Cyber Grants Alliance urges DIB manufacturers to use gap assessment grants before compliance deadlines

Cyber Grants Alliance is urging defense industrial base manufacturers to move on cybersecurity gap assessments after the Pentagon paused Phase 2 CMMC third-party assessments on July 13, 2026. The group says core obligations under NIST SP 800-171, SPRS and DFARS still apply, and it is offering in-kind grants to help firms assess Level 1 and Level 2 readiness.

Why it matters: - Manufacturing defense industrial base companies still face cybersecurity compliance obligations even after the pause in Phase 2 CMMC third-party assessments. - The gap between certification delays and enforceable requirements could expose suppliers to contract risk, remediation costs and potential False Claims Act exposure. - Cyber Grants Alliance is positioning gap assessments as a way for smaller manufacturers to document compliance before primes and contracting officers tighten expectations.

What happened: - Cyber Grants Alliance said the Department of Defense’s July 13, 2026, announcement suspending Phase 2 CMMC third-party assessments does not change mandatory cybersecurity requirements. - The organization urged manufacturing DIB companies to pursue Level 1 and Level 2 gap assessment grants before enforcement deadlines sharpen. - Rick Dassler, executive director of Cyber Grants Alliance, said, "Manufacturers cannot afford to sit on the sidelines."

The details: - Phase 1 self-assessments, NIST SP 800-171 Rev. 2 compliance and DFARS 252.204-7012 safeguarding requirements remain legally enforceable obligations. - The group says those obligations remain subject to the False Claims Act. - Prime contractors may still require C3PAO certifications for supplier programs, even while the third-party assessment pause remains in place. - Companies without a documented compliance posture could lose contract opportunities during the 60-day review period. - The pause affects certification bureaucracy, not the underlying duty to protect Federal Contract Information and Controlled Unclassified Information. - Cyber Grants Alliance offers a CMMC Level 1 Gap Assessment Grant valued at $5,000 in-kind. - The Level 1 grant evaluates 17 basic cyber hygiene practices across six control families under FAR 52.204-21. - The Level 1 assessment is intended to help small manufacturers submit accurate SPRS self-affirmations. - Cyber Grants Alliance also offers a CMMC Level 2 Gap Assessment Grant valued at $10,000 in-kind. - The Level 2 grant evaluates all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling Controlled Unclassified Information. - Cyber Grants Alliance said the grant readiness programs remove financial barriers to assessment. - The organization says the programs also identify vulnerabilities, support competitive differentiation with primes and create a path for future remediation funding.

Between the lines: - The message is that the compliance pause may be temporary, but supplier pressure is not. - Companies that delay assessment could face a more expensive and rushed remediation effort if the post-review framework changes or returns in modified form. - The pitch also reframes gap assessments from a regulatory burden into a contract-preservation tool.

What's next: - DIB manufacturers can apply for the gap assessment grants through Cyber Grants Alliance’s Level 1 and Level 2 grant programs. - The Department of Defense’s 60-day review period could produce modified, reinstated or alternative assessment frameworks. - Companies that complete baseline assessments now may be better prepared for whatever requirements follow.