The Department of War has suspended CMMC Phase II audits that could have cost small US defence contractors up to $593,800 each, but DOJ False Claims Act risks remain.