CMMC Phase Two Is on Hold. Your Contract Rules Are Not.

A pause that is easy to misread

If you run a machine shop, a parts maker or an engineering firm that sells into defense work, you have heard about CMMC for years. It is the Pentagon program that checks whether suppliers protect sensitive contract data. Many Oklahoma suppliers were bracing for outside audits that were due to start this November.

Then in July the department hit pause. It is tempting to read that as permission to set the project aside. That would be a costly mistake, because most of what a supplier has to do was never tied to the part that was paused.

What the evidence says

The Department of War CIO site says that on July 13, 2026 the department suspended CMMC Phase II requirements, which had been scheduled for November 10, 2026. The same page says all Phase I self assessment requirements remain firmly in place, and that during the review the department will enforce compliance with NIST SP 800 171 Revision 2 through self assessments and select government led assessments.

Phase 1 began on November 10, 2025, the date the defense contract rule published in the Federal Register in September 2025 took effect. Under it, a company that handles federal contract information, known as FCI, must do a self assessment every year against 15 basic security requirements and enter a sign off in the Supplier Performance Risk System. No open action plans are allowed at that level. Every item has to be met.

A company that handles controlled unclassified information, known as CUI, must assess itself every three years against the 110 requirements in NIST SP 800 171 and sign off again every year. If an assessment lapses because no one signs the yearly affirmation, the status lapses with it. Open items in a plan of action must be closed within 180 days.

The CIO page also states plainly that the pause does not remove the duty to protect information under DFARS clause 7012. That clause has been in defense contracts for years. It requires a contractor to report a cyber incident within 72 hours, keep images of affected systems for at least 90 days, use cloud services that meet the FedRAMP Moderate baseline or its equal when they store covered data, and pass the clause down to subcontractors who handle that data.

This matters at home. The Oklahoma Department of Commerce says the state's aerospace and defense industry has an annual economic impact of $44 billion, includes more than 1,100 aerospace companies and is the second largest industry in Oklahoma. Tinker Air Force Base alone accounts for about $7.5 billion.

Why suppliers fall behind

Nobody knows where the controlled data lives

Drawings, specs and purchase orders arrive by email, get saved to a shared drive, get printed on the shop floor and get copied to a laptop for a meeting. Before you can protect controlled data, you have to know every place it goes. Most small suppliers have never mapped that.

The yearly sign off has no owner

Someone at the company has to affirm it still meets the requirements each year. If that task lives in one person's memory, it gets missed. A lapsed status can cost you the chance to bid.

The score was filled in once and never checked

Many firms posted a score years ago and have changed systems since. New laptops, a new file sharing tool or a new cloud email plan can quietly break a control that used to be in place.

What to do while the pause lasts

1. 1Find out which of your contracts carry FCI only and which carry CUI, and ask your prime if you are not sure.
2. 2Map where controlled files come in, where they are stored, who opens them and where copies end up.
3. 3Shrink that footprint by keeping controlled files in one protected place instead of across email, desktops and personal drives.
4. 4Redo your self assessment against the current requirements and fix the gaps you find.
5. 5Name the person who signs the yearly affirmation and put the date on a shared calendar.
6. 6Write down how you would report an incident within 72 hours and how you would keep system images for 90 days.
7. 7Check that any cloud service holding controlled data meets the FedRAMP Moderate standard or its equal.

The work you do now is not wasted if outside audits return later. Every rule above already applies today, and a company that has its data mapped and its controls in place will be ready for whatever version of the program comes next.

What this means if you run a company in Oklahoma

Oklahoma suppliers compete for work from Tinker, the primes and their larger subcontractors. Those buyers carry their own duty to flow security rules down the chain, and they notice which suppliers can answer questions about data protection clearly and quickly.

Use the pause as breathing room, not a holiday. A supplier that keeps its self assessment honest, its sign off current and its controlled data in one known place is in a stronger spot to win and keep defense work.

At Oklahoma Data Partners, we help Oklahoma defense suppliers map where controlled data lives, tighten how it is stored and accessed and keep the records that back up a self assessment. If you are not sure where your company stands after the CMMC pause, book a consultation.