Atlantic Digital: CMMC Phase 2 Suspension Does Not Suspend DFARS 252.204-7012 or SPRS Obligations

Firm advises Defense Industrial Base contractors to treat the 60-day federal review as a window to close documented gaps

TAMPA, FL, UNITED STATES, September 15, 2026 /EINPresswire.com/ -- Atlantic Digital, Inc. (ADI), which has served federal and Defense Industrial Base organizations since 2009, is advising defense contractors that the suspension of Cybersecurity Maturity Model Certification Phase 2 leaves their underlying cybersecurity obligations intact.

The U.S. Department of War suspended Phase 2 on July 13, 2026, ahead of its November 10, 2026 effective date, and opened a 60-day review under a newly formed CMMC Reform Task Force. The suspension covers certification assessments by CMMC Third-Party Assessment Organizations and pending CMMC implementation milestones in Department solicitations and contracts, applied through contract modification.

Obligations outside Phase 2 continue to apply. Contractors remain bound by DFARS 252.204-7012 to implement the 110 security requirements in NIST SP 800-171 Revision 2 and to report cyber incidents. Level 1 and Level 2 self-assessment requirements remain in force, along with posting assessment scores to the Supplier Performance Risk System and affirming compliance annually.

The distinction carries enforcement weight. The Department of Justice Civil Cyber-Fraud Initiative has pursued alleged non-compliance with DFARS 252.204-7012 and 252.204-7020 as a basis for False Claims Act liability. With third-party assessments paused, the self-attested SPRS score becomes the government’s primary view of a contractor’s security posture, and an unsupported score carries the same exposure it carried before July 13.

"Contractors are not failing certification because they chose the wrong tools. They are failing because of technical debt," said Matthew Carson, who leads technical architecture on ADI’s CMMC engagements. "Every hour you spend maintaining a system you should have replaced is an hour you are not watching for the threat coming in somewhere else, and it is an hour you are not writing documentation. This review does not retire that debt. It gives contractors sixty days of quiet to” work on it."

Carson made the case at length in a recent long-form interview on IntelliGRC’s podcast, hosted by Steven Molter, covering enclave architecture under budget constraint, privileged access in software development environments, and why compliance programs stall inside organizations that have never consolidated their systems.

ADI engages at the leadership level rather than through IT departments alone.

"CMMC is a business maturity change before it is a technology change," said Matt Hall, co-owner of Atlantic Digital, Inc. "When an IT director carries this alone, it gets lost in the internal politics of the business. When the owner carries it, the plan of action items actually close."
ADI advises contractors against treating the suspension as grounds for revising a previously submitted SPRS score or slowing plan of action closeout. The review is expected to conclude in mid-September 2026.

About Atlantic Digital, Inc.
Founded in 2009, Atlantic Digital, Inc. provides cybersecurity compliance and digital modernization services to federal, defense and Defense Industrial Base organizations, delivered CONUS and OCONUS. Services include vCISO subscriptions, CMMC readiness strategy, NIST SP 800-171 implementation, compliance documentation, and GRC platform integration through the firm’s partnership with IntelliGRC. ADI staffs engagements exclusively with U.S. citizens. ADI is not a CMMC Third-Party Assessment Organization and does not perform certification assessments. More

Matthew Carson
Atlantic Digital, Inc
+1 813 304 2770
email us here

CMMC, Technical Debt & the $1,500 Classified Network with Matthew Carson