CMMC Certification Deadline Paused, but CUI Protection and Self-Assessments Remain Required

Summary

DoW paused the November 2026 CMMC certification deadline, but NIST SP 800-171 self-assessments and CUI safeguards remain required. Huntress says its Managed ISPM support now maps to 55 of 110 requirements.

Key points

DoW paused the November 2026 deadline for C3PAO or DIBCAC certification, pending a 60-day review.
NIST SP 800-171 Rev. 2 self-assessments and DFARS 252.204-7012 obligations to safeguard covered defense information remain in force; DoW can still audit self-assessments.
DoW can no longer contractually require Level 2 or Level 3 certification during the pause, and solicitations with that requirement are being amended. Prime contractors may still require certification.
The FAR Council proposed a separate government-wide rule requiring CUI incident reporting within 72 hours.
Huntress says adding Managed ISPM raised its mapped support for NIST SP 800-171 requirements from 37 to 55 of 110.
Huntress describes ISPM features for enforcing Microsoft 365 security settings, managing conditional access, monitoring configuration drift, and documenting continuous enforcement.

Article Details

Event Type: DoW paused the CMMC Phase II certification deadline pending a 60-day review, while existing CUI protection and self-assessment obligations remain in force; Huntress expanded its documented support from 37 to 55 of the 110 NIST SP 800-171 requirements through Managed ISPM.
Impact: Organizations no longer face the November 2026 deadline for DoW-required C3PAO or DIBCAC certification during the pause, but must continue safeguarding CUI, conducting required self-assessments, and remain subject to DoW audits. Prime contractors may still require certification independently. Huntress says the ISPM update adds coverage for 18 requirements.