Orange County’s aerospace and defense supply chain runs through machine shops in Anaheim, engineering firms in Irvine and small manufacturers up and down the 405. This summer, a lot of those businesses heard one piece of news and stopped listening: the Pentagon hit pause on the next phase of its cybersecurity certification program.
That pause is real. It is also not a pass.
What actually changed in July?
The Cybersecurity Maturity Model Certification program, known as CMMC, is the Department of War’s system for making sure contractors protect sensitive defense information. It rolls out in phases. Phase 1 began on November 10, 2025, and put self-assessment requirements into defense contracts.
Phase 2 was scheduled to start November 10, 2026. It would have required many contractors to pass a third-party Level 2 certification assessment before winning certain work. On July 13, 2026, the Department suspended Phase 2 and opened a 60-day review of the program. As of this writing, no new Phase 2 start date has been announced.
What is still required today?
Almost everything that matters day to day. Phase 1 remains in effect. And while the review runs, the Department said it would keep enforcing NIST SP 800-171 Rev. 2, the federal standard behind CMMC Level 2, through contractor self-assessments and selected government-led assessments.
NIST SP 800-171 contains 110 security requirements across 14 families, from access control and multi-factor authentication to incident response and audit logging. If a company stores, processes or sends Controlled Unclassified Information, called CUI, those requirements apply. They also flow down: a subcontractor three tiers below a prime is in scope if it touches the data.
Why waiting is the expensive choice
Contractors post their self-assessment score to the government’s Supplier Performance Risk System. That score is a representation to the federal government. An optimistic score that does not match reality is not just a paperwork problem; it is the kind of gap the Justice Department has pursued under the False Claims Act.
The practical issue is time. Closing real gaps, such as moving CUI out of a commercial email tenant, rolling out multi-factor authentication everywhere or building a logging system someone actually reviews, takes months, not weeks. Primes are also still asking suppliers about their readiness, pause or no pause. A supplier who can answer cleanly is easier to keep.
Five things OC suppliers can do this quarter
- Find the CUI. List every device, account and cloud service that touches controlled data. You cannot protect what you cannot list.
- Score yourself honestly. Walk through all 110 requirements and post a score you can defend.
- Write the plan. A Plan of Action and Milestones turns gaps into a dated punch list.
- Check your email and file sharing. Many contractors handling CUI need a government-grade cloud environment rather than standard commercial accounts.
- Keep the evidence. Policies, screenshots and logs prove the controls are working, which is what any assessor asks for first.
For a plain-English walkthrough of the CMMC Level 2 requirements mapped to the IT work behind each one, Seal Beach-based HD Tech has published a free checklist. The firm has supported Southern California businesses since 1995 and works with defense contractors across Orange County on compliance and managed security.
