The single most-asked question in our inbox for the last two weeks has been some version of the same thing. "I did a JSVA. Do I have a Level 2 certification, or do I have nothing?"
The honest answer is somewhere in between, and where exactly it lands depends on what the CMMC Reform Task Force does over the next 60 days. But the short version is this. Your JSVA is not worthless. Your JSVA also is not, at this moment, an active Level 2 certificate, because the mechanism that was going to turn it into one is paused. What you actually hold is a DIBCAC-witnessed assessment against NIST SP 800-171, a score in SPRS to match, and a very strong position to preserve credit under whatever program the task force recommends.
What the JSVA Actually Was
The Joint Surveillance Voluntary Assessment was the government's bridge program between "the CMMC rule is not final yet" and "the C3PAO ecosystem is stood up and ready." It let a contractor undergo a DIBCAC-led assessment against all 110 NIST SP 800-171 controls, on a voluntary basis, and post the resulting score to SPRS. If a contractor scored high enough, the assessment was intended to convert into a Level 2 certification once Phase 2 kicked in, with a three-year validity clock starting on the JSVA date.
Two things are worth being clear about, because they get conflated all the time.
- The JSVA is an assessment, not a certificate. It produced a score against the same 110 requirements a Level 2 assessment scores against. The score is real, and the DIBCAC witnesses were real. But the JSVA itself was never a CMMC Level 2 certification. It was a promise that one would be issued, mechanically, when Phase 2 turned on.
- The conversion was policy, not statute. The three-year credit rode on DoD policy announcements, not on a regulation. Policy can be preserved, revised, or replaced by the next policy. That is exactly the uncertainty the July 13 suspension put in play.
What the Conversion Was Supposed to Be
Under the pre-suspension plan, the sequence was clean. Phase 2 turns on. Contracts start carrying Level 2 certification requirements at award. Contractors that had completed a JSVA at or above the passing threshold get credited with a Level 2 certification, valid for three years from the JSVA date. No re-assessment. No trip through the C3PAO queue.
The value proposition was obvious. You got in front of the certification requirement early, you used a government assessor rather than sitting in the C3PAO capacity queue, and you locked in a three-year runway before the first re-assessment. Contractors that made the bet were, until July 13, comfortably ahead of the rest of the industrial base.
The bet was rational under the assumptions that existed. It is still rational under the assumptions that exist now. What changed is not whether the bet paid off, but the specific form the payoff takes.
What the July 13 Suspension Did to It
On July 13, 2026, the DoD suspended CMMC Phase 2 and stood up a 60-day reform task force. The suspension has a specific, bounded scope, and JSVA holders need to read that scope with care, because the question of what happens to a JSVA lives right on the seam.
What the suspension did not touch. It did not touch the JSVA record itself. Your assessment happened. The DIBCAC score is what it is. The score is posted in SPRS, and it is still the score primes see when they look you up. DFARS 252.204-7012 is untouched, so your underlying obligation to meet all 110 NIST 800-171 controls is exactly as binding as it was on July 12.
What the suspension did touch. The certification mechanism itself, which is the thing the JSVA was supposed to convert into. The C3PAO third-party certification mandate is on hold pending the review. Certification milestones on the phased rollout are frozen. Because the destination is paused, the automatic conversion into a formal Level 2 certificate is functionally paused with it. There is not, right now, an active certification pipeline into which a JSVA can pour out.
What JSVA Holders Should Do Right Now
This is the operational part. There are four things worth doing this month, and none of them are complicated.
1. Keep your SPRS score honest and current. A JSVA is a point-in-time assessment. Your environment moves. If controls drift, your SPRS score should reflect the drift. Do not let a two-year-old score sit unchanged while your infrastructure looks nothing like it did on the JSVA date. That is a False Claims Act problem waiting to happen, and it is completely avoidable.
2. Preserve the JSVA paperwork. The DIBCAC assessment record, the score at issuance, the date, and any evidence you provided during the assessment. If credit is preserved in any form by the task force, this is exactly the packet the new mechanism will ask for. Do not let it live in one person's inbox.
3. Keep the SSP and POA&M alive. Your System Security Plan should still match reality, and your POA&M should still be a live document, not a filing cabinet exhibit. Both are the evidence base for whatever comes next, and neither one gets easier to reconstruct after the fact.
4. Use the RFI window while it is open. Responses are due August 14, 2026. If you completed a JSVA, you have first-hand data on assessment cost, the DIBCAC experience, and what the government-led model does well and does poorly. That is exactly the input the task force is asking for, and JSVA holders are one of the most credible voices in the room on it. Say something on the record while the record is still being written.
Likely Outcomes for JSVA Credit
Nothing here is certain until the task force reports out. But there are only so many plausible landing spots, and JSVA credit fares differently under each.
- The certification model returns, largely unchanged. Under this outcome the original three-year conversion credit almost certainly comes back with it. There is no reason to design a new certification and then throw out the assessments the government already conducted itself.
- A tiered or risk-based certification replaces the single C3PAO path. JSVA holders are the natural population for the top tier. A government-led assessment against the full 110 is, if anything, a stronger evidence base than a C3PAO assessment, and any tier definition that ignores that would be politically difficult to defend.
- Commercial tools and managed services are recognized as compliance evidence. The RFI opens the door to this, and it is the most consequential of the possible outcomes. Even here, a JSVA is a floor, not a ceiling. Contractors that already have a DIBCAC-witnessed baseline are still ahead of contractors starting from a vendor dashboard.
- The program is materially restructured. Whatever the new structure looks like, it will still need an evidence path. JSVA credit is cheap to preserve, politically defensible, and rewards contractors that did what the DoD asked them to do. It is the low-friction option in every scenario.
The through-line is straightforward. The JSVA was work. The work happened. The evidence exists. Every plausible reform outcome has a place for that evidence. The next 60 days are about which shape that place takes, not whether it exists at all.
We will send the JSVA-credit answer the moment it lands.
The task force report is the document that turns "paused" into a direction. Whether JSVA credit carries forward, and in what form, is going to sit inside it. Leave a work email and we will send the analysis the day the answer is public.