CMMC guide

CMMC Phase 2 suspended: what still applies

DoD suspended Phase 2 of CMMC on July 13, 2026, so C3PAO assessments are not being required in new solicitations while the program is reviewed. Everything else still applies: DFARS 252.204-7012, the 110 requirements of NIST SP 800-171 Rev 2, a current score in SPRS and Phase 1 self-assessments with annual affirmations.

Last checked: October 29, 2026. We recheck this page every month.

Paused and still in force

What the CMMC Phase 2 suspension paused and what still applies
Requirement Status today
Level 2 C3PAO assessments in new solicitations Paused Paused. Solicitations may designate only Level 1 or Level 2 self-assessments.
Level 3 DIBCAC assessments in new solicitations Paused Paused.
CMMC waivers Paused None granted during the review.
CMMC program rule (32 CFR Part 170) In force In force since December 16, 2024.
DFARS 252.204-7021 (CMMC clause) In force In force. Becomes automatic in new contracts involving FCI or CUI from November 10, 2028 (Class Deviation 2026-O0025, Revision 3).
Level 1 and Level 2 self-assessments, with annual affirmations In force Required where the solicitation designates them (Phase 1, since November 10, 2025).
DFARS 252.204-7012 and NIST SP 800-171 Rev 2 In force Required for contracts with CUI, including 72-hour cyber incident reporting.
SPRS score (DFARS 252.204-7019 and 7020) In force A current self-assessment score is still required.
Flow-down to subcontractors In force Still applies to subcontractors handling the same FCI or CUI.

Timeline

  1. December 16, 2024

    The CMMC program rule (32 CFR Part 170) takes effect.

  2. November 10, 2025

    Phase 1 begins: Level 1 and Level 2 self-assessments can be required in new DoD solicitations.

  3. July 13, 2026

    DoD suspends Phase 2, which would have added C3PAO assessments from November 10, 2026, and starts a review of the program.

  4. August 14, 2026

    The public request for information on the program closes.

  5. September 3, 2026

    DFARS Class Deviation 2026-O0025, Revision 3: solicitations accept Level 1 and Level 2 self-assessments; the CMMC clause becomes automatic in new contracts from November 10, 2028.

  6. September 2026

    The review task force's recommendations are due to DoD. Reported options include restarting Phase 2 for a narrower group of contracts.

  7. October 2026

    No decision announced. Third-party assessments are still not being required.

What to do now

Keep implementing NIST SP 800-171

The 110 requirements apply under DFARS 252.204-7012 whether or not Phase 2 resumes. The suspension changes who assesses you, not what you must do.

Make your SPRS score accurate

Score each requirement with the DoD Assessment Methodology and keep the score current. An affirmation is a representation to the government.

Keep evidence as you go

When Phase 2 resumes, a C3PAO will ask for evidence of each practice. Collecting it now is far easier than reconstructing it later.

Check each solicitation

The level and assessment type in the solicitation are what apply to that contract. Primes may also ask their suppliers for their SPRS status.

TractionGRC tracks all three CMMC levels with owners, evidence and a readiness checklist. See CMMC compliance software for small defense contractors, or what the work costs in the CMMC Level 2 cost guide.

This is a summary, not legal advice. The requirement in each solicitation and contract is what applies to you.

Questions

Is CMMC cancelled?

No. Phase 2 of the rollout was suspended on July 13, 2026 while DoD reviews the program. The CMMC rule (32 CFR Part 170) and the DFARS clause 252.204-7021 remain in force, and Phase 1 self-assessment requirements continue.

Do I still need a C3PAO assessment?

Not for current DoD solicitations: during the review they designate only Level 1 or Level 2 self-assessments, and no CMMC waivers are granted. Third-party assessments are expected to return when Phase 2 resumes, so keep your evidence ready.

What happens to companies that already hold a Level 2 certification?

DoD hasn't said how existing C3PAO certifications will be treated going forward. They were issued under the rule that is still in force; watch for guidance when the review concludes.

Do I still need an SPRS score?

Yes. DFARS 252.204-7019 and 252.204-7020 still require a current NIST SP 800-171 self-assessment score in SPRS, and CMMC Phase 1 adds annual affirmations. The affirmation is a representation to the government, so it should match what is actually implemented.

When will Phase 2 restart?

No date has been set. Reported task force options include restarting Phase 2 for a narrower group of contracts, but DoD hasn't announced a decision. We update this page when it does.

Sources