SPEAKER: Kyle Lai, President & CISO, KLC Consulting
What to Expect After the CMMC Phase 2 Pause
October 1, 2026 | 1:45pm (CT) | Tulsa, Oklahoma
While the recent suspension of CMMC Phase 2 third-party certification requirements has created headlines across the Defense Industrial Base (DIB), it has also sparked widespread confusion. Does a pause in Phase 2 mean defense contractors can hit “pause” on cybersecurity?
To address these critical questions, Kyle Lai, President and CISO of KLC Consulting, is hosting an essential session for defense contractors, compliance officers, and IT leaders: “What to Expect After the CMMC Phase 2 Pause.” Drawing from deep expertise as an authorized Lead CMMC Certified Assessor, Kyle will provide actionable clarity on navigating compliance obligations during this transition period.
What You Need to Know: Session Overview
Despite the pause on mandatory C3PAO audits for Phase 2, core contractual and technical obligations remain fully active. In this session, Kyle unpacks the regulatory landscape, breaks down practical compliance risks, and outlines how organizations can stay prepared for upcoming standards.
Key Topics Covered:
- Unchanged Regulatory Standards: Why underlying requirements like NIST SP 800-171, DFARS 252.204-7012, and SPRS score postings remain legally binding.
- Self-Assessments vs. C3PAO Audits: The distinct operational, evidentiary, and liability risks associated with CMMC Level 2 Self-Assessments compared to formal C3PAO Certification Assessments.
- Real-World Assessment Lessons: Common compliance pitfalls and evidence-gathering errors identified during actual CMMC assessments.
- Future-Proofing for Revision 3: How to prepare your organization for the rollout of NIST SP 800-171 Revision 3 and future policy shifts.
Key Takeaways for Attendees
- Gain a clear roadmap of which cybersecurity requirements remain enforced during the CMMC Phase 2 pause.
- Learn the structural and risk differences between self-attestation and third-party C3PAO certifications.
- Build a defensible compliance strategy to prepare for NIST SP 800-171 Rev 3 and ongoing DoD rule changes.
Kyle Lai
President and CISO
Lead CMMC Certified Assessor (CCA)
Certified CMMC Professional (CCP)
Provisional Instructor (PI)
CISSP, CSSLP, CISA, CDPSE, CIPP/US, CIPP/G, ISO 27001 Lead Auditor
Nationally recognized as a DoD cybersecurity expert with over 20 years of experience in cyber and I.T., Kyle assesses and architects NIST 800-171 and CMMC compliance solutions for U.S. Defense Industrial Base (DIB) companies. He consulted as a security advisor to several Fortune 500 companies and the DoD. Kyle now specializes in developing cost-effective CMMC compliance solutions for: Manufacturers, Aerospace, Engineering, Software Development, and MSP/IT companies.
Kyle’s distinguished career includes consulting for high-profile clients like ExxonMobil, Zoom, DISA, Boeing, HP, Fidelity Investments, Microsoft, Akamai, and PwC. He served as the former CISO to Pactera (a Blackstone Portfolio Co.) and Brandeis University – Heller School. Kyle was also an operations manager for DISA Cybersecurity Portal (predecessor of public.cyber.mil – a department within the U.S. Department of Defense).
His broad cybersecurity expertise spans security strategy, policies, program management, vulnerability management, penetration testing, incident response, business continuity, regulatory compliance, application security, and third-party risk management. (continues)
About KLC Consulting
KLC Consulting is an Authorized C3PAO specializing in CMMC assessments and NIST 800-171 compliance for the Defense Industrial Base (DIB). Our team of Cyber AB-authorized Lead CMMC Certified Assessors has a combined 75 years of experience in the cybersecurity field, allowing us to deliver objective, high-quality CMMC Level 2 assessments and readiness services for organizations from Fortune 500s to small subcontractors. Read more about us here.
