CMMC Guide · Status

CMMC Status in 2026: Phase 2 Suspension and What Still Applies

CMMC is in effect, but its rollout is paused at Phase 1. On July 13, 2026, the Department of War suspended Phase 2. New contracts may now require only CMMC Level 1 (Self) or Level 2 (Self); third-party (C3PAO) and DIBCAC assessments cannot be required during the suspension. DFARS 252.204-7012 still applies in full.

What applies today?

Still required

  • CMMC Level 1 (Self) and Level 2 (Self) when a contract includes them
  • Self-assessment results and annual affirmations in SPRS
  • DFARS 252.204-7012: NIST SP 800-171 Rev 2 and cyber incident reporting
  • Flow-down of CMMC requirements to subcontractors
  • Government-led assessments of selected contractors

Paused

  • The move to Phase 2, planned for November 10, 2026
  • New Level 2 (C3PAO) requirements in solicitations
  • New Level 3 (DIBCAC) requirements in solicitations
  • Existing C3PAO and DIBCAC requirements are being removed from active solicitations and contracts

What changed on July 13, 2026?

The Department of War Chief Information Officer suspended the advancement to Phase 2 and directed three things:

  • Self-assessments only. Program managers may include only CMMC Level 1 (Self) or Level 2 (Self) in new requirements.
  • Relief on current contracts. Active solicitations that required a C3PAO or DIBCAC assessment must be amended, and existing contracts are modified at the next option or administrative change.
  • A program review. A 60-day review to align CMMC with the Department’s acquisition reform goals, including lower barriers for small and non-traditional businesses.

Contracting rules were updated a few days later through DFARS Class Deviation 2026-O0025, since revised. The underlying CMMC rule, 32 CFR Part 170, has not been withdrawn.

What does the suspension mean for your company?

If you handle only FCI
Nothing changes. Level 1 was always a self-assessment: meet the 15 requirements, record the result in SPRS and affirm it every year. CMMC Level 1
If you handle CUI
Expect Level 2 (Self) in new contracts. Your self-assessment score and affirmation are representations to the government, so they must be accurate and backed by evidence. CMMC Level 2
If you were preparing for a C3PAO assessment
Keep going. The requirement is paused, not repealed, and the same 110 requirements apply to your self-assessment today. Work done now counts when third-party assessments return.

CMMC timeline

  1. Dec 31, 2017

    Deadline for contractors to implement NIST SP 800-171 under DFARS 252.204-7012.

  2. Jul 2019

    DoD Inspector General reports inconsistent protection of CUI by contractors.

  3. Dec 2019

    Congress directs an assessment framework (FY2020 NDAA, Section 1648).

  4. Nov 30, 2020

    First version of CMMC (“CMMC 1.0”, five levels) takes effect through an interim DFARS rule.

  5. Nov 2021

    The Department announces CMMC 2.0: three levels and more self-assessment.

  6. Dec 16, 2024

    The CMMC program rule, 32 CFR Part 170, takes effect.

  7. Nov 10, 2025

    The DFARS contract rule takes effect and Phase 1 begins.

  8. Jul 13, 2026

    Phase 2 suspended; only Level 1 (Self) and Level 2 (Self) may be required.

  9. Sep 2026

    The 60-day program review ends. As of October 7, 2026, no decision has been published.

  10. Nov 10, 2028

    Under current contracting rules, the CMMC clause becomes standard in contracts involving FCI or CUI. Before then, it is added case by case.

What happens next?

The Department has said further guidance will follow its review. Until then, the original plan for Phases 2 to 4 (third-party assessments, then Level 3, then full implementation) is on hold. Two things are unlikely to change: the duty to protect FCI and CUI, and the government’s ability to check how well contractors do it.

Compare the levels and what each requires: CMMC levels compared.

Questions about the CMMC suspension

Is CMMC cancelled?

No. Only the move to Phase 2 is suspended. The CMMC rule (32 CFR Part 170) remains in force, contracts can still require Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 still applies.

Do we still need to submit a self-assessment in SPRS?

Yes, if your contract or solicitation requires a CMMC level. Level 1 (Self) and Level 2 (Self) results and the annual affirmation are entered in SPRS before award and kept current.

Should we still prepare for a C3PAO assessment?

Yes. The C3PAO requirement is paused, not removed, and it covers the same 110 requirements your Level 2 self-assessment must already meet. Preparing now avoids a rush when third-party assessments return.

Unsure how the suspension affects your contracts?

Talk to a CMMCMARK specialist. We’ll review what your contracts require today and help you prepare for what comes next.

Talk to a CMMC specialist Explore CMMC training

Prefer the phone? Call +1 (202) 867-8444.

Sources