Orange County’s aerospace and defense supply chain, encompassing machine shops in Anaheim, engineering firms in Irvine, and small manufacturers along the 405 freeway, recently heard news that might have seemed like a reprieve.
The Department of War announced a pause on the next phase of its Cybersecurity Maturity Model Certification (CMMC) program. However, this suspension does not mean local contractors can relax their cybersecurity efforts.
The CMMC program is the Department of War’s system designed to ensure contractors protect sensitive defense information. It is being rolled out in phases. Phase 1, which began on November 10, 2025, introduced self-assessment requirements into defense contracts.
Phase 2 was originally set to commence on November 10, 2026. This phase would have mandated many contractors to pass a third-party Level 2 certification assessment before securing certain work. On July 13, 2026, the Department suspended Phase 2 and initiated a 60-day review of the program. As of this writing, a new start date for Phase 2 has not been announced.
Despite the halt to Phase 2, most day-to-day requirements remain unchanged. Phase 1 is still in effect, and during the review period, the Department stated it would continue enforcing NIST SP 800-171 Rev. 2.
This federal standard, the basis for CMMC Level 2, is enforced through contractor self-assessments and selected government-led assessments. NIST SP 800-171 contains 110 security requirements spread across 14 families, covering areas from access control and multi-factor authentication to incident response and audit logging.
These requirements apply to any company that stores, processes, or sends Controlled Unclassified Information, known as CUI. Importantly, these standards “flow down,” meaning a subcontractor three tiers below a prime contractor is in scope if it handles such data.
Contractors are required to post their self-assessment score to the government’s Supplier Performance Risk System. This score represents their compliance to the federal government. An “optimistic score that does not match reality” is not merely a paperwork issue; the Justice Department has pursued such discrepancies under the False Claims Act.
The practical challenge for many Orange County businesses is the time required for actual remediation. Addressing genuine gaps, such as moving CUI out of commercial email systems, implementing multi-factor authentication across all operations, or establishing a logging system that is actively reviewed, takes “months, not weeks.”
Furthermore, prime contractors continue to ask their suppliers about their readiness, regardless of the program’s pause. A supplier who can provide clear answers regarding their cybersecurity posture is often easier to retain for ongoing work.
For Orange County businesses seeking guidance, Seal Beach-based HD Tech has published a free checklist. This resource maps the CMMC Level 2 requirements to the underlying IT work needed for compliance. The firm has a history of supporting Southern California businesses since 1995, including defense contractors across Orange County, with compliance and managed security services.