The CMMC reform task force’s 60-day clock ran out on September 11. If you’ve been watching for the report — the one that’s supposed to say what replaces Phase 2 — you may have noticed something: nothing came out. No release, no summary, no announcement. Here’s what we actually know, and why the silence itself is informative.
Where the report went
The task force convened in early September to work through the more than 1,100 comments the RFI generated, and its recommendations were due to the DoW Chief Information Officer, Kirsten Davies, on September 11. They have not been made public — and by the Department’s own account, it is up to her whether they ever are. That’s not speculation; it’s how the process was designed. If this sounds familiar, it should: the RFI itself collected those 1,100 comments by email, into inboxes, with no public docket. The reform’s inputs were invisible. Its output may be too.
The one glimpse we have comes from Davies herself, speaking at the Billington Cybersecurity Summit two days before the deadline: more than half of the comments supported the Phase 2 suspension, and the loudest concerns came from the third-party assessor community — focused, tellingly, on how the Department would confirm compliance without them. We said in August that what industry “said” would have to be inferred from what the task force does. That’s now true of the task force itself: watch what the Department does, not what it publishes.
The part nobody’s pricing in: reform might add, not just subtract
Everyone reads “reform” as relief. The record suggests something more mixed. Davies’ remarks and the RFI’s own questions point at a parallel review of the Risk Management Framework and a specific focus on the cybersecurity of operational technology — the shop-floor machines, controllers, and manufacturing systems that most small contractors have never had to think about as a compliance surface. A review that rolls back third-party assessments could, in the same stroke, extend requirements toward OT. If you run CNC machines or networked production equipment, that’s the line to watch in whatever eventually surfaces.
The part that already happened — while nobody was watching
Here’s what most coverage missed: a piece of the outcome arrived before the report did. On September 3, a class deviation memo from DoW’s pricing and contracting directorate instructed contracting officers to follow the FAR Overhaul instead of the final CMMC rule — which removes third-party assessment requirements from contracts as a matter of binding regulation, not temporary policy. Whatever the report recommends, the suspension of Phase 2 is no longer a pause that expires. It’s the operating rule until something replaces it.
What this changes about your obligations
Nothing — and by now you know why. Phase 1 is fully in force: a current NIST SP 800-171 self-assessment, a score posted in SPRS, and a senior official’s affirmation with False Claims Act exposure behind it, plus the standing DFARS 252.204-7012 obligations (cloud security, incident reporting, media preservation). The Department has said it intends to keep enforcing the underlying requirements during the suspension through self-assessments and selected DoW-led assessments — meaning the government can still show up and check, even with the C3PAOs benched. No reform scenario on the table makes a current, accurate self-assessment wasted work. If you haven’t checked where you stand since the suspension, our free SPRS score tool takes about ten minutes and maps you against all 110 requirements.
What to watch now
Three things. Whether Davies releases the recommendations (any time, or never). Formal determinations, which prior reporting pointed at mid-October. And the contract clauses in front of you — after September 3, what’s in your contract is the reform, whatever the report says. We’ll break down the report within 48 hours if it ever becomes public, and the October determinations when they land.
Know exactly where you stand — free
Whatever the task force recommends, a current self-assessment is the floor. Run the free SPRS self-assessment: your real score against all 110 requirements, your prioritized gaps, and your next moves. No signup.
Calculate your SPRS score →Score, document, plan — free
The reform debate will run for months; what your contracts require today won’t wait for it: calculate your SPRS score, draft your SSP, and build your POA&M — all free, in your browser. New to all of this? Start with Where Do You Stand? For the background to this story, see CMMC Phase 2 Suspended: What It Actually Means, what happened when the reform RFI closed, why your SPRS score outlived the deleted Basic Assessment tier, and what you’re signing in the annual affirmation.