Cyber Grants Alliance pushes DIB manufacturers to seek CMMC gap assessments

Cyber Grants Alliance is urging defense industrial base manufacturers to move quickly on Level 1 and Level 2 cybersecurity gap assessments after the Pentagon paused Phase 2 CMMC third-party assessments on July 13, 2026. The group says core compliance duties remain in place and companies risk contract setbacks if they wait.

Why it matters: - Manufacturing defense industrial base companies still face mandatory cybersecurity obligations even though Phase 2 CMMC third-party assessments have been paused. - Delayed compliance work can create contract risk, especially for suppliers competing for prime contractor business during the review window. - Gap assessments can identify remediation needs now and may help companies prepare for whichever certification framework follows.

What happened: - Cyber Grants Alliance said the Department of Defense’s July 13, 2026 announcement suspending Phase 2 CMMC third-party assessments does not change core compliance requirements. - The nonprofit urged DIB manufacturers to use Level 1 and Level 2 gap assessment grants before enforcement deadlines and before any future framework changes. - Executive Director Rick Dassler said manufacturers “cannot afford to sit on the sidelines.”

The details: - Phase 1 self-assessments, NIST SP 800-171 Rev. 2 compliance, and DFARS 252.204-7012 safeguarding requirements remain legally enforceable, the group said. - The pause affects certification timing, not the underlying duty to protect Federal Contract Information and Controlled Unclassified Information. - Cyber Grants Alliance said prime contractors may still require C3PAO certifications for supplier programs, even while the government review is underway. - Companies without documented compliance status could lose opportunities during the 60-day review period. - The group warned that companies waiting for a final policy outcome could face rushed and unfunded remediation later. - The Level 1 Gap Assessment Grant is valued at $5,000 in-kind and covers all 17 basic cyber hygiene practices across six control families under FAR 52.204-21. - The Level 2 Gap Assessment Grant is valued at $10,000 in-kind and evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling CUI. - Cyber Grants Alliance said the grants are designed to remove financial barriers for small manufacturers. - The organization said the assessments can also provide competitive differentiation with primes and create a baseline for future compliance work. - The nonprofit describes itself as focused on making cybersecurity accessible to small and medium-sized businesses in the defense industrial base through grants, education and resources. - Cyber Grants Alliance directed applicants to its Level 1 Grant and Level 2 Grant pages for more information. - The company also listed its LinkedIn and Facebook pages in the release.

Between the lines: - The announcement frames the Pentagon pause as a temporary process shift, not a relief from cybersecurity obligations. - Cyber Grants Alliance is positioning gap assessments as both a compliance tool and a business-development tool for manufacturers trying to protect or win defense work. - The message reflects growing uncertainty in the DIB about what comes after the 60-day review.

What’s next: - DIB manufacturers will need to keep documenting compliance while the government reviews the CMMC assessment process. - Companies that apply for the grants now can use the results to support self-affirmations, remediation planning and supplier discussions. - The next federal decision could leave companies with modified, reinstated or alternative assessment requirements, making early documentation more valuable.

The bottom line: - Cyber Grants Alliance’s pitch is simple: do not treat the CMMC pause as a pause in cybersecurity work.