year. Keep the logs, scan results, training records, and policies that show how each requirement is met, so a self-assessment, a prime’s questionnaire, or a future third-party assessment draws on the same record. Compliance automation platforms such as Vanta collect and organize that evidence; the program itself stays with the contractor.

“The pause moved one deadline. It did not change the contract clauses most subcontractors have already signed,” said Ian Garrett, founder of Shadowbear. “A subcontractor that keeps its score honest and its evidence current has a good answer for its prime today, and it will be ready for whatever the task force recommends.”

Shadowbear’s Cyber Defense Suite covers many of the technical controls behind those requirements, including 24/7 managed detection and response, endpoint protection, security monitoring with one-year log retention, zero-trust network access, vulnerability scanning, and patching, and keeps the records that show they are in place. Shadowbear is SPECTRA Certified and was ranked No. 35 on the Washington Business Journal’s 2026 list of the Cybersecurity Companies in Greater Washington.

Subcontractors can book a Cyber Defense Consult at shadowbear.com/contact to review their environment, risks, and goals.

About Shadowbear

Shadowbear is a veteran-owned managed cybersecurity provider based in Ashburn, Virginia. Its Cyber Defense Suite gives businesses 24/7 managed detection and response, security monitoring, employee phishing training, and compliance support for frameworks including CMMC, NIST SP 800-171, SOC 2, and ISO 27001, with no internal security team required. Shadowbear is SPECTRA Level 1 certified and a Vanta partner. Learn more at shadowbear.com.

Ian Garrett
Shadowbear
+1 571-680-6880
hello@shadowbear.com
Visit us on social media:
LinkedIn

Media gallery