Cyber Grants Alliance pushes DIB manufacturers to secure gap assessment grants

Cyber Grants Alliance says defense industrial base manufacturers should use Level 1 and Level 2 gap assessment grants now, even after the Pentagon paused Phase 2 CMMC third-party assessments on July 13, 2026. The group argues self-assessment duties, NIST 800-171 compliance and DFARS safeguards still apply, and companies that wait could face rushed remediation and lost contract opportunities.

Why it matters: - Defense manufacturers still face cybersecurity compliance obligations even though Phase 2 CMMC third-party assessments are on pause. - Companies that delay documentation and remediation could lose competitiveness with prime contractors and face unfunded fixes later. - Cyber Grants Alliance is trying to lower the cost barrier with in-kind grant programs for gap assessments.

What happened: - Cyber Grants Alliance issued a notice on July 23, 2026, urging manufacturing Defense Industrial Base companies to act before enforcement and review deadlines tighten. - The guidance followed the Department of Defense's July 13, 2026 announcement suspending Phase 2 CMMC third-party assessments. - Rick Dassler, executive director of Cyber Grants Alliance, said manufacturers cannot afford to sit on the sidelines and need an accurate baseline to safeguard defense contracts. - Cyber Grants Alliance directs companies to apply for its Level 1 Grant and Level 2 Grant programs.

The details: - Phase 1 self-assessments remain mandatory. - NIST SP 800-171 Rev. 2 compliance remains legally enforceable. - DFARS 252.204-7012 safeguarding requirements remain in force and are subject to the False Claims Act. - C3PAO certifications are paused, but prime contractors may still require them for supplier programs. - Companies without a documented compliance posture risk losing contract opportunities during the 60-day review period. - The pause affects certification timing, not the underlying duty to protect Federal Contract Information and Controlled Unclassified Information. - Cyber Grants Alliance offers a $5,000 in-kind CMMC Level 1 Gap Assessment Grant. - The Level 1 program evaluates 17 basic cyber hygiene practices across 6 control families under FAR 52.204-21. - The Level 1 assessment is intended to help small manufacturers submit accurate SPRS self-affirmations. - Cyber Grants Alliance offers a $10,000 in-kind CMMC Level 2 Gap Assessment Grant. - The Level 2 program evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling Controlled Unclassified Information.

Between the lines: - The group is framing the DoD pause as a short-term certification change, not a relaxation of cybersecurity expectations. - The emphasis on gap assessments suggests companies need evidence now, even if the final compliance framework changes after the 60-day review. - The messaging also positions grant-funded assessments as both a compliance tool and a competitive signal for prime contractor relationships.

What's next: - The Defense Department's 60-day review could produce modified, reinstated or alternative assessment frameworks. - Companies that do not document their current gaps may have to scramble later to fund and complete remediation. - Manufacturers that apply now can use the grant-supported assessments to build a baseline before any new requirements are finalized.

The bottom line: - Cyber Grants Alliance is betting that the safest move for DIB manufacturers is to assess now, even while the federal certification process is in flux.