CMMC Phase 2 Suspended: A Clear Guide to What Still Applies in 2026

Last updated 19 September 2026

CMMC Phase 2 was scheduled to begin on 10 November 2026, the day third-party certification would have become a condition of award for contracts involving Controlled Unclassified Information. It did not happen. On 13 July 2026 the Department of War suspended the transition to Phase 2 and every pending and future CMMC implementation milestone, ordered contracts already carrying Level 2 (C3PAO) and Level 3 requirements to be amended to remove them, and launched a 60-day review of the program.

A class deviation signed on 3 September 2026 made the suspension binding on contracting officers. Phase 1 — self-assessments, SPRS scores and annual affirmations — continues exactly as before. This guide sets out what CMMC Phase 2 was, what the suspension changed and did not change, where the review stands, and what a defense contractor should be doing in the meantime.

What CMMC Phase 2 was

The CMMC program rule at 32 CFR 170.3(e) staged the requirement across four phases from the effective date of the DFARS acquisition rule, which was 10 November 2025:

Phase 2 was the step with the cost. A Level 2 self-assessment is an internal exercise scored into SPRS; a Level 2 certification is an on-site assessment by an authorized C3PAO against all 320 NIST SP 800-171A objectives, at a three-year cost the rule’s own analysis put at roughly $105,000 for a small entity. The bottleneck was capacity: authorized C3PAOs numbered in the dozens against tens of thousands of contractors holding CUI. Our guide to CMMC compliance and the rollout covers the phase structure as the rule wrote it.

The suspension: 13 July 2026

The Department of War announced the suspension on 13 July 2026, with a memo issued the following day. Its scope is broad. Suspended: “the transition to Phase II requirements of CMMC, as well as pending and future CMMC implementation milestones across the Department of War solicitations and contracts”. Directed: “active solicitations and contracts, which already include CMMC Level 2 C3PAO or CMMC Level 3 assessment requirements, must be amended to remove those requirements”. Preserved: “DFARS 252.204-7012 and CMMC Phase I self-assessment requirements remain unaffected”, including Level 1 self-assessed certifications and attestations to protect FCI and Level 2 self-assessments and attestations to protect CUI.

The memo also created a CMMC Reform Task Force to conduct “a comprehensive top-to-bottom review” and deliver a final report within 60 days, and opened a request for information to industry with responses due 14 August 2026. Around 1,100 responses were received. Cyber AB, the accreditation body, said on 15 July that only the Phase 2 implementation requirements were suspended and “all CMMC program elements remain operational and available” — C3PAOs can still assess and certify, voluntarily.

On 3 September 2026 a class deviation signed by the Department’s principal director for defense pricing, contracting and acquisition policy directed contracting officers to follow the suspension rather than the final rule’s phase schedule — the step that turned an announcement into binding contracting guidance. The 60-day review window closed on 11 September 2026. As of mid-September no report, recommendations or replacement schedule had been published; the results go to the DoD CIO, who decides whether and when to make them public.

What CMMC Phase 2 suspension changed, and what it did not

Two points deserve emphasis. First, the suspension is of milestones, not of the rule: 32 CFR Part 170 still defines the levels, the scoring, the POA&M rules and the assessment ecosystem, and any revived or reformed program will be built on it. Second, the self-attestation you post in SPRS is a representation to the government. The Department of Justice has already used the False Claims Act against contractors whose affirmed NIST SP 800-171 compliance was untrue, and nothing in the suspension changes that exposure — if anything, a period in which self-attestation is the only check makes the attestation more consequential, not less.

What contractors should do during the CMMC Phase 2 pause

1. Keep Phase 1 current. The Level 1 or Level 2 self-assessment, the SPRS score and the annual affirmation are still conditions of award where the contract carries them. Missing an affirmation during the pause is a live ineligibility, not a technicality.
2. Make the SPRS score true. Score against the 800-171A objectives, not the requirement headings; close POA&M items within the 180-day limit; keep six years of evidence. Our guide to the SPRS score covers the scoring rules.
3. Read your prime’s flow-down clauses. Several primes wrote C3PAO certification into subcontract terms ahead of Phase 2 and have not withdrawn it. The pause is DoD’s; the prime’s requirement is contractual.
4. Decide on voluntary certification on your own facts. A C3PAO certificate remains the strongest evidence that the SPRS affirmation is accurate, capacity is available now, and a certified contractor is at the front of whatever queue the reformed program creates. Our guide to choosing a C3PAO covers the decision.
5. Scope properly now. Whatever the review produces, the CUI boundary, the asset inventory and the SSP are the artifacts every version of the program has required. Our guide to CMMC scoping sets out the five asset categories.
6. Watch three sources, not the commentary. The DoD CIO CMMC page for the review outcome, the Federal Register for any amendment to 32 CFR 170 or the DFARS clauses, and your contracting officer for the class deviation as applied to your contracts.

What might come out of the review

The RFI responses reportedly favoured reform over abolition, with the identification and marking of CUI — not assessment fees — the most cited problem. The plausible outcomes range from a rescheduled Phase 2 with more C3PAO capacity, through a narrower certification requirement targeted at higher-risk CUI, to a self-attestation model with government spot-checks. None of them removes NIST SP 800-171, DFARS 7012 or the SPRS affirmation, which is why the preparation above is not wasted under any of them. What the review cannot do quickly is amend 32 CFR Part 170 or the DFARS clauses: those require rulemaking, so any structural change will come with its own notice period.

Frequently asked questions

Is CMMC Phase 2 still happening on 10 November 2026?
No. The Department of War suspended the transition to Phase 2 on 13 July 2026 and a class deviation of 3 September 2026 directs contracting officers accordingly. No replacement date has been published.

Do we still have to do the CMMC self-assessment?
Yes. Phase 1 requirements — Level 1 and Level 2 self-assessments, SPRS submissions and annual affirmations — are explicitly unaffected by the suspension, as is DFARS 252.204-7012.

Are C3PAO assessments cancelled?
Not as a program element. Cyber AB confirmed C3PAOs remain operational and can certify voluntarily. What is suspended is the requirement for C3PAO certification as a condition of award, and existing contract clauses requiring it are being removed.

Did the 60-day review report come out?
The review window closed on 11 September 2026. As of mid-September 2026 no report or recommendations had been published; publication is at the discretion of the DoD CIO.

Has 32 CFR Part 170 been changed?
No. The program rule is unamended. The suspension operates through departmental direction and a class deviation, not through rulemaking.

Where this leaves you

CMMC Phase 2 is suspended, not repealed, and the obligations underneath it never moved. Keep the self-assessment honest and the affirmation current, read your primes’ clauses, scope the CUI boundary as if the assessor were coming, and decide on voluntary certification on your own risk. When the review lands, the contractors in the best position will be the ones who treated the pause as time, not as relief.

References

• Holland & Knight: DOW Suspends CMMC Phase II Requirements — Law-firm analysis of the 13–14 July 2026 suspension and memo.
• Crowell & Moring: Department of War Immediately Suspends CMMC Phase II Requirements — Quotes from the suspension memo: what is suspended and what remains unaffected.
• Nextgov/FCW: CMMC’s Phase 2 suspension locked in with binding regulation — The 3 September 2026 class deviation and the status of the review.
• 32 CFR Part 170 — Cybersecurity Maturity Model Certification Program — §170.3(e), the four-phase implementation the suspension paused.

More on CMMC

• CMMC Phase 2 — you are here
• CMMC compliance: the phased rollout
• CMMC Level 1: the 15 requirements
• C3PAO: choosing a CMMC assessor
• CMMC scoping: the five asset categories
• CMMC Level 2 certification cost

The SSP template, the CMMC Gap Analysis Workbook, the SPRS Score Calculation guide and the policies behind all 110 Level 2 requirements — the Phase 1 obligations the suspension left in place — are in the CMMC Documentation Toolkit, or start with the free templates.