Time-sensitive: the Request for Information feeding the CMMC Reform Task Force closes at 12:00 p.m. ET on Friday, August 14, 2026. If you are an MSP with defense-contractor clients, that is the narrow window in which your operational experience can actually influence what the framework becomes. Most MSPs will let it pass without filing, and then spend 2027 complying with whatever the contractors who did file managed to shape.
The Department of War suspended CMMC Phase II on July 13, 2026 and stood up a CMMC Reform Task Force with a 60-day mandate — a final report due around mid-September 2026. We covered the suspension itself and what still applies in our breakdown of the paused Phase 2 deadline. This piece is about the second-order question that guide deliberately left alone: what a genuinely reformed CMMC would mean for the managed service providers sitting inside their clients' assessment boundaries, and how to run an MSP practice through a review period where the destination is unknown.
What the Task Force Is Actually Asking
The RFI is unusually specific about where the department thinks the problem is. Rather than asking broadly whether CMMC is burdensome, it poses seven questions that push respondents toward naming individual controls. Contractors are asked to identify their top five most prohibitive cost drivers, administrative burdens, or operational challenges under CMMC and NIST SP 800-171 Rev. 2; to name which specific security controls delivered the most tangible uplift and actual risk reduction; and — the question with the most reform leverage in it — which specific requirements or controls create the highest administrative overhead and financial burden with the least measurable improvement to real security posture. Further questions address how self-assessments could be streamlined and what actionable policy reforms respondents would propose.
Read those questions as a signal about the likely output. A task force asking "which controls are expensive and useless" is not building a case for uniform relaxation across all 110 practices. It is building a case for differentiation — keeping the controls that assessors and incident data show matter, and reducing the documentation and verification load around the ones that mostly generate paperwork. The department framed the suspension around compliance costs and small-business attrition from the Defense Industrial Base, with the stated goal of prioritizing speed to capability for small, medium, and non-traditional defense businesses.
Why MSPs Should File Separately from Their Clients
An MSP sees something no individual contractor sees: the same control implemented across a dozen or fifty client environments, with visibility into which ones actually withstood an incident. That is a materially different evidence base from a single contractor describing its own experience, and it is the kind of input a task force reviewing control efficacy has the least of. If you manage CUI-adjacent environments for multiple defense clients, your aggregated observation about, say, which audit-logging requirements produce evidence nobody ever reads is more useful than any one client's estimate of what it cost them.
There is also a self-interested case. Several of the highest-overhead areas in a Level 2 environment are ones MSPs bear directly — scoping documentation, evidence collection across managed endpoints, and the architectural separation questions covered below. Nobody else is going to raise those on your behalf.
The Scope Question Reform Is Least Likely to Solve
Here is the structural point MSPs should not expect the task force to change: CMMC follows the CUI, not the org chart. An MSP that accesses, stores, processes, or transmits Controlled Unclassified Information on a client's behalf — or whose remote-management tooling reaches into systems where CUI lives — sits inside that client's assessment boundary. Remote monitoring of CUI-hosting endpoints, backup services replicating CUI-containing systems onto MSP-controlled infrastructure, email management where CUI transits provider-hosted systems, help-desk access to CUI-processing workstations, and cloud infrastructure management where CUI workloads run all pull a provider into scope.
Every plausible reform outcome — fewer controls, streamlined self-assessment, a tiered or scaled-down third-party model — leaves that scoping logic intact, because it flows from the data, not from the assessment mechanism. A task force chartered to reduce cost and burden has no obvious lever that makes an MSP's privileged access to CUI systems stop mattering. If anything, a framework that trims low-value controls while keeping high-value ones concentrates attention on exactly the access-control and boundary-protection practices where MSPs are most exposed.
The practical implication: architectural scope reduction is the one investment that pays off under every reform scenario. Documented technical separation between your management plane and client CUI-handling systems reduces your exposure whether the framework tightens, loosens, or stays put. A contract clause stating you don't look at client data does not satisfy an assessor who examines the actual network architecture — and it will not satisfy one under a reformed framework either.
Running the Practice During the Review Window
The awkward position an MSP is in right now: clients are asking whether they can stop spending on CMMC readiness, and the honest answer is more nuanced than either yes or no.
What has not moved
Phase I self-assessment and affirmation requirements, in effect since November 10, 2025, remain fully in force on applicable solicitations. The underlying control set — the security requirements in NIST SP 800-171 — is not what the review suspended. DFARS obligations that predate CMMC entirely are untouched. Clients with contracts that already carry a third-party certification clause are not automatically relieved of it by a suspension of the Phase 2 expansion; that is a question for their contracting officer, not for you, and you should say so rather than opining on their contract terms.
What an MSP should tell a client asking to pause
Distinguish clearly between two categories of spend. Remediation work — closing gaps in the System Security Plan, implementing MFA without convenience exceptions, finishing CUI data mapping, building a real incident response capability with 72-hour DIBNet reporting — is durable under every reform scenario, because those are the practices most likely to survive a review focused on efficacy. Advising a client to pause that work is advising them to accept a worse security posture and then rebuild the same readiness later at higher cost.
Assessment-scheduling spend is a different matter. The urgency of booking a specific C3PAO slot ahead of a November 2026 date has genuinely eased. Assessment fees for a small-to-mid-size contractor commonly run $20,000–$60,000 depending on company size, in-scope system count, and assessor selection, and the accredited C3PAO pool was reported booked out six to nine months in advance before the pause. That capacity constraint is structural rather than deadline-driven, so it will reassert itself quickly once a new date exists — but a client who has not yet engaged an assessor is no longer late.
The framing that holds up: the review is about the verification mechanism and its burden on small business, not about whether the security practices are expected. Recommend continuity on practices, flexibility on scheduling.
Do not let a client cancel an in-flight engagement on your advice
If a client has an active C3PAO engagement, the decision to cancel belongs to them and their contracting officer, and the cost of being wrong is asymmetric. A cancelled engagement that turns out to have been contractually required is a bid-eligibility problem; a completed assessment that turns out not to have been required is a sunk fee and a defensible security posture. Document that you advised them to confirm with their contracting officer.
Positioning for the Report Rather than Guessing at It
A mid-September report does not mean a mid-September rule. Whatever the task force recommends has to move through rulemaking to change the regulatory text in 32 CFR Part 170 and the acquisition rule in 48 CFR — and CISA's CIRCIA rule, discussed in our piece on the 72-hour reporting clock, is a live demonstration of how far a target date can slip from an announced intention. MSPs building a 2027 service roadmap should plan for the recommendations to be public well before they are binding.
Two service-line implications are safe to act on now, because they hold regardless of what the report says. First, evidence automation has rising value under any streamlined self-assessment model — if the reform reduces third-party verification and leans harder on self-attestation, the liability weight on the accuracy of that attestation goes up, not down. A self-assessment score without substantiating evidence does not hold up under DoW scrutiny even absent a formal review, and false attestation carries False Claims Act exposure. Helping clients produce defensible evidence is more valuable in a self-attestation-heavy regime, not less.
Second, flow-down did not pause. Prime contractors can still require CUI-handling subcontractors to demonstrate compliance as a condition of subcontract award, and many are continuing to ask. For an MSP, that means client-side security questionnaires keep arriving on the old cadence whatever the department decides, and the ability to answer them quickly with real documentation stays a competitive asset.
What to Watch, and What Not To
Watch the RFI response volume and the task force's stated framing when the report lands — specifically whether it recommends a tiered assessment model scaled to contract sensitivity, a reduced control set, or a streamlined self-assessment with sharper attestation liability. Those three outcomes have meaningfully different consequences for an MSP practice, and the report's language will indicate which one is in front.
Do not build a service offering around a predicted reinstatement date. The suspension was announced as being in effect until further notice, and a review chartered around speed to capability for small business is more likely to produce a restructured mechanism than a straight resumption of the original timeline. That is informed expectation, not confirmed policy.
The concrete move available this week is the one with a deadline attached: file an RFI response before noon Eastern on August 14 describing which controls you have watched deliver real risk reduction across your client base and which ones consumed budget without moving the needle. Aggregated cross-client observation is the evidence this task force is short of, and an MSP is one of the few parties positioned to supply it. Then go back to closing SSP gaps for clients, because that work is durable under every version of the framework that could plausibly emerge.
Frequently Asked Questions
When will the CMMC Reform Task Force report be released?
The task force was chartered on July 13, 2026 with a 60-day mandate, placing its final report around mid-September 2026. A report is a set of recommendations, not a rule change — implementing anything it proposes requires rulemaking to amend the existing regulatory text.
Should MSPs respond to the CMMC RFI?
If you manage environments for defense contractors handling CUI, there is a strong case for it. Responses are due by 12:00 p.m. ET on August 14, 2026, and the RFI asks precisely the questions an MSP with cross-client visibility is best placed to answer — which controls deliver real risk reduction and which generate overhead without security benefit.
Will reform take MSPs out of CMMC scope?
Almost certainly not. Scope follows CUI access, not company type, and none of the plausible reform outcomes change that logic. Architectural separation between your management plane and client CUI systems remains the only reliable way to reduce scope, and it works under any version of the framework.
Should defense contractors pause CMMC readiness spending during the review?
Separate remediation from assessment scheduling. NIST SP 800-171 remediation work is durable — the practices are not what the review suspended, and Phase I self-assessment obligations still apply. Booking a specific C3PAO assessment slot is genuinely less urgent than it was before July 13. Clients with a third-party certification clause already in an executed contract should confirm their obligation with their contracting officer rather than assume the suspension covers them.
← CMMC Level 2 Phase 2 Deadline | CIRCIA's 72-Hour Reporting Clock →