In July 2026, the Department of War suspended the third party assessment requirement in the Cybersecurity Maturity Model Certification (CMMC) program. Self assessment obligations, reporting to the Supplier Performance Risk System (SPRS), and Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 all remain in force. The suspension changes how compliance gets verified, and the obligation to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) is unchanged. Contractors who keep building toward Level 2 readiness now will be ready to move if third party assessments return.
On July 13, 2026, the Department of War suspended Phase 2 of CMMC. That phase would have required many defense contractors to earn certification from a CMMC Third Party Assessment Organization (C3PAO) starting November 10, 2026.
The news spread fast, and so did the confusion. Some contractors took it to mean CMMC was finished. Others assumed nothing had changed. Neither reading is accurate.
In this article, you’ll learn what the suspension covers, which CMMC obligations still apply to every contractor handling FCI or CUI, and what it means if you’re partway through building toward Level 2 readiness.
What Changed
The suspended requirement is Phase 2: the rule that a C3PAO independently verify a contractor’s CMMC Level 2 status before contract award. That requirement was scheduled to take effect on November 10, 2026. The Department also suspended all pending and future CMMC implementation milestones across its solicitations and contracts.
The Department said the program had created prohibitive compliance costs and bureaucratic burdens, especially for small businesses. Officials also pointed to the mismatch between the more than 100,000 contractors who would eventually need an assessment and the limited number of certified assessors available. A new CMMC Reform Task Force was given 60 days to review the program and report back.
In practice, contracting officers cannot require a Level 2 certification from a C3PAO or a Level 3 assessment from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
If a third party certification requirement already appears in a contract you hold, it stays in place until your contracting officer formally modifies the contract. Confirm in writing how the suspension applies to you.
What Didn’t Change
Phase 1 self assessment requirements, in effect since November 2025, still apply.
If your contract calls for CMMC Level 1 or Level 2 (Self), you still need to submit a current self assessment score to SPRS, and your Affirming Official still has to sign off each year.
DFARS 252.204-7012 still applies, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 is still the standard your controls are measured against.
The Department was clear on this point. The suspension leaves the requirement to protect federal data in place, and every defense contractor remains contractually obligated to safeguard covered defense information under DFARS 252.204-7012. During the suspension, the Department says it will enforce compliance through self assessments and select government led assessments.
Legal analysis since the announcement adds that the accuracy of your self assessment may matter more now, since it has become the main way compliance gets verified.
Why It Pays to Keep Preparing
Some contractors will treat the suspension as a reason to slow down. That’s the expensive choice.
The Department hasn’t said what comes next. Officials have not ruled out ending CMMC, and a revised program could also bring assessment requirements back on short notice. Contractors who kept building toward Level 2 readiness will be ready to bid either way. Those who stopped would start further behind, competing for the same limited pool of assessors on a shorter runway.
A gap a third party audit would have caught is still there with the audit suspended. It simply surfaces later, and in a less convenient way, such as a DIBCAC review or a compliance complaint.
Conclusion
The suspension doesn’t change the underlying job of protecting FCI and CUI, and it doesn’t reduce the risk of getting self assessment wrong. If anything, self assessment now carries more weight than it did a month ago, since it’s the only verification mechanism currently in play.
If you’re not sure how the suspension affects your contracts or your self assessment, let’s walk through it together. We’ll give you a straight read on where you stand, at no cost.
FAQ
Does this mean CMMC is going away?
The Department of War suspended the Phase 2 third party assessment requirement while a Reform Task Force reviews the program. Phase 1 self assessment requirements, SPRS reporting, and DFARS 252.204-7012 all still apply. The long term shape of CMMC depends on that review, and officials have not ruled out major changes.
Do I still need to submit a self assessment score to SPRS?
Yes. If your contract requires CMMC Level 1 (Self) or Level 2 (Self), you still need a current, accurate self assessment score in SPRS, with your Affirming Official’s sign off on file. That requirement was never part of the suspension.
What happens if my contract already references a third party assessment requirement?
Contracting officers are directed to amend solicitations and contracts to remove C3PAO and DIBCAC assessment requirements. Until your contract is formally modified, the clause stays in place, so confirm with your contracting officer how the suspension applies to you.
Should I stop preparing for a future third party assessment?
Stopping is likely the more expensive choice. The requirement is suspended, and officials haven’t said what a revised program will look like. Contractors who keep building toward Level 2 readiness now will be ready to move quickly if third party assessments return.
When will third party assessments resume?
No date has been set. The Task Force began its 60 day review on July 13, 2026, and its recommendations go to the Department’s Chief Information Officer. Until the Department announces a decision, the third party assessment requirement stays suspended.
About the Author: scott
Commercial Microsoft 365 falls short of CMMC requirements for protecting CUI. Here’s how to tell whether GCC or GCC High is the right fit for your contract.
FCI and CUI carry very different obligations. Which one your company handles decides your CMMC level and how much compliance work you’re signing up for.
A GCC migration means building a new Microsoft 365 environment from scratch and moving your business into it. Here's what the process involves and what tends to catch people off guard.
The Department of War suspended the CMMC third party assessment requirement in July 2026, and self assessment and DFARS obligations remain in force. Here is what changed and what contractors still need to do.
CMMC compliance comes down to five phases that take you from your first gap assessment to a third party audit. A sixth phase of ongoing maintenance keeps you compliant once you get there.
Boeing has been messaging its supply chain about CMMC readiness, on a schedule separate from the government’s. Here’s what that means in practice.
Phishing emails used to give themselves away through bad spelling. AI has closed that gap, so your team needs a better way to tell what is real.
Most compromised business websites were never singled out. An automated tool found an outdated plugin and took it from there. Here's how to tell if your site carries that same risk, and what a fix actually looks like.
A cloud outage does not need a hacker behind it to shut down your business for a few hours. A short continuity plan is what keeps your team working and your customers informed until service returns.
Zero Trust is no longer just for large enterprises. For small businesses, it offers a practical way to limit access, reduce risk, and protect critical data as cloud tools, remote work, and modern threats change how security needs to work.
STAY IN THE LOOP
Subscribe to our free newsletter.
