CMMC Phase 2 Is Suspended — What Actually Changed, and What Didn't. Plus 15 Vetted Contracts

The Department of War suspended CMMC Phase 2 on July 13, freezing the third-party assessment regime that was set for November — but self-assessment, DFARS 252.204-7012, and your SPRS affirmation remain fully in force.

1. U.S. Army — Enterprise Identity, Credential & Access Management (ICAM) RFI

Sources Sought · Response due August 4, 2026 · Full & open · NAICS 541519

Market research for an Army-wide ICAM capability — the identity backbone that zero-trust architectures are built on. A program of this scale rarely starts with an open RFI; responding now is how a small firm gets its approach in front of the requirement before it's written.

View on SAM.gov →

2. Dept. of Energy — Technical Security Support Services

Presolicitation · Response due August 3, 2026 · 8(a) Competed · NAICS 541690

Technical security support set aside for 8(a) firms, with real runway before the solicitation drops. For an 8(a) shop with cleared security staff, this is the kind of anchor contract worth building a capture plan around.

View on SAM.gov →

3. Dept. of Defense — IT Global Operation Support Services (DOWEA)

Presolicitation · Response due July 30, 2026 · Total Small Business Set-Aside · NAICS 541519

Enterprise IT operations support, set aside for small business. A recurring global-support requirement is a durable book of business — engage at the pre-solicitation stage to shape scope and signal capability.

View on SAM.gov →

A quieter FAR change took effect this month with real teeth for IT and cyber firms. Under the Revolutionary FAR Overhaul, fixed-price is now the government's default contract type, and agencies were directed to update their class deviations by July 15. Time-and-materials and labor-hour vehicles — the backbone of a lot of small-firm IT and staff-augmentation work — are squarely in scope. What this means for you: expect more requirements structured as firm-fixed-price, which shifts performance risk onto you. Price accordingly, scope tightly, and don't assume a T&M structure will be available just because it was last year.

Values are shown where published. Most federal RFIs, sources-sought, and presolicitation notices carry no stated dollar figure — act on set-aside, notice type, and deadline. The Q4 clock is running: most notices below close within two to three weeks.

1. U.S. Army — Enterprise ICAM RFI

Sources Sought · Due 08/04/2026 · Full & open · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: On-brand identity/zero-trust work at scale. Realistic for firms with ICAM, PKI, or IAM past performance — respond to shape the buy.

2. Dept. of Energy — Technical Security Support Services

Presolicitation · Due 08/03/2026 · 8(a) Competed · NAICS 541690 · View on SAM.gov →

Bid/No-Bid: Realistic for 8(a) firms with cleared security-program staff. Good runway.

3. DoD — PAE Cyber's Public Key Infrastructure (PKI)

Sources Sought · Due 07/30/2026 · Full & open · NAICS 541512 · View on SAM.gov →

Bid/No-Bid: PKI/credentialing engineering. Realistic for firms with certificate-infrastructure or crypto experience — and directly relevant given the post-quantum push.

4. VA — Security Information & Event Management (SIEM) Software & Support

Sources Sought · ⚠️ Due 07/23/2026 — closes Thursday · SDVOSB · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: SDVOSB cyber set-aside, but the clock is short. Only if you can respond on SIEM this week.

5. VA — Cybersecurity Architecture & Engineering Services

Sources Sought · ⚠️ Due 07/23/2026 — closes Thursday · Full & open · NAICS 541512 · View on SAM.gov →

Bid/No-Bid: Core cyber-engineering work. Fast turn — worth a capability statement if security architecture is your lane.

6. DoD — IT Global Operation Support Services (DOWEA)

Presolicitation · Due 07/30/2026 · Total Small Business Set-Aside · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: Enterprise IT ops, SB set-aside. Durable, recurring work — engage early.

7. DoD — AI-Enabled Manpower Modeling & Readiness Optimization

Sources Sought · Due 07/30/2026 · Total Small Business Set-Aside · NAICS 541511 · View on SAM.gov →

Bid/No-Bid: AI/analytics for workforce readiness, SB set-aside. Realistic for firms with ML and data-modeling depth.

8. Dept. of Energy — Commvault Renewal (FY26)

Solicitation · Due 08/04/2026 · Total Small Business Set-Aside · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: Data-protection/backup renewal, SB set-aside. Straightforward for resellers with the SKU.

9. FDIC — Palo Alto Networks Hardware & Professional Services

Solicitation · Due 07/29/2026 · Full & open · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: Firewall/next-gen security hardware plus services. Realistic for authorized Palo Alto partners.

10. DoD — Data & Artificial Intelligence (AI) Modernization Support

Presolicitation · Due 07/29/2026 · Full & open · NAICS 541512 · View on SAM.gov →

Bid/No-Bid: Data/AI modernization at enterprise scale. Teaming play for most small firms; respond to get on the radar.

11. DoJ — Whooster Law-Enforcement DaaS Access & Search Credits

Solicitation · Due 07/27/2026 · Full & open · NAICS 541519 · View on SAM.gov →

Bid/No-Bid: Investigative data-as-a-service. Realistic for firms holding or reselling the named data platform.

12. DoD — Naval Information Warfighting Development Center (NIWDC) Electronic Systems Support

Combined Synopsis/Solicitation · Due 08/18/2026 · Total Small Business Set-Aside · NAICS 541511 · View on SAM.gov →

Bid/No-Bid: SB set-aside with the longest runway on this list. Realistic for firms supporting naval C5ISR/electronic systems.

13. Dept. of Commerce — SRD31 Content Development & Maintenance

Solicitation · Due 07/24/2026 · Total Small Business Set-Aside · NAICS 541690 · View on SAM.gov →

Bid/No-Bid: Content/technical development, SB set-aside. Realistic for small dev/content shops.

14. Dept. of the Interior — Software Development Services (Coastal Remote Sensing)

Solicitation · Due 07/24/2026 · Full & open · NAICS 541511 · View on SAM.gov →

Bid/No-Bid: Custom software for remote-sensing data. Realistic for firms with geospatial or scientific-software experience.

15. DoD — Periodic Health Assessment (PHA) Modernization Capability

Solicitation · Due 07/27/2026 · Full & open · NAICS 541512 · View on SAM.gov →

Bid/No-Bid: Military health-IT modernization, biddable now. Realistic for health-systems integrators.

DHS/CISA — State & Local Cybersecurity Grant Program Support. Incumbent PADRON LLC; 8(a); completion ~09/30/2026 — now roughly 70 days out. For an 8(a) cyber firm, capture time is nearly gone; a decision to pursue needs to happen now. (Forecast record F2025069027; confirm live status.)

DoD — Air Defense Communication Services 5. The "5" signals a recurring recompete of an established communications-support vehicle; an acquisition-strategy sources-sought is open, responses due 08/07/2026. Track it toward the eventual RFP.

This was the busiest week we've tracked: 246 notices across our seven NAICS codes, 153 biddable. DoD (55) and VA (44) drove roughly two-thirds, with VA volume unusually high. The pattern worth naming: cyber services are visible in the pipeline this week in a way they haven't always been — a SIEM buy, cybersecurity architecture and engineering, public-key infrastructure, Army enterprise ICAM, technical security support, and Palo Alto professional services all posted inside seven days. If cyber is your core, this is a week to move. The brand-name-or-equal and renewal pattern also held — Commvault, Palo Alto, Extreme Networks, Vindicator — which continues to reward resellers and integrators who can quote a named platform fast. And note the timing irony: the same week DoW paused the CMMC assessment regime, the government kept right on buying cybersecurity. The demand isn't waiting on the rulemaking.

Last week we told you a Rev 3 interim rule was expected this month. That rule hasn't landed — and it may not on the original timeline, because the ground moved under the entire program instead. In a memo dated July 10 and announced July 13, Department of War CIO Kirsten Davies immediately suspended CMMC Phase 2 — the phase, scheduled for November 10, that would have begun requiring third-party (C3PAO) assessments in contracts — along with the pending Phase 3 and Phase 4 milestones. A newly created CMMC Reform Task Force will run a 60-day, top-to-bottom review and report back around September 13.

The reasoning was blunt. Davies cited SBA figures suggesting future CMMC phases could cost small and mid-size businesses more than $7 billion a year, with individual compliance bills approaching $600,000 — while more than 100,000 defense-industrial-base firms would need assessments from roughly 100 accredited organizations. Her summary: "the math just simply doesn't math." A March GAO report had already warned the requirements could push small firms out of the base, and the SBA publicly backed the pause.

Now read the fine print, because this is where contractors get hurt. The suspension lifts one verification mechanism — not the underlying obligation. Phase 1 self-assessment stays in effect. DFARS 252.204-7012, your SPRS score, and your annual affirmation still bind you, and the Justice Department's Civil Cyber-Fraud Initiative still treats a false affirmation as False Claims Act exposure. Your audit is off; your liability is not. Separately, if you have a live bid that cited Level 2 C3PAO or Level 3, DoW says those requirements must be amended out — watch for the amendment.

The move: don't stop. A certification you earn now still has value, the controls still reduce real risk, and the reformed program will be built on the record created over the next 60 days. Submit comments to the RFI — responses are due August 14 at noon Eastern — because the firms that shape the new rules are the ones writing to the task force while the window is open.

(Verify every opportunity and deadline directly on SAM.gov before acting.)

Know a small firm drowning in SAM.gov? Forward this brief.
federalcyberbrief.com

Federal Cyber Brief is an independent publication providing general information for educational purposes. It is not legal, financial, or procurement advice. Verify all opportunities and deadlines directly on SAM.gov before acting.