Two kinds of contractor came out of the summer. One paid for a third-party assessment and holds a certificate that no new solicitation can currently require. The other pulled out of the C3PAO queue and is waiting to see what the Department does next. Both are asking the same question, and both are getting the same vague answer. Here is the specific one.

A CMMC Level 2 (C3PAO) certification remains valid for three years from its CMMC Status Date under 32 CFR 170.17, and neither the July 13 suspension nor the September 3 class deviation withdrew any certificate already issued. Because DFARS 252.204-7021(d)(1)(i) requires the contract’s CMMC level “or higher,” a Level 2 (C3PAO) status satisfies every Level 1 (Self) or Level 2 (Self) designation a contracting officer can now insert. What the certificate does not do is pause your obligations: the annual affirmation, the six-year hashed-artifact retention, and the SPRS score all continue, and the government keeps the right to override your status with a DCMA DIBCAC assessment.

KEY TAKEAWAYS
  • Cyber AB reported 1,391 Final Level 2 certificates issued as of its May 2026 town hall. Nothing in the July 13 suspension memos or the September 3 class deviation cancels one. A certificate is valid for three years from the CMMC Status Date under 32 CFR 170.17.
  • DFARS 252.204-7021(d)(1)(i) requires the designated level "or higher." A Level 2 (C3PAO) status therefore covers any Level 2 (Self) or Level 1 (Self) requirement that appears in a solicitation during the suspension. You do not redo the self-assessment.
  • Three clocks did not stop: the three-year certification cycle, the annual affirmation under 32 CFR 170.22 and 7021(d)(3), and the six-year hashed-artifact retention under 32 CFR 170.17. Miss the affirmation and the certificate stops earning you eligibility.
  • Primes were never bound by the suspension. DFARS 252.204-7021(f) requires them to flow the substance of the clause down, and several kept Level 2 (C3PAO) in their subcontract terms. Your certificate answers that demand; a paused assessment does not.
  • If you pulled out of the queue, you are not on hold. Level 2 (Self) remains the codified default, the SPRS score is a representation to the government, and DOJ collected $507,144 from LOGZONE in June over a self-assessment score an audit found inaccurate.

Two camps, one rulebook

On September 15, Professional Services Council president Stephanie Kostro told Federal News Network that the contractors calling her split cleanly into two groups. One group finished a third-party assessment before the suspension and treats the certificate as a competitive advantage. The other has decided not to pursue certification unless it becomes unavoidable, and has stepped out of the C3PAO queue until the Department says what it wants. Her comment on the first group was that sunk costs are sunk, and the money was well spent because cybersecurity requirements are not going anywhere. Her comment on the second was that she did not blame them.

That is a fair reading of the mood. It is not a reading of the rules, and the rules are what decide whether your certificate is an asset or a wall decoration. The class deviation breakdown from last week covered what Revision 3 of 2026-O0025 changed for contracts in general. This piece is narrower. It is about what the suspension means if you already hold the piece of paper, and what it means if you decided not to get it.

The question underneath both camps is simpler than either wants it to be. The accounting you were preparing to give an assessor in November is still owed. What changed is who you give it to, and whether anyone schedules the appointment.

Two camps, same rules: certified contractors hold a three-year status, paused contractors are not off the hook, and both still affirm annually

What your certificate is still worth

Three things, each traceable to a regulation rather than a vendor blog.

It was not withdrawn, and it runs for three years. The July 13 action was a pair of memoranda directing the Department’s own acquisition workforce to stop designating Level 2 (C3PAO) and Level 3 (DIBCAC) in new requirements. The September 3 class deviation directs contracting officers to remove third-party assessment requirements from solicitations and contracts. Neither instrument touches 32 CFR Part 170, and neither instructs eMASS or SPRS to alter a CMMC Status already recorded. Under 32 CFR 170.17, a Final Level 2 (C3PAO) status remains valid for three years from the CMMC Status Date, at which point a new certification assessment is required to maintain it. If you were certified in March 2026, your status runs to March 2029 regardless of what the task force recommends in October.

It satisfies any lower designation, automatically. This is the clause language most contractors have not read. DFARS 252.204-7021(d)(1)(i) requires the contractor to have and maintain, for the duration of the contract, a current CMMC status at the designated level “or higher.” The contracting officer’s insert options are Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), and Level 3 (DIBCAC). During the suspension the first two are the only ones being inserted. A Level 2 (C3PAO) status sits above both. You do not run a separate self-assessment, you do not post a separate self-assessment score, and you do not create a second CMMC UID for the same scope. Your existing status in SPRS answers the requirement as written.

It answers your prime, which the suspension never did. The suspension bound Department personnel. DFARS 252.204-7021(f) requires primes to insert the substance of the clause in subcontracts that will involve FCI or CUI, and 32 CFR 170.23 governs how the level flows down. A prime that wrote Level 2 (C3PAO) into its supplier terms before July 13 was under no obligation to rewrite them after, and the volume of subcontractors reporting exactly that through August suggests plenty did not. Cyber AB CEO Matthew Travis called a C3PAO certification a “compelling calling card for subcontracting viability.” That is the polite version. The practical version is that the prime’s supplier portal has a field for it, and the paused contractor’s field is empty. The prime flowdown analysis from June covers what those portals were accepting before the suspension; the suspension gave primes a reason to accept less, not more.

What the certificate does not switch off

Here is the part the certified camp tends to skip, because the assessment felt like a finish line. Three clocks are still running, and two of them can quietly void the value of the certificate without anyone telling you.

The annual affirmation. 32 CFR 170.22 and DFARS 252.204-7021(d)(3) require an affirming official to affirm continuous compliance in SPRS annually, for each CMMC UID, for the life of every contract carrying the clause. The certificate establishes the status. The affirmation keeps it current. A Level 2 (C3PAO) status with a lapsed affirmation is not eligible for award, and the annual affirmation walkthrough covers the cycle in full. The affirmation liability breakdown covers why the person signing it has more personal exposure than the person who signed the C3PAO engagement letter.

The artifact retention requirement. 32 CFR 170.17 requires the OSC to retain the hashed artifacts used as evidence for the certification assessment for six years from the CMMC Status Date, hashed with a NIST-approved algorithm so their integrity can be demonstrated. Six years outlasts the certificate by three. If your evidence lives in a consultant’s shared drive, a departed IT manager’s laptop, or a folder that was never hashed, you hold a certificate you may not be able to defend. The C3PAO evidence guide lists what was examined; the retention rule says you still have to be able to produce it in 2032.

The government’s override. 32 CFR 170.17 reserves the Department’s right to conduct a DCMA DIBCAC assessment of a certified OSC. If the DIBCAC result shows the requirements were not achieved or were not maintained, the DIBCAC result takes precedence over the pre-existing CMMC Status, and the OSC becomes ineligible for further Level 2 (C3PAO) awards on that scope until a new status is achieved. The DIBCAC preparation piece explains the assessment; the point here is that the certificate does not immunize you from it. Government-led Medium and High assessments also survived the class deviation intact under DFARS 252.240-7997.

One more detail for anyone holding a Conditional rather than Final status: the 180-day POA&M closeout window in 32 CFR 170.21 did not pause either. C3PAOs can still perform closeout assessments. If your 180 days run out with the POA&M open, the conditional status expires on its own schedule, suspension or not.

Three clocks still run: three years on the status, one year on the affirmation, six years on hashed artifact retention

If you paused: what waiting actually requires

The paused camp has a different problem, which is that “waiting” sounds like a state of rest and is not one.

Under the class deviation, Level 2 (Self) is the codified default for CUI work. That means the exact same 110 requirements of NIST SP 800-171 Rev 2, assessed by you rather than a C3PAO, scored under the DoD Assessment Methodology, and posted in SPRS as a representation the government relies on for award. The SPRS score improvement guide covers how that score is built; the self-disclosure piece covers what to do if you find out it is wrong.

The distinction between the camps, then, is not whether you are assessed. It is whether anyone independent looked before the number went into the system. The Justice Department spent the review window demonstrating what that gap costs: $507,144 from LOGZONE in June over a near-perfect self-assessment score that a DoD audit found inaccurate, and $2,042,518 from Honeywell Aerospace on September 1 over NIST SP 800-171 noncompliance on a single network. Neither case needed a C3PAO. Neither needed CMMC. Both ran on a self-reported statement that did not match the environment.

Kostro’s framing of the paused camp was that companies far back in the queue are reasonably waiting to learn what the actual requirements will be. That is true for the third-party appointment. It is not true for the controls, the score, or the affirmation, none of which are waiting for the task force. A contractor who paused the assessment and also paused remediation has not preserved optionality. It has moved from a scheduled verification to an unscheduled one, and unscheduled verifications in this program come from DIBCAC or from a former employee with a lawyer.

There is also the practical matter of the queue. Kostro noted that contractors deep in the backlog are pausing. That backlog was the C3PAO scheduling wall covered in May, and it does not shrink while you wait. If the task force restores third-party assessment in any form, the contractors who kept their place hold a calendar slot. The ones who left hold a place at the back.

The Reddit question: has certification gotten anyone more business?

The r/CMMC thread ranking for this search asks whether passing Level 2 has generated new business, and the most-upvoted answer is a candid no, not yet, because few contracts have carried the requirement. Six months and a suspension later, that answer is more accurate than when it was written.

It is worth being honest about what the certificate is for. It is not a sales engine. It is a defensive asset with three specific uses: it keeps you eligible for any Level 2 designation a contracting officer inserts, it satisfies the primes who kept the requirement in their supplier terms, and it means the number in SPRS was verified by someone other than you before the affirming official signed under it. For a 30-person machine shop or a 60-person engineering sub, that third use is the one that matters most, because it is the one that shows up in an FCA complaint.

Contractors who paid for certification and expected a pipeline were sold the wrong story. Contractors who paid for it and expected a defensible position got what they paid for, and the class deviation made that position more valuable, not less, because it removed the third-party check for everyone who did not already have one.

What to do this month

If you hold a Final Level 2 (C3PAO) status:

  1. Pull the CMMC Status Date from SPRS and calendar two dates: the three-year expiry, and the next annual affirmation. The affirmation date is the one that voids the certificate quietly.
  2. Locate the hashed assessment artifacts, confirm the hashes verify, and confirm the retention location will still exist in six years. If a consultant holds them, get your own copy now.
  3. Send each prime a one-paragraph note: your Level 2 (C3PAO) status, its CMMC UID, its status date, and a request that they confirm which level their subcontract terms now require. Get the answer in writing.
  4. Brief the affirming official that the deviation removed the third-party check from everyone else’s contracts and left theirs the primary verification event. Show them the evidence behind what they will sign next.

If you paused the assessment:

  1. Confirm whether your prime’s subcontract terms still say Level 2 (C3PAO). If they do, the pause did not reach you, and you need a conversation about timeline, not a decision to stop.
  2. Re-score against the current environment, not against the SSP as it read when you last posted. A score submitted against last year’s network is a live misrepresentation.
  3. Keep the evidence trail running exactly as if the C3PAO were arriving. DIBCAC authority survived the deviation. Whistleblowers never needed it.
  4. Decide, in writing, what would make you re-enter the queue: a task force recommendation, a prime demand, a specific contract. A plan to wait is a plan. A habit of waiting is not.

The bottom line

The suspension sorted contractors into people who finished the assessment and people who did not, and then told both groups the same thing: no new contract will require the certificate for now. That sentence describes the award process. It does not describe the certificate, which remains valid for three years under 32 CFR 170.17, satisfies any lower designation under 7021(d)(1)(i), and answers the primes that never paused. It also does not describe the obligations, which run on their own clocks for both camps: an affirmation every year, artifacts for six, and a score that has to be true on the day the government reads it. The certified camp holds an asset it can lose through neglect. The paused camp holds an exposure it can reduce through work. The accounting is due either way.

If the immediate job is proving the certificate is still defensible, the CMMC Level 2 Evidence Tracker for NIST 800-171 Audit ($67) maps every artifact to its requirement and assessment objective so the six-year retention has a structure. If you paused the assessment and need to run the full self-assessment regime properly before an affirmation deadline or a prime’s demand forces the timeline, the CMMC Level 2 Readiness Kit: 5 NIST 800-171 Tools ($147) covers scoping, the SSP, the SPRS score, the POA&M, and the evidence trail a DIBCAC assessor or a DOJ attorney would ask for.

Sources