Submit any questions you would like answered on the podcast!

Here are the actual memos (Definitely worth a read):  

• https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902
• https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf

The Department of War just paused the rollout of CMMC Phase 2's third-party certification requirement for 60 days. Austin breaks down what the memo actually says, what it doesn't say, and why "certification is paused" is not the same thing as "compliance is paused."

In this episode:

• What the 60-day pause on CMMC Phase 2 actually covers (hint: it's the certification verification process, not the underlying NIST 800-171 requirements)
• Why this could ultimately make your path to CMMC less expensive, and why that's not a reason to slow down
• Why contractors who are already deep into implementation are in the strongest position no matter which direction this goes
• Why assuming "compliance has disappeared" is the riskiest read of this news
• What happens if third-party certification gets replaced with a stronger self-attestation or spot-check model, and why unsupported SPRS scores are already a liability
• A trade show story about a Department of War investigator actively pursuing ITAR fraud leads, and what that says about enforcement appetite right now
• What to actually do in the next 60 days while DoD figures out the future of the verification model