CMMC Intelligence Report: July 2026

CMMC Program Status: Phase 2 Suspended

On July 13, DoD Chief Information Officer Kirsten Davies signed a memo suspending CMMC Phase 2, the requirement that contractors handling CUI obtain third-party (C3PAO) assessment at Level 2, and froze Phases 3 and 4 alongside it. The memo cites prohibitive compliance costs, a severe shortage of accredited third-party assessors, and complex regulatory timelines pushing small businesses and non-traditional entrants out of DoD contracting.

The suspension was issued via internal DoD memo, not a Federal Register rule change: 32 C.F.R. Part 170 remains formally unamended. In practice, that means the November 10, 2026 deadline that has anchored every conversation in this report since April is no longer an active enforcement date. DoD has stood up a CMMC Reform Task Force to conduct a 60-day review, with a public Request for Information due August 14, 2026 and a report expected around mid-September.

What’s unchanged is arguably more important than what’s paused. Phase 1 obligations remain fully enforceable: contractors handling CUI still must self-assess against all 110 NIST SP 800-171 Revision 2 controls, maintain a current SPRS score with a named senior official affirming its accuracy, and report cyber incidents to DIBNet within 72 hours. With third-party verification on hold, self-certification carries more exposure, not less. False attestations remain an explicit target of the Department of Justice’s Civil Cyber-Fraud Initiative, with False Claims Act liability including treble damages. An inaccurate SPRS score is a bigger liability now than it was in June, because there is no longer a scheduled third-party assessment that would have caught the gap before it became a legal problem.

Assessment Pipeline: What Happens to Booked C3PAO Work

The most common question this report is getting since July 13: what do I do with an assessment I already booked? DoD’s guidance is not to cancel it. Converting a scheduled C3PAO engagement to a readiness assessment or mock assessment preserves the value of the work: you still get an independent, methodical review of your control implementation, documentation, and evidence, without the certification outcome being contingent on a program that is currently under review.

For contractors who had not yet engaged a C3PAO, the suspension removes the hard calendar pressure this report spent April through June documenting, but it does not remove the underlying requirement. NIST 800-171 Rev 2 remediation should continue on its own timeline, independent of when or how Phase 2 resumes. Contractors who use this pause to stop work entirely will be starting from behind again whenever third-party assessment restarts, and self-assessment liability under Phase 1 is running the entire time regardless.

The practical shift is this: the forcing function for CMMC work is no longer a government enforcement date. It is now (1) prime contractor flow-down requirements, which several primes began enforcing ahead of DoD’s own timeline earlier this year, and (2) the exposure sitting behind your own SPRS self-certification. Neither of those paused on July 13.

New Executive Order on Defense Supply Chain Security

A July 20 executive order, published in the Federal Register on July 23, directs the Secretary of War to develop a regulatory process requiring covered contractors and subcontractors, at any tier, to map their supply chains back to raw-material origin and implement due-diligence screening to identify and mitigate sourcing risk. Implementation guidance is due within 180 days.

Combined with expanded Foreign Ownership, Control, or Influence (FOCI) disclosure requirements moving through rulemaking this year, the direction of travel is clear even as CMMC’s specific mechanics are under review: supply chain visibility and ownership transparency are becoming standing requirements, not optional documentation. Contractors at any tier of a defense supply chain should expect sourcing and provenance questions to become a standard part of both prime due-diligence and eventual regulatory review, independent of the CMMC Reform Task Force’s outcome.

DIB Threat Landscape

PTC Windchill / FlexPLM: Mass Extortion Campaign Hits the Defense Supply Chain Directly

Clop-affiliated threat actors exploited CVE-2026-12569 (CVSS 9.8), an unauthenticated remote code execution flaw in PTC’s Windchill and FlexPLM product lifecycle management software, likely as a zero-day starting in early June. PTC patched on June 17 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 25, but the active extortion campaign (threatening to leak data under the subject line “Windchill PDMLink module serious data leak”) didn’t begin until July 20, confirmed hitting organizations across aerospace, automotive, and manufacturing.

The data at risk is exactly what CMMC exists to protect: product designs, bills of materials, and supplier records. PTC’s customer base includes defense contractors, energy suppliers, and electronics manufacturers, making this the single most relevant incident of the month for a CUI-handling readership. If your organization runs Windchill or FlexPLM, confirm patch status against the June 17 release immediately if you have not already. This is not a theoretical exposure, it is an active campaign.

Ransomware Groups Continue Targeting Defense-Adjacent Organizations

The Gentlemen ransomware group claimed an attack on a subsidiary of Indra Group, a Spanish defense, aerospace, and air-traffic-management technology company and NATO cyber coalition member, with an initial ransom deadline later extended to July 9. Indra says the incident was contained to a non-critical environment with no operational disruption. Whatever the ultimate outcome, it is a current, concrete example of a top-tier ransomware group directly targeting a defense-adjacent, NATO-affiliated organization, the same threat category that any CMMC-scoped contractor sits in.

Regulatory Watch

August Action Items

August is a month to re-baseline, not to stand down. The items below reflect what actually changed on July 13, and what didn’t.