CMMC Phase 2 Is Paused: Here's What MSPs Should Tell Their Clients Right Now. On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II. Which begs the question: “Does this mean we can stop worrying about compliance?” NinjaOne’s Head of MSP Partnerships, Paul Redding, along with Technical Marketing Manager, Zach Therrien, hosted a webinar covering FedRAMP and NinjaOne’s federal platform. During the webinar, Paul shared his perspective on the Phase II suspension and explained how MSPs should discuss it with their clients. Let’s break it down. But first, a disclaimer: none of the information presented in this video should be taken as legal advice, and contractors are advised to confer with legal counsel for their specific obligations. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. What Exactly Was Suspended? The CMMC suspension does not mean CMMC has been canceled. The Department of War announced that Phase II, which was scheduled to take effect on November 10, 2026, is suspended pending a 60-day review led by the new CMMC Reform Task Force. C3PAO requirements for contractors, and pending and future CMMC implementation milestones, will be on pause while the review is underway. The Phase I self-assessment requirements remain in effect, along with other legal obligations. For instance, DFARS clause 252.204-7012 is still the standard for contractors. We are also still following NIST SP 800-171 Rev. 2 for self-assessments and select government-led reviews during the suspension period. What Does This Mean for MSP Clients? While third-party certifications are on pause, contractors are still expected to self-attest to meeting the requirements. Falsified attestations could have legal ramifications for a business under the False Claims Act. With this on the line, MSPs should encourage their clients that, while there is no longer a looming November certification deadline, any self-attestations must still be verifiable. Does the CMMC Suspension affect FedRAMP? One of the main points Paul made is that FedRAMP is independent from the CMMC and is not affected by CMMC’s status. FedRAMP continues to serve as one of the primary benchmarks for identifying which cloud tools are authorized to handle sensitive federal data — independent of whatever changes emerge from the CMMC review. As more and more industries become involved with federal data, MSPs can use their FedRAMP knowledge to their advantage, especially while the CMMC protocols are being reworked. What Should MSPs Tell Clients to Do Next? Now that we know the implications of the CMMC Phase II suspension, what are the next steps MSPs can take? Here are Paul’s recommendations. Number one, Don’t stop compliance work. Again, don’t stop compliance work. There are still active requirements, risk assessments, and documentations that are still required and need to be accomplished. Only the certification was suspended; the standards remain in place. Number two Correct the “it’s over” narrative. Make sure to talk to your clients and emphasize that, while there is no longer a November deadline, compliance remains a must. Especially given the legal repercussions of inconsistent self-attestations. Number three Keep an eye out for the 60-day task force report. Set to be released by mid-September 2026, the task force report should provide recommendations and guidelines for proceeding with the reformed CMMC program. Preparations should be made to avoid panicking once new deadlines are set. Number four Talk to your clients about FedRAMP authorized tooling. The Phase II suspension is a good moment to raise this with any client that touches federal data in any way, not just the Defense Industrial Base (or DIB), but also healthcare, legal, fintech, or state and local government clients. Ask whether the tools in their stack are FedRAMP-authorized, regardless of where CMMC ends up. The bottom line is that even though CMMC Phase II is suspended, organizations still have security, self-assessment, and contractual obligations to fulfill. The suspension should buy more time for preparation, not stop compliance altogether. For a fuller discussion on CMMC Phase II, watch Paul Redding’s full webinar linked in the description below.