In July 2026, the Department of War suspended the third party assessment requirement in the Cybersecurity Maturity Model Certification (CMMC) program. Self assessment obligations, reporting to the Supplier Performance Risk System (SPRS), and Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 all remain in force. The suspension changes how compliance gets verified, and the obligation to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) is unchanged. Contractors who keep building toward Level 2 readiness now will be ready to move if third party assessments return.
On July 13, 2026, the Department of War suspended Phase 2 of CMMC. That phase would have required many defense contractors to earn certification from a CMMC Third Party Assessment Organization (C3PAO) starting November 10, 2026.
The news spread fast, and so did the confusion. Some contractors took it to mean CMMC was finished. Others assumed nothing had changed. Neither reading is accurate.
In this article, you’ll learn what the suspension covers, which CMMC obligations still apply to every contractor handling FCI or CUI, and what it means if you’re partway through building toward Level 2 readiness.
What Changed
The suspended requirement is Phase 2: the rule that a C3PAO independently verify a contractor’s CMMC Level 2 status before contract award. That requirement was scheduled to take effect on November 10, 2026. The Department also suspended all pending and future CMMC implementation milestones across its solicitations and contracts.
The Department said the program had created prohibitive compliance costs and bureaucratic burdens, especially for small businesses. Officials also pointed to the mismatch between the more than 100,000 contractors who would eventually need an assessment and the limited number of certified assessors available. A new CMMC Reform Task Force was given 60 days to review the program and report back.
In practice, contracting officers cannot require a Level 2 certification from a C3PAO or a Level 3 assessment from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
If a third party certification requirement already appears in a contract you hold, it stays in place until your contracting officer formally modifies the contract. Confirm in writing how the suspension applies to you.
What Didn’t Change
Phase 1 self assessment requirements, in effect since November 2025, still apply.
If your contract calls for CMMC Level 1 or Level 2 (Self), you still need to submit a current self assessment score to SPRS, and your Affirming Official still has to sign off each year.
DFARS 252.204-7012 still applies, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 is still the standard your controls are measured against.
The Department was clear on this point. The suspension leaves the requirement to protect federal data in place, and every defense contractor remains contractually obligated to safeguard covered defense information under DFARS 252.204-7012. During the suspension, the Department says it will enforce compliance through self assessments and select government led assessments.
Legal analysis since the announcement adds that the accuracy of your self assessment may matter more now, since it has become the main way compliance gets verified.
Why It Pays to Keep Preparing
Some contractors will treat the suspension as a reason to slow down. That’s the expensive choice.
The Department hasn’t said what comes next. Officials have not ruled out ending CMMC, and a revised program could also bring assessment requirements back on short notice. Contractors who kept building toward Level 2 readiness will be ready to bid either way. Those who stopped would start further behind, competing for the same limited pool of assessors on a shorter runway.
A gap a third party audit would have caught is still there with the audit suspended. It simply surfaces later, and in a less convenient way, such as a DIBCAC review or a compliance complaint.
Conclusion
The suspension doesn’t change the underlying job of protecting FCI and CUI, and it doesn’t reduce the risk of getting self assessment wrong. If anything, self assessment now carries more weight than it did a month ago, since it’s the only verification mechanism currently in play.
If you’re not sure how the suspension affects your contracts or your self assessment, let’s walk through it together. We’ll give you a straight read on where you stand, at no cost.
FAQ
Does this mean CMMC is going away?
The Department of War suspended the Phase 2 third party assessment requirement while a Reform Task Force reviews the program. Phase 1 self assessment requirements, SPRS reporting, and DFARS 252.204-7012 all still apply. The long term shape of CMMC depends on that review, and officials have not ruled out major changes.
Do I still need to submit a self assessment score to SPRS?
Yes. If your contract requires CMMC Level 1 (Self) or Level 2 (Self), you still need a current, accurate self assessment score in SPRS, with your Affirming Official’s sign off on file. That requirement was never part of the suspension.
What happens if my contract already references a third party assessment requirement?
Contracting officers are directed to amend solicitations and contracts to remove C3PAO and DIBCAC assessment requirements. Until your contract is formally modified, the clause stays in place, so confirm with your contracting officer how the suspension applies to you.
Should I stop preparing for a future third party assessment?
Stopping is likely the more expensive choice. The requirement is suspended, and officials haven’t said what a revised program will look like. Contractors who keep building toward Level 2 readiness now will be ready to move quickly if third party assessments return.
When will third party assessments resume?
No date has been set. The Task Force began its 60 day review on July 13, 2026, and its recommendations go to the Department’s Chief Information Officer. Until the Department announces a decision, the third party assessment requirement stays suspended.
About the Author: scott
Learn how SPF, DKIM, and DMARC work together to stop email spoofing and protect your business from domain impersonation.
QR code scams are becoming more common because they can bypass traditional email security. Learn how quishing works, how to recognize it, and how to protect your business.
A cyberattack can move quickly, and the first hour matters. This guide explains what to do first, what mistakes to avoid, who to call, and how to protect your business from further damage.
AI note-takers can save time, but they also create stored records of business conversations. Before using them in sensitive meetings, know where the data goes, who can access it, and when consent is required.
Fix messy offboarding by cleaning up SaaS accounts, shared logins, personal devices, and client handoffs before they create risk.
Older Microsoft 365 tenants can carry settings that no longer match today’s security defaults. These five checks help you find quiet gaps before they create bigger risk.
Microsoft 365 Copilot works with the permissions your employees already have. Before turning it on, review old access, shared files, Teams membership, and sensitivity labels so confidential information does not surface where it should not.
Cloud-only is not always the smartest path. This article explains when a hybrid cloud strategy can help businesses control costs, improve performance, and keep the right systems closer to home.
Most offboarding checklists cover email and devices, but SaaS access is often missed. Learn where zombie accounts hide and how to remove them before they create security risk.
Fake recruiter messages can look legitimate enough to catch employees off guard. Learn how LinkedIn recruitment scams work, what warning signs to watch for, and how to reduce the risk before one message turns into a bigger security problem.
STAY IN THE LOOP
Subscribe to our free newsletter.
