The Department of War has paused the CMMC Phase II certification deadline pending a 60-day review, but underlying obligations remain unchanged: NIST SP 800-171 self-assessments, DFARS 252.204-7012 requirements, and DoW's right to audit at any time all still apply. CMMC Level 2 and Level 3 certification requirements can't be contractually enforced by DoW for now, though prime contractors may still require them independently, and C3PAO assessments are continuing for those already scheduled. Separately, the FAR Council proposed a rule expanding CUI incident reporting requirements government-wide. Huntress announced its Managed Identity Security Posture Management (ISPM) offering now brings its CMMC documentation coverage from 37 to 55 of the 110 NIST SP 800-171 requirements, adding prevention capabilities across Microsoft 365 environments including Conditional Access Policies and configuration drift monitoring, with updated Shared Responsibility Matrix and Operations Plan materials available in its Trust Center.
Table of contents
DoW Paused the Deadline. Your Compliance Work Isn't Paused.Meanwhile, Huntress Just Got You Closer to Half the ControlsSame Message, Two Fronts: We're Not Slowing Down. Neither Should You.The TakeawayQuestions this post answers
Did the Department of War pause the CMMC Phase II certification deadline?
Yes, the Department of War paused the November 2026 CMMC certification deadline pending a 60-day review, meaning CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) certifications can no longer be contractually required by DoW for now. However, NIST SP 800-171 self-assessments, DFARS 252.204-7012 obligations, and DoW's right to audit self-assessments at any time remain fully in effect. Contractors tracking shifting compliance deadlines can follow regulatory changes like this on daily.dev.
How many NIST SP 800-171 requirements does Huntress support with Managed ISPM?
Huntress support for NIST SP 800-171 requirements increased from 37 to 55 out of 110 total requirements after adding Managed Identity Security Posture Management (ISPM) to its CMMC documentation. This covers more than half the controls a CMMC Level 2 assessment evaluates, with gains concentrated in Access Control, Identification and Authentication, Configuration Management, and System and Communications Protection families. MSPs mapping vendor coverage against compliance frameworks can track updates like this on daily.dev.