AvL Technologies, a North Carolina maker of SATCOM antenna and terminal systems used in defense satellite communications, announced on October 28, 2026 that it had secured Final Cybersecurity Maturity Model Certification (CMMC) Level 2, verified by an authorized third-party assessment organization against the 110 security requirements in NIST SP 800-171 Revision 2.
The timing is pointed. November 10, 2026, just two weeks after AvL's announcement, was supposed to mark the start of CMMC Phase 2, when the Pentagon would begin requiring third-party Level 2 and Level 3 certification as a condition of contract award for thousands of defense suppliers, replacing self-attestation. The Department of War suspended that rollout back in July, and as of this writing has not revived it.
A deadline in limbo
DoD CIO Kirsten Davies and Under Secretary for Acquisition and Sustainment Michael Duffey jointly announced the suspension on July 13, 2026, citing prohibitive compliance costs, shortages in third-party assessment capacity, and complex regulatory timelines. They launched a 60-day CMMC Reform Task Force and opened a request for information that drew close to a thousand responses before closing on August 14. Davies said the task force's findings would be made public roughly two to three months after the pause began, putting the target around late September. That date has come and gone.
The Pentagon's own numbers complicate the story
An October report from Federal News Network, based on internal DoD documents, found that the RFI responses actually cut against the stated rationale for the pause. Respondents' chief complaints centered on ambiguity in the underlying NIST SP 800-171 standard itself, particularly inconsistent marking and scoping of controlled unclassified information, rather than on the mechanics of third-party assessment. One unnamed former official told the outlet that Davies had hoped the task force would recommend scrapping mandatory third-party assessments altogether, but that "the RFI responses don't support that."
Satellite operators already placed their bets
Space is not waiting on Washington to decide. Space Systems Command's Commercial Satellite Communications Office wrote CMMC Level 3 directly into its Inmarsat BGAN and Global Xpress contract, requiring contractors to work with certified assessors to qualify. Capella Space became one of the first aerospace companies to reach CMMC Level 2, assessed by Kratos as its C3PAO, back in May 2025, well ahead of the now-frozen deadline. AvL's certification mid-freeze fits the same pattern: a bet that compliance work banked now will count for something whenever Phase 2 resumes, rather than sunk cost on a mandate that might be rewritten or scrapped.
Davies pledged a public task force report by late September. Nearly two months past that mark, no report has surfaced, Phase 2 carries no new start date, and the underlying DFARS 252.204-7012 safeguarding duties and CMMC Level 1 and 2 self-assessment requirements that took effect in November 2025 remain fully in force regardless of how the review concludes.
First reported by SatNews.
