The Department paused the third-party (C3PAO) certification requirement that would have entered new solicitations on November 10, 2026, while a task force reviews the cost to small businesses. Phase I self-assessments stay in effect; DFARS 252.204-7012 and NIST SP 800-171 obligations are unchanged.
What to do: Keep your SPRS score posted. Do not cancel an assessment a prime contractor requires. A posted score is still a differentiator.