CMMC Phase 2 is suspended. Here is what still applies.
By Sid Varma, Founder - AllyMatter.com
Published September 25, 2026
The short version
- The move to CMMC Phase 2, due on November 10, 2026, is suspended. The Department of War announced it on July 13, 2026.
- While the suspension lasts, defense contracts can ask only for CMMC Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) cannot be required.
- NIST SP 800-171 Revision 2 still applies through DFARS 252.204-7012, and so do the self-assessments and yearly affirmations entered in SPRS.
- CMMC has not been repealed. The rule text is unchanged. The suspension works through contracting instructions, made binding on contracting officers on September 3, 2026.
- A 60-day review was due to report around September 11, 2026. As of September 25 its findings have not been published.
If your company has been working toward a CMMC Level 2 certificate from a third-party assessor before November 10, 2026, that deadline is gone. The Department of War suspended Phase 2 of the Cybersecurity Maturity Model Certification program on July 13, 2026, and on September 3 wrote the suspension into the instructions contracting officers must follow.
What did not go away is the security work underneath. This article sets out what stopped, what still applies, and the questions the published documents do not answer yet.
What did the suspension stop?
It stopped the move to third-party certification as a condition of winning a contract. Under the CMMC program rule, Phase 2 was to begin one year after Phase 1, which started on November 10, 2025. From that date the Department intended to require a CMMC Level 2 certificate from a certified third-party assessment organization (a C3PAO) on applicable contracts.
The Chief Information Officer's memorandum suspends that November 2026 transition and holds "all pending and future CMMC implementation milestones" in abeyance "until further notice". That covers Phases 3 and 4 as well.
The implementing memorandum from the Under Secretary for Acquisition and Sustainment, dated July 13, 2026, is specific. Program managers may put only CMMC Level 1 (Self) or Level 2 (Self) into procurement requests. They "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period", and no waivers will be granted while the review runs.
What still applies to you?
Everything that does not depend on a third-party certificate. Both July 13 memoranda say so directly: DFARS 252.204-7012 "remain[s] in effect", and the Department will keep enforcing baseline compliance with NIST SP 800-171 Revision 2 through self-assessments and "select Government-led assessments".
| Requirement | Status on September 25, 2026 | Where it comes from |
|---|---|---|
| Basic safeguarding of Federal contract information (FAR 52.204-21) | Still applies | Implementing memorandum, Attachment 1 |
| NIST SP 800-171 Rev 2 and 72-hour cyber incident reporting (DFARS 252.204-7012) | Still applies | Both July 13 memoranda |
| CMMC Level 1 (Self): self-assessment every year, results in SPRS, yearly affirmation | Applies where the contract asks for it | 32 CFR 170.15 and 170.22 |
| CMMC Level 2 (Self): self-assessment every three years, results in SPRS, yearly affirmation | Applies where the contract asks for it | 32 CFR 170.16 and 170.22 |
| CMMC Level 2 (C3PAO) as a condition of award | Suspended | Both July 13 memoranda; Class Deviation 2026-O0025 Rev 3 |
| CMMC Level 3 (DIBCAC) | Suspended | Implementing memorandum, Attachment 1 |
| Government-led assessments | Continue for "select" contractors; who is selected is not published | CIO memorandum |
The affirmation is the item most likely to be missed. Under 32 CFR 170.22 a senior official of the company affirms in SPRS that it continues to meet the requirements, at the first assessment and every year after. The suspension does not touch that.
Has CMMC been repealed?
No. The CMMC program rule at 32 CFR Part 170 has not been amended since it took effect on December 16, 2024, according to the eCFR amendment history we checked on September 25, 2026. The contract clause DFARS 252.204-7021 was last amended on November 10, 2025.
The four-phase schedule in 32 CFR 170.3(e) still reads as it did.
The suspension works one level down, through what goes into a solicitation or contract. The rule allows the Department to choose which CMMC status each contract requires, and the memoranda tell it to choose only the self-assessed ones for now.
What changed on September 3, 2026?
The suspension became binding acquisition guidance. Class Deviation 2026-O0025, Revision 3, signed on September 3, 2026 by John Tenaglia, Principal Director of Defense Pricing, Contracting, and Acquisition Policy, tells contracting officers to work with requiring activities to "remove or revise" CMMC requirements in new and existing solicitations and contracts in line with the July 13 memorandum.
Revision 3 carries forward direction first given in Revision 2 of July 16, 2026. It also restates the practical steps, set out in the next section.
What happens to a solicitation or contract that already asks for a C3PAO certificate?
It is supposed to be amended, but not all at once. For active solicitations, the program office starts an amendment that removes the Level 2 (C3PAO) or Level 3 requirement, and the contracting officer issues it "as soon as practicable".
For contracts already signed, the requirement is removed by modification "prior to the exercise of the next option period or through the next scheduled administrative modification". Until that modification arrives, the contract still says what it says. The person who can confirm where a particular contract stands is its contracting officer.
What is the CMMC Reform Task Force?
It is the group the Chief Information Officer set up to run a "top-to-bottom 60-day review" of the program. Its brief is to recommend a framework that "replaces prohibitive, third-party compliance models with scalable, realistic security measures". Sixty days from July 13 is September 11, 2026.
As of September 25, 2026, the Department of War CIO's CMMC page has not published the findings. The CIO memorandum says only that further guidance "will be promulgated in the coming months". When it is, we will add a dated note to the top of this article rather than rewrite it.
What are others saying?
These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.
Lawyers at Latham & Watkins argue that the suspension lightens the assessment burden without lightening the obligations. In a July 30 client alert, the firm warns that leaning on self-assessment raises a contractor's exposure under the False Claims Act, and urges companies to review how their cybersecurity affirmations are made and to keep contemporaneous evidence of the controls they have in place.
Olivia Lynch and Cherie J. Owen of Crowell & Moring warn that an agency which fails to amend a solicitation could still evaluate bids against the requirement as written. Writing two days after the suspension, they advise offerors to press the point through the question-and-answer process and, if needed, to consider a pre-award protest to get Phase 2 requirements removed.
Susan B. Cassidy, Ryan Burnette and Darby Rourick of Covington read the Department as weighing roll-backs of planned requirements alongside possible expansions, such as the security of operational technology. Their conclusion is that reform may not move in one direction only.
What we could not verify
Whether a Level 2 (C3PAO) certificate already earned, or an assessment started now, will count for anything after the review. None of the three documents addresses it.
Which contractors will face the "select Government-led assessments" the CIO memorandum mentions, or who will carry them out. The memorandum does not name DIBCAC or any other body for this.
The exact title and date of the CIO memorandum. The class deviation cites it as "Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, dated July 13, 2026". The copy posted on the CIO's site carries a different subject line and no visible date.
The July 13 date is confirmed by the CIO's CMMC page and by the implementing memorandum, which is dated.
Whether the Department will propose changes to 32 CFR Part 170 or to the DFARS clause. We found no proposed rule as of September 25, 2026.
Need a hand implementing it?
Find a consultant for CMMC/NIST 800-171
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Is CMMC canceled?
No. Phase 2 and later phases are suspended while the program is reviewed. The rule at 32 CFR Part 170 and the clause at DFARS 252.204-7021 are unchanged, and contracts can still require CMMC Level 1 (Self) or Level 2 (Self).
Do we still need to post a score and an affirmation in SPRS?
Yes, if your contract asks for CMMC Level 1 (Self) or Level 2 (Self). Level 1 is a self-assessment every year and Level 2 every three years, and in both cases a senior official affirms continuing compliance every year (32 CFR 170.15, 170.16 and 170.22).
Our contract requires a Level 2 (C3PAO) certificate. What now?
Existing contracts are to have the requirement removed by modification before the next option is exercised or at the next scheduled administrative modification. Until then the contract text stands. Your contracting officer can say where your contract is.
Does NIST SP 800-171 still apply?
Yes. Revision 2 still applies through DFARS 252.204-7012, which both July 13 memoranda say remains in effect, together with its cyber incident reporting requirement.
When will we know what replaces Phase 2?
The review was due around September 11, 2026. Its findings had not been published by September 25. The CIO memorandum says further guidance will come in the coming months.
What each one is doing here.
Department of War CIO, Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of CMMC Requirements, signed Kirsten A. DaviesUnder Secretary of War for Acquisition and Sustainment, Implementing the Suspension of CMMC Phase 2 Requirements, July 13, 2026, signed Michael P. Duffey, with Attachment 1Department of War CIO, Cybersecurity Maturity Model Certification pageDefense Pricing, Contracting, and Acquisition Policy, Class Deviation 2026-O0025, Revision 3, September 3, 2026eCFR, 32 CFR 170.3, ApplicabilityeCFR, 32 CFR 170.15, 170.16 and 170.22eCFR, DFARS 252.204-7021
What has changed on this page.
Changes
Corrections
None so far.
Found something wrong? [email protected]. We check it against the source, fix it, and record it here with the date.