The CMMC Pause: What Australian businesses need to know
If you're an Australian business supplying to the US Defense supply chain, the latest news on CMMC may have you asking how the changes will affect you. The short answer? The audit process has been paused. Your obligations have not.
On 13 July 2026, the US Department of War suspended Phase II of the Cybersecurity Maturity Model Certification (CMMC) program. Phase II was the stage that would have required an independent auditor to certify your cyber security from 10 November 2026. Later stages have been paused too, and a task force is now reviewing the whole program. Whilst we were expecting an update in mid-September, we are yet to here any news.
If you supply into US Defense programs, here is what it means for you:
What changed
One thing: Who checks your homework.
For now, contracts can only ask you to assess yourself, not to be certified by an outside auditor. Where contracts already include the audit requirement, it will be removed.
What did not change
Everything that matters.
You still have to meet the same US security standard, NIST SP 800-171. All 110 controls of it.
You still have to complete a self-assessment and have a senior person sign off on it.
You still have to protect defence information under your existing contract clauses.
The US government can still audit you directly, and has said it will do so selectively.
The Department was clear about this. It is cutting the paperwork burden, not lowering the security bar.
Why stopping now presents a high risk
Your signature is a legal promise. A self-assessment isn't a box-tick. Someone senior in your business signs a declaration that goes into the US contracting system.
Getting it wrong isn't an admin error. In the US it's the basis for serious legal claims. With no auditor in the middle, there is now nothing standing between your claim and your liability.
Your prime contractor won't ease off. Most Australian firms contract through a prime or a larger supplier, and they've likely built CMMC requirements into their supplier terms. A pause in Washington doesn't rewrite your contract, and primes will maintain their high expectations.
Paused doesn't mean cancelled. The review is looking at how to check cyber security maturity, not whether it should or not. Something will come back, probably a solution that is simpler and better suited to small business. Companies that kept going will be ready. Companies that pause will be scrambling to a deadline, competing for a small pool of auditors, alongside everyone else who waited.
The Australian angle
AUKUS means more US technical data is flowing into Australian businesses, and heightened scrutiny of the systems holding it.
The good news is that almost none of this work is wasted. The controls behind NIST SP 800-171 overlap with DISP membership, the ACSC Essential Eight, and ISO 27001. A few shared pillars include multi-factor authentication, access controls, patching, logging, staff training, and incident response. This is similar evidence you need for Australian Defence contracts, for insurers, and increasingly for any large customer.
The bottom line is that in Defence, cyber security maturity is never wasted spend. The rules around it change, but the threats remain.
6 things to do in the next 60 days
We recommend you use the pause to your advantage. Maintain your momentum and continue to uplift your organisation's capabilities.
Know your data. Where does sensitive US Defense information enter, sit and move in your business?
Score yourself honestly. Complete or refresh your self-assessment without being optimistic! After the pause, when external audit is required, you won’t want to repeat the exercise.
Get your paperwork straight. A current security plan and a real improvement plan are the first things anyone will ask for.
Fix the gaps now, without an audit deadline driving up your costs.
Ask your primes what they still expect from you. Don't assume anything has changed.
Watch and wait. Whatever replaces Phase II has already started taking shape.
If you have questions or need support, contact the team at De Stefano & Co for expert advice on developing your CMMC capability, managing internal audits, and navigating compliance assessments.
