# HX5 Maintains Cybersecurity Spending During CMMC Pause

HX5 CEO Margarita Howard says the company will maintain its cybersecurity spending despite the suspension of CMMC certification requirements. The pause does not remove defense contractors’ continuing obligations under NIST SP 800-171 and DFARS 252.204-7012, or self-assessment reporting to the Pentagon’s Supplier Performance Risk System (SPRS), so suppliers still face compliance and enforcement exposure.

- Defense suppliers must continue applicable NIST SP 800-171 controls, DFARS 252.204-7012 obligations, and SPRS self-assessment reporting despite the certification pause.
- Contractors should treat the pause as a change in certification timing, not as a reason to reduce cybersecurity controls or compliance investment.
- HX5’s decision signals continued demand for cybersecurity capabilities and support among defense suppliers during the pause.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 14, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Vendors
- HX5 (Defense contractor)

### Sources
- [Why Margarita Howard Is Keeping HX5’s Cyber Budget Whole Through the CMMC Pause - CEOWORLD magazine](https://ceoworld.biz/2026/10/14/why-margarita-howard-is-keeping-hx5s-cyber-budget-whole-through-the-cmmc-pause) - CEOWORLD magazine