A defense contractor deciding which cybersecurity work can wait needs to start with its contracts. The suspension of the next Cybersecurity Maturity Model Certification phase changes the assessment rollout. Existing safeguarding commitments still require attention.
On November 3, the Justice Department announced a $13 million settlement with ILC Dover LP and ILC Astrospace LLC over alleged cybersecurity failures involving Army, Missile Defense Agency and NASA contracts. The alleged conduct ran from January 2018 through October 2024, before the current CMMC rollout. The case concerns obligations that contractors should not confuse with a future certification milestone.
The agreement became effective October 26, based on its last signatures. DOJ announced the resolution on November 3. ILC did not admit liability, and the settlement is not a judicial determination that the allegations were proved. Its practical value is the opportunity to examine the records and contractual duties behind the government’s allegations.
What the pause actually changes
The department’s current CMMC notice says that Phase II, previously scheduled for November 10, 2026, was suspended on July 13. Phase I self-assessment requirements remain in place. Contractors working from an older rollout chart should check the current guidance before making scheduling or purchasing decisions.
The implementing memorandum limits requiring activities to CMMC Level 1 or Level 2 self-assessments during the suspension. It expressly preserves the safeguarding and incident-reporting requirements of DFARS 252.204-7012. It also directs amendments to active solicitations containing the affected higher-level assessment requirements and modifications to existing contracts before the next option exercise or during the next scheduled administrative modification.
That distinction matters when reviewing a live contract. Identify the assessment requirement actually incorporated, the amendments already issued and the modification still needed. An announcement directing contracting officers to change contracts should not be treated as proof that a particular contract has already changed.
The cloud provider belongs in the review
One allegation in the ILC settlement concerns an external cloud provider used to store engineering, manufacturing and quality documentation, including covered defense information. The government alleged that ILC failed to require and ensure the provider met the specified security and incident-response obligations.
DFARS 252.204-7012(b)(2)(ii)(D) addresses this arrangement directly. When applicable, a contractor using an external cloud provider for covered defense information must require and ensure security equivalent to the FedRAMP Moderate baseline, together with the clause’s requirements concerning incident reporting, malicious software, preservation, forensic access and damage assessment.
A useful review therefore reaches beyond the contractor’s own computers. Which service actually holds the covered information? What documents establish the provider’s relevant security posture? Do the service terms support the required incident response and access? A vendor’s general security assurance should be tested against the obligation in the contract and the service being used.
The same clause defines rapid reporting as within 72 hours of discovery of a qualifying cyber incident. It also requires preservation of specified system images and monitoring data for at least 90 days after submission of the incident report. A contractor should understand how its provider will support those duties before an incident forces the question.
Reconcile the plan, the systems and the assessment
The settlement also addresses alleged gaps in system security plans, implementation of required controls, remediation plans and assessment submissions. These are connected records: an assessment should describe the relevant systems and their actual controls, rather than a different environment or an intended future state.
The published DFARS 252.204-7019 provision requires an offeror subject to its NIST implementation requirement to have a current assessment for each covered system relevant to the offer. Generally, the assessment cannot be more than three years old, although a solicitation can specify a shorter period. The provision also requires verification that summary scores are posted in the Supplier Performance Risk System.
Before the next submission or contract decision, bring the technical and contracting records together. Identify the systems supporting the work, locate their security plans, compare the assessment with the controls actually implemented, and account for changes since the assessment. Determine who reviewed the submission and what evidence supports it. A remediation schedule should clearly distinguish completed work from work still outstanding.
Address discrepancies before repeating them
The settlement resolves allegations of knowing false claims. It does not establish that every technical shortcoming creates False Claims Act liability. The applicable requirements, what the company represented, what responsible personnel knew and the relationship to government payment all deserve careful examination.
When records conflict, preserve the original plans, assessment materials, consultant findings and relevant communications. Counsel and technical personnel can then establish what changed, when the company learned of the issue and which contractual or reporting duties require action. Updating a plan should not erase the record needed to understand an earlier submission.
For Georgia contractors and businesses elsewhere in the defense supply chain, the immediate decision is where to direct that review. Start with the promises already made and the evidence supporting them. The CMMC pause provides a reason to verify the assessment schedule; it provides no substitute for understanding the obligations in the contract.
Charles Rollins represents individuals and businesses in white collar matters and selected civil and regulatory disputes. Read more about federal investigations and subpoenas and parallel proceedings. General information, not legal advice. Contacting the firm does not create an attorney-client relationship; do not send confidential records before representation is agreed upon.