When Certification Deadlines Move
What the CMMC Pause Means for SOC 2, HIPAA, and PCI Planning
A Certification Deadline That Did Not Arrive
For thousands of defense contractors, November 10, 2026 was supposed to be the date for Phase 2 of the Cybersecurity Maturity Model Certification. The program would begin requiring many companies handling controlled unclassified information to hold a Level 2 certification from a third-party assessor before a contract award. Instead, the Pentagon paused Phase 2 on July 13 and launched a 60-day review, and as of this date, it still has not published the results or a new start date.
This week, a two-part Federal News Network investigation showed why the delay is dragging on. According to the DoD's own RFI summary of 997 responses, the biggest cost driver was not the certification itself, but implementing the underlying NIST SP 800-171 controls. The average reported assessment cost was about $47,000, far below public estimates of up to $600,000. The same reporting noted that 2,433 companies had already earned Level 2 third-party certifications by September, roughly five times what the department expected in the program's first year.
Paused Deadlines Are Not Paused Obligations
The most important lesson from the CMMC situation is that a delayed certification date rarely removes the underlying requirement. Phase 1 self-assessments and annual affirmations in the Supplier Performance Risk System remain in effect, and DFARS clause 252.204-7012 still requires contractors to protect covered defense information and report cyber incidents. Many large prime contractors had already told their suppliers to treat November 10 as a firm deadline. Nothing about the pause stops a prime from keeping that expectation in a subcontract.
Enforcement has not paused either. In September, Honeywell Aerospace agreed to pay more than $2 million to resolve allegations under the False Claims Act tied to NIST SP 800-171 compliance, a reminder that inaccurate security attestations can become a fraud question rather than a paperwork question. Meanwhile, a proposed government-wide FAR rule would extend controlled unclassified information safeguards based on Revision 3 of NIST SP 800-171 to civilian agency contractors, along with a 72-hour incident reporting requirement. This means the security bar is spreading even as one deadline slips.
Organizations that kept working are already seeing the benefit. Electrical and logistics distributor Graybar and satellite communications manufacturer AvL Technologies both announced final Level 2 certifications this week, positioning themselves ahead of competitors when Phase 2 resumes in whatever form it takes.
HIPAA Shows the Same Pattern
Healthcare organizations are living through a similar dynamic. The proposed overhaul of the HIPAA Security Rule, published in the Federal Register in January 2025, would add requirements such as an asset inventory and network map, annual compliance audits, vulnerability scanning every six months, annual penetration testing, multifactor authentication and 72-hour system restoration procedures. Federal regulators have since indicated that final action is not anticipated until July 2027, which has led some organizations to wait.
That would be a mistake, as an enforcement action announced on October 30 illustrates. Lehigh Valley Health Network agreed to pay an $800,000 penalty and adopt a three-year corrective action plan after a ransomware attack exposed the information of 248,359 individuals. Regulators cited a failure to conduct an accurate and thorough risk analysis, a requirement that has been in force since 2005, along with late notifications under the Breach Notification Rule.
Business associates should pay particular attention. The proposed rule would require covered entities to obtain annual written verification of safeguards from their vendors, and regulators are already giving vendor breaches closer scrutiny. Whatever the final timeline, healthcare customers are likely to start asking their suppliers for evidence well before any rule takes effect.
Realistic Timelines for SOC 2, PCI DSS and Other Attestations
Every major framework has a lead time that does not compress well under deadline pressure. A SOC 2 Type 2 report requires controls to operate over an observation period, commonly three to twelve months, before an auditor can issue an opinion. An organization that starts preparing when a customer asks for a report may be a year away from delivering one. Readiness work, gap remediation, and policy development typically add several months on top of that.
Payment card security follows a similar rhythm. The future-dated requirements in PCI DSS version 4 became mandatory on March 31, 2025. Merchants and service providers are now being assessed against the full standard, including targeted risk analyses and stronger authentication requirements. For CMMC, the department's task force has floated options such as restarting Phase 2 with a narrower population and giving explicit credit for overlapping ISO 27001 controls. This suggests that organizations with mature, well-documented programs will be best positioned no matter which version of the rules prevails.
The practical implication is that compliance calendars should be built backward from the date customers and contracts will demand evidence, not forward from the date a regulator finalizes a rule. In most cases, the evidence that satisfies one framework, such as access reviews, logging, vulnerability management, and incident response testing, can be mapped to several others at once.
Building a Program That Survives Shifting Dates
The organizations best positioned for change share a few habits. They maintain a current inventory of where sensitive data lives, keep an accurate system security plan, and map their controls to multiple frameworks so that one body of evidence serves SOC 2, HIPAA, PCI DSS and NIST SP 800-171 together. For CMMC specifically, the task force also highlighted machine-readable evidence using OSCAL, an approach that can reduce the effort of repeated assessments.
It is also wise to plan for the more demanding version of each requirement. Building to NIST SP 800-171 Revision 3 while documenting against Revision 2, implementing the controls proposed in the HIPAA Security Rule update, and confirming that cloud services handling federal information meet FedRAMP Moderate equivalency all reduce the risk of scrambling when a deadline is reinstated. Free resources such as the roadmap recently released for construction contractors can help smaller firms get started.
Finally, keep an eye on the assessor market. The CMMC ecosystem, overseen by The Cyber AB, has had spare capacity throughout Phase 1, but demand for SOC 2 auditors, Qualified Security Assessors, and certified third-party assessment organizations tends to spike sharply when deadlines become firm. Booking assessments early is often the difference between meeting a contract requirement and missing a bid.
How Webcheck Security Can Help
Shifting certification timelines create uncertainty, but they also create an opportunity for organizations that use the extra time wisely. Whether you are preparing for CMMC Level 2, closing gaps against the proposed HIPAA Security Rule, working toward a SOC 2 report, or validating PCI DSS controls, a clear readiness assessment and a realistic roadmap will put you ahead of competitors who are waiting for regulators to decide.
If your organization needs help understanding which requirements apply, mapping controls across frameworks, or building the evidence auditors and customers expect, contact Webcheck Security today. Our team can help you turn moving deadlines into a steady, defensible compliance program.
Comments