The Diligence Artifact Just Got Cancelled. The Liability Didn't.

If you hold defense contractors in your portfolio, the July 13 CMMC suspension changed your position in a way most of the coverage is missing.

What CMMC certification was going to be worth at exit

Set aside whether the assessment regime was good policy. From an owner's chair, CMMC Level 2 certification had a specific property: it was going to be a standardized, third-party diligence artifact for every defense portfolio company. Bought with compelled spend, yes — but a recognized asset a buyer's diligence team would accept at face value. "Are they compliant?" had a one-document answer.

On July 13, DoD cancelled the artifact. It did not cancel the liability. Under Secretary Michael Duffey:

"We're not relaxing any standards by any means. We expect businesses to adhere to the standards that NIST has outlined. What we're removing is the bureaucracy of the third-party assessment."

NIST 800-171, DFARS 252.204-7012, and the annual SPRS affirmation — signed personally by a named affirming official at each portco — all remain in force. Compelled spend with an asset became optional spend with no artifact. That is a strictly worse trade for an owner.

The question at the next exit

At the next sale process, a diligence team asks: "Has CUI ever left this environment?"

There is no certificate behind that answer anymore. There is only what the portco can produce itself. And for the highest-velocity leak path — employees using ChatGPT, Claude, and Copilot with contract data — most portcos can produce nothing, because nothing was ever logged.

An unprovable answer is an unquantifiable contingent liability, and diligence teams price unquantifiable contingent liabilities the way they always have: haircut, holdback, escrow, R&W exclusion. The suspension didn't remove that question from the checklist. It removed the easy answer.

The gap that can't be fixed in the pre-sale sprint

Most diligence findings can be remediated in the run-up to a process. This one can't. Evidence is the only asset that cannot be bought retroactively — you can't generate logs in 2027 for AI usage that happened in 2026. Every month a portco operates ungoverned adds a permanent, unrecoverable hole in exactly the record a buyer will ask about.

That asymmetry is the whole timing argument. It doesn't depend on what DoD's task force decides in 60 days, because every outcome — CMMC reinstated, replaced, or abolished — still leaves NIST 800-171 and the SPRS affirmation standing, and still leaves the diligence question unanswered without a record.

The replacement artifact

What replaces the cancelled certificate is a record the asset produces itself: a governed AI environment inside the portco's own compliance boundary, where CUI can't leave the frame and every interaction is logged, hash-chained, tamper-evident, and exportable on demand. Continuous rather than snapshot — which is more than the certificate was ever going to be, since a triennial assessment was always a point-in-time claim about a continuous obligation.

There's a second effect worth more than the de-risking: it unblocks the AI value-creation thesis in the one portfolio segment where it's currently frozen or reckless. Defense portcos are either banning AI (forfeiting the productivity while competitors don't) or tolerating shadow usage (accumulating the exposure above). A governed interface ends the dilemma — the operational gains come with the evidence trail as exhaust. De-risking gets tolerated; unblocking the mandate gets deployed.

The budget window

One timing note: FY26/27 CMMC-readiness budgets across defense portcos are already approved — and as of July 13, orphaned. That money was allocated against a certificate that no longer exists, and it gets swept back into general funds within a budget cycle. The window to redirect it toward a record the company will actually need is now.

The legal-exposure framing here describes a risk shape, not a legal opinion — run it past counsel. They'll recognize the shape.