CMMC Consulting for Indian Companies: What the Phase 2 Pause Means for Your US Defense Supply Chain

If your company supplies software, engineering, manufacturing or support services to a US defense contractor, you have probably heard the letters CMMC. You may also have heard, in July 2026, that part of the programme was suddenly put on hold.

So is CMMC still something to worry about? Short answer: the third-party certification rollout is paused, but the security obligations underneath it are not. This guide explains what CMMC is, what the pause changed, what it did not, and how an Indian supplier can stay ready while the rules settle.

CMMC in plain language

CMMC stands for Cybersecurity Maturity Model Certification. It is the US Department of Defense’s way of checking that companies in its supply chain protect sensitive information. The final rule took effect on 10 November 2025, which started the first phase of the rollout.

The model depends on what kind of information you handle:

• Federal Contract Information (FCI): basic information not meant for public release. This falls under Level 1, which is a self-assessment.
• Controlled Unclassified Information (CUI): more sensitive information that needs stronger protection. This falls under Level 2, which is based on the 110 requirements in NIST SP 800-171. Depending on the contract, Level 2 can be a self-assessment or an assessment by a third party known as a C3PAO.
• Level 3: an enhanced level for the most critical programmes, assessed by the government.

The level you need is driven by the data you handle, not by the size of your company.

Why this matters to companies in India

You might think a US defense rule has nothing to do with a company in Pune or Bengaluru. In practice, requirements travel down the supply chain. A US prime contractor that must meet a requirement will typically pass it on to the subcontractors who handle the same data on its behalf. If your work touches CUI, the prime will want to see evidence that you protect it.

That is why Indian IT services firms, engineering houses, electronics makers and BPOs working with US defense primes are asking about CMMC readiness. Even if nobody has asked you yet, a customer’s security questionnaire can arrive at any time.

What the pause changed, and what it did not

The original plan had four phases, with Phase 2 due to begin on 10 November 2026. That was the point at which Level 2 third-party (C3PAO) assessments were expected to become a standard condition in contracts involving CUI.

On 13 July 2026, the US Department of War announced an immediate suspension of the move to Phase 2, along with other pending and future CMMC milestones. It also launched a 60-day review through a CMMC Reform Task Force, and a follow-up memo told contracting teams to remove Level 2 (C3PAO) and Level 3 requirements from solicitations. The stated aim was to reduce the cost and paperwork burden, especially for small and non-traditional businesses.

Here is what stayed the same:

• Phase 1 is still in effect. Level 1 and Level 2 self-assessments continue.
• DFARS 252.204-7012 still applies. This clause has required contractors to protect covered defense information in line with NIST SP 800-171 for years.
• Your score and your statements still matter. A current self-assessment score in the SPRS system is still expected, and an inaccurate attestation carries legal risk. As several US law firms have pointed out, a pause on third-party assessments is not a pause on False Claims Act exposure.

As for the review itself, reports indicate that the task force delivered its recommendations to the Department of War’s CIO around 11 September 2026. At the time of writing, the recommendations had not been made public, and there was no announced restart date for Phase 2. A task force report is advice, not a rule, so the final shape of CMMC is still unknown.

A practical CMMC readiness roadmap for an Indian supplier

The sensible response to uncertainty is to keep doing the work that is useful whatever the final rules turn out to be. Here is a roadmap you can follow.

1. Confirm whether you handle CUI. Ask your prime contractor directly, and ask for the contract clauses that apply. Do not assume.
2. Define your scope. Decide which systems, people, locations and vendors store, process or transmit CUI. A tightly scoped environment is cheaper to secure than your whole company.
3. Run a gap assessment against NIST SP 800-171. Compare each of the 110 requirements with what you do today and mark each as met, partly met or not met.
4. Write your System Security Plan (SSP). This document describes how each requirement is implemented in your environment.
5. Build a Plan of Action and Milestones (POA&M). List every gap with an owner, a fix and a date.
6. Collect evidence as you go. Screenshots, configuration exports, policies, training records and logs show an assessor that controls are real.
7. Keep your SPRS score honest and current. Update it when your position changes, and make sure the person who signs off understands what they are attesting to.

The role of a consultant versus a C3PAO

It is worth being clear on who does what. A CMMC consultant helps you prepare. That means gap assessments, documentation support, remediation planning and mock reviews. A C3PAO is an authorised third-party assessment organisation that carries out the official Level 2 certification assessment. Preparing you and certifying you are separate roles, and an assessor cannot certify work that it designed.

When you talk to any firm that offers CMMC consulting, ask what exactly it is authorised to do, and be wary of anyone who blurs the line between readiness support and official certification.

Three common misunderstandings

• “The pause means CMMC is over.” It does not. Phase 1 self-assessments, DFARS 252.204-7012 and the SPRS requirement are all still in place, and the review could lead to anything from small tweaks to a bigger overhaul.
• “We are too small to matter.” CMMC is driven by the type of data you handle, not your headcount. A ten-person firm that holds CUI has the same basic duty as a large one.
• “We will deal with it when the rules are final.” Building a compliant environment takes time. Teams that scope, document and fix gaps now can respond quickly when a customer asks, while teams that wait often find the work harder to fit into a bid deadline.

What to do right now

If you have been waiting for clarity, this pause is not a reason to stop. Work on NIST SP 800-171 is useful on its own, because it improves your security and prepares you for customer questionnaires and other frameworks. Companies that use this window to scope their environment and fix the biggest gaps will be able to move quickly once the rules are confirmed.

The team at VIES Consulting can help you understand where you stand against the requirements and put a practical plan together. Book an appointment to talk through your CMMC readiness.

Frequently Asked Questions

1. What is CMMC?

CMMC, or Cybersecurity Maturity Model Certification, is a US Department of Defense programme that verifies whether contractors and subcontractors protect sensitive government information. It sets levels of requirements based on the type of information a company handles.

2. Does CMMC apply to companies in India?

It can. The requirements are written into US defense contracts, and prime contractors typically pass them on to subcontractors that handle the same information, wherever those subcontractors are based. If you work with a US defense prime, ask them which clauses apply to you.

3. What is the difference between FCI and CUI?

Federal Contract Information (FCI) is basic information created for or provided under a government contract that is not meant for public release. Controlled Unclassified Information (CUI) is more sensitive and needs stronger safeguards. The type of information you handle determines the level you need.

4. What are the CMMC levels?

Level 1 covers basic protection of FCI and is a self-assessment. Level 2 covers CUI and is based on the 110 requirements in NIST SP 800-171, with either a self-assessment or a third-party assessment depending on the contract. Level 3 adds enhanced requirements for the most critical programmes.

5. What happened to CMMC Phase 2?

On 13 July 2026, the US Department of War suspended the transition to Phase 2, which was due on 10 November 2026, and launched a 60-day review. Third-party Level 2 assessment requirements were removed from solicitations, while Phase 1 requirements stayed in place.

6. Has CMMC been cancelled?

No. The programme was paused, not cancelled. Phase 1 self-assessment requirements and the DFARS 252.204-7012 clause remain in force, and the outcome of the review will determine what changes next.

7. Do we still need to follow NIST SP 800-171?

Yes, if your contracts include DFARS 252.204-7012 or require it. The pause affects third-party assessments, not the underlying obligation to protect covered defense information.

8. What is a C3PAO?

A C3PAO is a Certified Third-Party Assessment Organization, an authorised body that carries out official CMMC Level 2 certification assessments. Consultants who help you prepare are separate from the C3PAO that assesses you.

9. What is an SPRS score?

SPRS is the US government’s Supplier Performance Risk System. Contractors post a score there that reflects how well they have implemented NIST SP 800-171. The score must be accurate and kept current, because it forms part of what you are attesting to.

10. How long does CMMC readiness take?

It depends on your starting point, the size of your scope and how many gaps need fixing. Industry assessors commonly describe a range of several months to a year or more. Scoping your environment tightly is one of the best ways to shorten the journey.