CMMC's third-party audit is suspended. The data obligation isn't.
On July 13 the Pentagon suspended CMMC Phase II, the third-party audit that was set to start in November. NIST 800-171 self-assessment stays, and so does the legal duty to protect federal data. For contractors running AI dev tools, the burden of proof just moved onto them.