By: David Dillow, CTO, Greypike Inc.
Last updated: November 1st, 2026
Since the Department of War paused CMMC Phase 2 in July, I’ve heard a new line from small business owners: “Great, we can wait.”
I understand why. Compliance costs money, and nobody wants to spend it early. But in my 20+ year government career I was always taught, never assume anything, and the assumption here is that the pause made the risk go away. It didn’t. The bill for non-compliance just shows up in different places.
Here’s where it shows up, with real numbers.
BLUF
CMMC non-compliance costs you in three ways. You can lose awards and renewals that require a current SPRS score or CMMC status. You can be held liable under the False Claims Act when your posted score or certifications don’t match reality, and recent settlements range from $507,144 to $4.6 million. And primes can drop subcontractors who can’t show proof. The Phase 2 pause did not change DFARS 252.204-7012, NIST SP 800-171 or your SPRS obligations. For most small contractors, getting compliant costs far less than any one of these outcomes.
Key takeaways
- A SPRS score is a statement to the government. If it’s wrong, it’s a liability.
- DOJ settled cybersecurity False Claims Act cases in 2025 and 2026 with defense contractors of different sizes.
- The Phase 2 pause delayed third-party certification. It didn’t pause the rules you already signed up for.
- The fix starts with an honest score. Update SPRS when you learn your real number.
- Budget the cost of compliance against the DoD revenue you could lose, not against zero.
What happens if you’re not CMMC compliant?
Three things can happen, and none of them waits for Phase 2.
- You can’t win or renew certain awards. Under DFARS 252.204-7019, contracting officers check for a current NIST SP 800-171 assessment score in SPRS, no more than three years old, before award. Where a solicitation requires a CMMC level under DFARS 252.204-7021, you need that status in SPRS too.
- You take on False Claims Act risk. If you posted a score or affirmed compliance that wasn’t true, the government can treat payments under that contract as false claims.
- Primes may drop you. Primes are responsible for flowing requirements down, and a sub that can’t show a real score or a plan becomes a risk to their contract.
How much has non-compliance actually cost contractors?
These are public settlements announced by the Department of Justice. Each one resolved allegations without a finding of liability, but the dollar amounts were real.
| Company | Announced | Amount | What the government alleged |
|---|---|---|---|
| MORSECORP Inc. | March 2025 | $4.6 million | Posted a SPRS score of 104, then got an outside gap analysis scoring -142 and waited almost a year to update it. Also alleged: email hosting that didn’t meet FedRAMP Moderate equivalent and no System Security Plan. |
| LOGZONE Inc. | June 18, 2026 | $507,144 | Did not implement required NIST SP 800-171 controls on two Navy contracts from May 2021 to March 2025. A DCMA assessment scored the company at -170. |
| Honeywell Aerospace Inc. | September 1, 2026 | $2,042,518 | A business unit did not meet NIST SP 800-171 requirements on one of its networks from April 2020 to December 2023. The case started with a whistleblower, a former employee. |
Look at the range. A Huntsville contractor working on Navy contracts, and a business unit of Honeywell. The common thread isn’t size. It’s a gap between what was required and what was actually in place.
Also notice how two of these started. One with an outside gap analysis that found a different number. One with a former employee. The people inside your company know what your network really looks like.
How much can non-compliance cost in lost contracts?
Only you can answer this one, and it’s worth ten minutes. Pull your last 12 months of revenue and add up every DoD prime contract and subcontract that involves Federal Contract Information or CUI. That’s the revenue tied to these requirements.
Then ask two questions:
- If a prime asked for our SPRS score and evidence tomorrow, could we send it?
- If a new solicitation required a CMMC Level 2 self-assessment, could we affirm it honestly?
If either answer is no, that revenue is at risk. If DoD work is most of your business, most of your business is at risk.
Does the CMMC Phase 2 pause protect me?
No. On July 13, 2026, the Department of War suspended Phase 2, which had been scheduled for November 10, 2026. A task force is reviewing the program and its report has not been published. On October 27, 2026, Federal News Network reported on a leaked internal summary that discusses restarting Phase 2 for a narrower group within about 90 days. DoD declined to comment, and none of that is a decision yet.
What hasn’t changed:
- DFARS 252.204-7012 and the 110 requirements in NIST SP 800-171 Rev 2
- Your SPRS score and the requirement to keep it current
- Level 1 and Level 2 self-assessments where your contracts require them
- False Claims Act liability for scores and affirmations that aren’t true
More on that in our post on the CMMC Phase 2 suspension.
What does it cost to fix instead?
Compare the numbers above with what compliance actually costs. These are our public prices from our pricing page:
| Plan | Price | Who does the work |
|---|---|---|
| CMMC Level 1 only | $199 a month | You, for companies up to 50 people that only handle FCI and need their yearly self-assessment |
| Compliance App | $399 a month, no setup fee | You or your IT provider, with every task reviewed by our compliance manager |
| Managed | $999 a month | We run the program, you make the decisions |
| Managed + Fixes | $1,999 a month | We run the program and help close the gaps |
If you need a third-party certification, the C3PAO assessment is a separate bill. DoD estimated it at about $104,670 over three years for a small business Level 2 certification. That’s real money. It’s also a fraction of the smallest settlement in the table above.
What should I do this month?
- Calculate your real SPRS score against all 110 requirements, and show your work.
- If the score in SPRS is wrong, update it. In the MORSECORP case, the delay was a big part of the problem.
- Confirm your email and file storage meet FedRAMP Moderate or equivalent if they hold CUI.
- Make sure you have a System Security Plan that describes what you actually do.
- Write a Plan of Action and Milestones for the gaps, with owners and dates.
Our free Excel calculator covers all 110 NIST SP 800-171 requirements, applies the DoD scoring method, and has a notes column for your evidence. Or talk to our team about where you really stand.
Get the free SPRS calculator Talk to a practitionerI’m not a lawyer, and nothing here is legal advice. If you think your posted score is wrong, talk to counsel about how to correct it. Then fix the gaps. It’s worth getting ahead of it now, while it’s still your choice.
Related reading: What happens if you don’t get CMMC certified.
Frequently asked questions
What happens if my company is not CMMC compliant?
You can lose awards that require a current SPRS score or CMMC status, face False Claims Act liability if your posted score or affirmations aren’t accurate, and lose subcontracts when primes ask for proof you can’t provide.
How much have contractors paid for cybersecurity non-compliance?
Recent DOJ settlements include MORSECORP at $4.6 million (March 2025), Honeywell Aerospace at $2,042,518 (September 2026) and LOGZONE at $507,144 (June 2026). Each settlement resolved allegations without a finding of liability.
Does the CMMC Phase 2 pause mean I don’t have to comply?
No. Phase 2 third-party certification is paused, but DFARS 252.204-7012, NIST SP 800-171, SPRS scores and contract-required self-assessments still apply.
Can a wrong SPRS score lead to a False Claims Act case?
Yes. In the MORSECORP settlement, the government alleged the company posted a score of 104 while an outside gap analysis scored it at -142, and did not update the score for almost a year.
How much does it cost to become CMMC compliant?
It depends on your scope. Greypike’s public pricing starts at $199 a month for CMMC Level 1 and $399 a month for the Compliance App. A Level 2 C3PAO assessment is billed separately, and DoD estimated it at about $104,670 over three years for a small business.
What should I do first if I’m not compliant?
Calculate an honest SPRS score against all 110 NIST SP 800-171 requirements, correct the score in SPRS if it’s wrong, and write a Plan of Action and Milestones for the gaps.
