-- Stealth Technology Group (STG), a Cyber AB Registered Practitioner Organization that prepares defense suppliers for the Cybersecurity Maturity Model Certification (CMMC) program, today announced that a defense consulting firm it prepared met all 110 security requirements of NIST SP 800-171 at its CMMC Level 2 certification assessment, conducted by an authorized third-party assessment organization (C3PAO), scoring 110 out of 110 with no open plan-of-action items. The client reached its assessment after an implementation of roughly 90 days.
The result came in July 2026, the same month the Department of War suspended Phase II of the CMMC program. A second STG client, a metal fabrication manufacturer, also passed its C3PAO Level 2 assessment that month.
On July 13, 2026, the Pentagon suspended the Phase II requirements that had been scheduled to begin on November 10, 2026, and placed pending and future CMMC implementation milestones on hold while the Department reviews the program. Level 1 and Level 2 self-assessment requirements remain in place, and the Cyber AB has confirmed that C3PAO Level 2 certification assessments remain available to companies that want them. At the time of writing, the Pentagon has not published the results of its review or a new timeline.
“The deadline is paused. Your signature isn’t,” said Michael J. Bannach, President and CEO of Stealth Technology Group. “Every defense supplier that handles controlled unclassified information still carries DFARS 252.204-7012, still has to implement the 110 requirements in NIST SP 800-171 Revision 2, and still puts its name on a self-assessment. The pause took a date off the calendar. It didn’t take the obligation out of the contract.”
Enforcement has not paused either. On September 1, 2026, the Justice Department announced a $2,042,518 False Claims Act settlement with Honeywell Aerospace resolving allegations that the company failed to implement required NIST SP 800-171 controls on a Defense Department contract. In June, an Alabama defense contractor agreed to pay $507,144 after a government assessment scored its implementation at negative 170, on a scale where the maximum is 110.
“The suppliers getting certified during the pause aren’t doing it for the government’s calendar,” Bannach said. “They’re doing it for their primes, who still have to flow cybersecurity requirements down to every supplier that touches controlled information, and for their own position when third-party requirements return. There are only about a hundred authorized assessment organizations, and the Pentagon’s own rulemaking estimated that more than 76,000 companies would eventually need a Level 2 certificate. When those requirements return, the queue will be long.”
Bannach credits the result to scoping and preparation. The client kept its controlled unclassified information inside a tightly defined enclave, documented each requirement the way an assessor would test it, and rehearsed its evidence before the assessment began. “Meeting all 110 at assessment isn’t an accident,” he said. “It comes from drawing the boundary tightly, writing down exactly how every control is met, and practicing the evidence walk-through until nothing surprises you.”
STG’s CMMC practice combines readiness and gap assessments, remediation, managed CUI enclaves and ongoing managed security, so suppliers build evidence designed to stand up to an assessor, on assessment day and after it. Defense suppliers can start with a CMMC readiness assessment at stealthcmmc.com.
About Stealth Technology Group
Stealth Technology Group (STG) is one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies and defense suppliers. Formed through the combination of GizmoFish in Boston, Savage Consulting in Tampa and Empire Computer Services in Sarasota, STG delivers managed IT and security services, CMMC readiness and assessment preparation, Stealth 360°™ Continuous Assurance, and AI strategy and governance. STG is a Cyber AB Registered Practitioner Organization. Learn more at www.stealthtech365.com.
About Michael J. Bannach
Michael J. Bannach is President and CEO of Stealth Technology Group. A CISSP with more than 25 years in enterprise IT and cybersecurity, he advises executive teams and defense suppliers on CMMC, cybersecurity and AI governance. Learn more at michaelbannach.com.
Contact Michael J. Bannach, President and CEO of Stealth Technology Group, by email at [email protected] or by phone at 844-955-0438.
Contact Info:
Name: Michael J. Bannach
Email: Send Email
Organization: Stealth Technology Group
Website: https://www.stealthtech365.com/
Release ID: 89206227
Google
RSS