CMMC Phase 2 Suspended: What Changed and What Didn’t

In July 2026, the Department of War suspended the third party assessment requirement in the Cybersecurity Maturity Model Certification (CMMC) program. Self assessment obligations, reporting to the Supplier Performance Risk System (SPRS), and Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 all remain in force. The suspension changes how compliance gets verified, and the obligation to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) is unchanged. Contractors who keep building toward Level 2 readiness now will be ready to move if third party assessments return.

On July 13, 2026, the Department of War suspended Phase 2 of CMMC. That phase would have required many defense contractors to earn certification from a CMMC Third Party Assessment Organization (C3PAO) starting November 10, 2026.

The news spread fast, and so did the confusion. Some contractors took it to mean CMMC was finished. Others assumed nothing had changed. Neither reading is accurate.

In this article, you’ll learn what the suspension covers, which CMMC obligations still apply to every contractor handling FCI or CUI, and what it means if you’re partway through building toward Level 2 readiness.

What Changed

The suspended requirement is Phase 2: the rule that a C3PAO independently verify a contractor’s CMMC Level 2 status before contract award. That requirement was scheduled to take effect on November 10, 2026. The Department also suspended all pending and future CMMC implementation milestones across its solicitations and contracts.

The Department said the program had created prohibitive compliance costs and bureaucratic burdens, especially for small businesses. Officials also pointed to the mismatch between the more than 100,000 contractors who would eventually need an assessment and the limited number of certified assessors available. A new CMMC Reform Task Force was given 60 days to review the program and report back.

In practice, contracting officers cannot require a Level 2 certification from a C3PAO or a Level 3 assessment from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

If a third party certification requirement already appears in a contract you hold, it stays in place until your contracting officer formally modifies the contract. Confirm in writing how the suspension applies to you.

What Didn’t Change

Phase 1 self assessment requirements, in effect since November 2025, still apply.

If your contract calls for CMMC Level 1 or Level 2 (Self), you still need to submit a current self assessment score to SPRS, and your Affirming Official still has to sign off each year.

DFARS 252.204-7012 still applies, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 is still the standard your controls are measured against.

The Department was clear on this point. The suspension leaves the requirement to protect federal data in place, and every defense contractor remains contractually obligated to safeguard covered defense information under DFARS 252.204-7012. During the suspension, the Department says it will enforce compliance through self assessments and select government led assessments.

Legal analysis since the announcement adds that the accuracy of your self assessment may matter more now, since it has become the main way compliance gets verified.

Why It Pays to Keep Preparing

Some contractors will treat the suspension as a reason to slow down. That’s the expensive choice.

The Department hasn’t said what comes next. Officials have not ruled out ending CMMC, and a revised program could also bring assessment requirements back on short notice. Contractors who kept building toward Level 2 readiness will be ready to bid either way. Those who stopped would start further behind, competing for the same limited pool of assessors on a shorter runway.

A gap a third party audit would have caught is still there with the audit suspended. It simply surfaces later, and in a less convenient way, such as a DIBCAC review or a compliance complaint.

Conclusion

The suspension doesn’t change the underlying job of protecting FCI and CUI, and it doesn’t reduce the risk of getting self assessment wrong. If anything, self assessment now carries more weight than it did a month ago, since it’s the only verification mechanism currently in play.

If you’re not sure how the suspension affects your contracts or your self assessment, let’s walk through it together. We’ll give you a straight read on where you stand, at no cost.

FAQ

Does this mean CMMC is going away?

The Department of War suspended the Phase 2 third party assessment requirement while a Reform Task Force reviews the program. Phase 1 self assessment requirements, SPRS reporting, and DFARS 252.204-7012 all still apply. The long term shape of CMMC depends on that review, and officials have not ruled out major changes.

Do I still need to submit a self assessment score to SPRS?

Yes. If your contract requires CMMC Level 1 (Self) or Level 2 (Self), you still need a current, accurate self assessment score in SPRS, with your Affirming Official’s sign off on file. That requirement was never part of the suspension.

What happens if my contract already references a third party assessment requirement?

Contracting officers are directed to amend solicitations and contracts to remove C3PAO and DIBCAC assessment requirements. Until your contract is formally modified, the clause stays in place, so confirm with your contracting officer how the suspension applies to you.

Should I stop preparing for a future third party assessment?

Stopping is likely the more expensive choice. The requirement is suspended, and officials haven’t said what a revised program will look like. Contractors who keep building toward Level 2 readiness now will be ready to move quickly if third party assessments return.

When will third party assessments resume?

No date has been set. The Task Force began its 60 day review on July 13, 2026, and its recommendations go to the Department’s Chief Information Officer. Until the Department announces a decision, the third party assessment requirement stays suspended.