Cyber Grants Alliance pushes DIB manufacturers to pursue CMMC gap assessment grants

Cyber Grants Alliance is urging defense industrial base manufacturers to use Level 1 and Level 2 gap assessment grants as the Pentagon pauses Phase 2 CMMC third-party assessments. The group says self-assessment, NIST 800-171 and DFARS obligations still apply, and companies that wait could face compliance and contract risks.

Why it matters: - Manufacturing defense industrial base companies still must meet cybersecurity obligations even as Phase 2 CMMC third-party assessments are paused. - The group says companies that lack documented compliance may lose contract opportunities during the 60-day review period. - The pause does not remove the need to protect Federal Contract Information and Controlled Unclassified Information.

What happened: - Cyber Grants Alliance on July 23 urged DIB manufacturers to act before enforcement deadlines after the Department of Defense announced on July 13, 2026, that it was suspending Phase 2 CMMC third-party assessments. - The nonprofit said its warning targets manufacturers that serve the defense industrial base. - Rick Dassler, executive director of Cyber Grants Alliance, said, "Manufacturers cannot afford to sit on the sidelines."

The details: - Cyber Grants Alliance said Phase 1 self-assessments remain mandatory. - The group said NIST SP 800-171 Rev. 2 compliance remains enforceable. - Cyber Grants Alliance said DFARS 252.204-7012 safeguarding requirements remain legally enforceable and subject to the False Claims Act. - The organization said the pause affects certification bureaucracy, not the underlying cybersecurity obligations. - Cyber Grants Alliance said confusion about the pause could lead companies to delay cybersecurity compliance, wrongly assume third-party assessments are permanently canceled, or undervalue grants and assessments. - The group offers a CMMC Level 1 Gap Assessment Grant valued at $5,000 in-kind. - The Level 1 grant evaluates 17 basic cyber hygiene practices across six control families under FAR 52.204-21. - Cyber Grants Alliance also offers a CMMC Level 2 Gap Assessment Grant valued at $10,000 in-kind. - The Level 2 grant evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling Controlled Unclassified Information. - Cyber Grants Alliance said the grants are designed to remove financial barriers and help small manufacturers submit accurate SPRS self-affirmations. - The organization said the assessments can provide competitive differentiation with prime contractors.

Between the lines: - The pause creates uncertainty for suppliers, but the article argues that uncertainty raises the value of documenting compliance now. - Cyber Grants Alliance is framing gap assessments as both a compliance tool and a business development tool for defense suppliers. - If the review leads to a modified or alternative framework, companies with current assessments may be better positioned than companies starting from scratch.

What's next: - Cyber Grants Alliance says companies should apply for the Level 1 or Level 2 grant now. - The Department of Defense's 60-day review could lead to a modified, reinstated, or alternative assessment framework. - Companies without documented gap assessments may face rushed and unfunded remediation later.

The bottom line: - The certification pause may slow one part of CMMC, but it does not pause cybersecurity compliance for defense manufacturers.