CMMC Phase 2 suspended: what defense contractors still owe in 2026

Yes, CMMC Phase 2 is suspended. On July 13, 2026, the Department of War paused the November 10, 2026 start of Phase 2, which would have made third-party (C3PAO) Level 2 assessments a standard condition of award. But CMMC itself is not gone. Phase 1 is still in force: self-assessments, SPRS scores, annual affirmations, and the NIST SP 800-171 controls behind them still decide whether you can win and keep defense work.

Status as of October 18, 2026: the CMMC Reform Task Force delivered its review to the Department's CIO around September 11, 2026, and its recommendations have not been made public. We will update this guide when they are.

What changed on July 13, 2026

Two memoranda issued on July 13 put every pending CMMC milestone "in abeyance until further notice." In practical terms:

Two details are easy to miss. First, no CMMC waivers are being granted during the review. Second, existing contracts that already carry Level 2 (C3PAO) or Level 3 requirements are not changed automatically. Contracting officers are to remove those requirements by modification before the next option period. Until that modification arrives, the contract terms you signed still apply.

What still applies right now

The suspension removed a verification step. It did not remove the security obligations underneath it. If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), all of this remains in force:

Why "paused" does not mean "optional"

The most expensive misreading of the suspension is that compliance work can stop. Four realities say otherwise.

• Your SPRS score is a legal statement. A self-assessment score and an annual affirmation are representations to the government. The Department of Justice's Civil Cyber-Fraud Initiative has used the False Claims Act against contractors whose cybersecurity claims did not match reality, including settlements with Aerojet Rocketdyne and MORSECORP. Less outside verification makes an accurate self-assessment more important, not less.
• DFARS 7012 never paused. The NIST SP 800-171 obligation and the 72-hour incident reporting rule have applied to CUI contracts for years. CMMC was the verification layer on top of them.
• Primes still flow requirements down. Prime contractors carry their own risk and are still asking suppliers for SSPs, SPRS scores, and evidence. Being ready is a sales advantage when a prime is picking subcontractors.
• The pause has an end. The Task Force was asked to look at alternatives to third-party certification, but some form of verification is very likely to return. Teams that stop now will be rebuilding from a cold start when it does.

What the Task Force could change

Nobody outside the Department knows what the report recommends. Its stated goals give useful bounds: move faster, lower barriers for small and non-traditional businesses, evaluate alternatives to third-party compliance, and keep cybersecurity measures scalable and realistic. Press reports of a September 9 talk by the Department's CIO said more than half of the RFI comments supported the suspension. Plausible outcomes include:

• A delayed Phase 2 with the same structure. Third-party certification returns on a new date, possibly with more C3PAO capacity in place.
• A narrower Phase 2. Third-party assessment kept only for higher-risk programs, with self-assessment plus spot checks for everyone else.
• A different verification model. More government-led assessments, continuous monitoring, or reliance on commercial certifications.
• Changes to scope. Covington reports that rollbacks and expansions are both on the table, including security for operational technology.

Every one of these outcomes still assumes NIST SP 800-171 is implemented. That is why the safest plan does not depend on guessing the answer.

A 90-day plan for the pause

Use the pause to turn compliance into something you can defend under any of those outcomes. For most small and mid-sized contractors, the work looks like this:

1. Confirm your scope (weeks 1 to 2). Map where CUI and FCI actually live: systems, people, cloud services, and vendors. Shrinking scope is the cheapest control you will ever implement.
2. Re-score honestly (weeks 2 to 4). Rebuild your SPRS score from evidence, not memory, using the DoD assessment methodology (scores run from -203 to 110). If the honest number is lower than the posted one, update it. That is a much better conversation than the alternative.
3. Close the heavy POA&M items (weeks 4 to 10). Prioritize the high-weight controls first: multi-factor authentication, FIPS-validated encryption for CUI, audit logging, and incident response. Under the CMMC rule, POA&M items have a 180-day closeout window, so plan as if the clock will matter again.
4. Make incident reporting real (weeks 6 to 8). Confirm who files a DFARS 7012 report within 72 hours, and that you hold the required DoD-approved medium assurance certificate. Our incident response plan template is a fast starting point.
5. Fix vendor and cloud gaps (weeks 8 to 12). Confirm that cloud services storing CUI meet FedRAMP Moderate or equivalent, and that your MSP's responsibilities are written down. See our guide to third-party risk management.
6. Brief leadership and reaffirm (week 12). The senior official who signs the affirmation should understand what they are signing, what is still open, and when it closes.

Should you still get a C3PAO assessment?

It depends on your customers more than on the rule. A voluntary third-party assessment can make sense if a prime is asking for it, if you are competing for work where verified maturity is a differentiator, or if you were already scheduled and close to ready. It makes less sense if your SSP and POA&M are still immature. In that case, the money is better spent on closing gaps, because an assessment mostly confirms what an honest self-assessment would have shown. If you have an assessment booked, talk to your C3PAO before canceling. Capacity was the bottleneck before the pause and may be again when verification returns.

Who should own CMMC during the pause

CMMC fails the same way most compliance programs fail: it becomes a side task for an IT manager or an MSP with no authority over scope, budget, or vendors. The work needs an owner who can make risk decisions, brief the official who signs the affirmation, and hold providers to evidence. For many contractors, that is a fractional CISO who owns the program through the uncertainty and is ready when the rules settle. If you are weighing that model, our guide to what a vCISO does covers the cost and what to expect.