CMMC Phase 2 Suspended: What Defense Contractors Need to Know in 2026

On July 13, 2026, the Department of War (DoW) suspended CMMC Phase 2. Third-party Level 2 certification, due to start on November 10, 2026, is on hold while a CMMC Reform Task Force reviews the program. The suspension doesn't switch CMMC off. Self-assessments, NIST SP 800-171 controls, and annual affirmations still apply. Here's what changed, what still applies, and how a penetration test can show whether your controls actually work.

What is CMMC Phase 2?

The second CMMC rollout stage, which would have required C3PAO Level 2 certification for applicable CUI contracts from November 2026.

Is CMMC Phase 2 suspended?

Yes. The DoW suspended it on July 13, 2026, and placed later CMMC milestones in abeyance until further notice.

Is CMMC still required?

Yes. Applicable Phase 1 self-assessments, SPRS submissions, annual affirmations, and DFARS 252.204-7012 obligations remain in force.

Who needs CMMC Level 2?

Contractors and subcontractors that process, store, or transmit CUI under a DoD contract with a Level 2 requirement.

Can you self-assess CMMC Level 2?

Yes, when the contract specifies Level 2 (Self). During the suspension, new solicitations should only require self-assessments.

Key Takeaways

• Phase 2 is suspended, not CMMC. Mandatory Level 2 C3PAO certification and planned Level 3 milestones are on hold. Phase 1 self-assessments and selected government-led assessments continue.
• DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 obligations remain in force where applicable.
• Contracts that already require a C3PAO assessment stay in force until the contracting officer modifies them.
• SPRS scores and affirmations are representations to the government. Allegedly inflated scores have led to False Claims Act settlements.
• Primes may still expect third-party assessments, so check with your customers, not just the rule.
• Contractors that keep improving their controls will be better placed if third-party assessments return in any form.

What Is CMMC Phase 2?

The Cybersecurity Maturity Model Certification (CMMC) program checks whether defense contractors protect the federal information they handle. Its program rule, 32 CFR Part 170, was published on October 15, 2024, and the DFARS rule that puts CMMC into contracts took effect on November 10, 2025. The rollout has four phases:

• Phase 1 (from November 10, 2025): Level 1 (Self) and Level 2 (Self) assessments as a condition of award.
• Phase 2 (planned for November 10, 2026): Level 2 certification assessments by a C3PAO for applicable CUI contracts.
• Phase 3 (planned for November 10, 2027): Level 3 certification assessments by DCMA's DIBCAC.
• Phase 4 (planned for November 10, 2028): full implementation across applicable contracts.

Phase 2 was the big shift. It moved many CUI contracts from "tell us you comply" to "prove it to an independent assessor," much like the difference between a vulnerability scan and a real penetration test.

Why CMMC Phase 2 Was Suspended

DoW Chief Information Officer Kirsten Davies set out the decision in a memo titled "Removing Barriers to Defense Industrial Base Expansion," and the DoW announced it in a public press release. The memo says CMMC imposes "significant and often prohibitive burdens" on contractors, especially small and non-traditional businesses. Three issues stood out:

• Cost. Small Business Administration cost estimates were cited as a reason small firms were leaving, or not entering, the defense market.
• Assessor capacity. There were few authorized C3PAOs compared with the number of companies expected to need certification.
• Acquisition priorities. The suspension was tied to the Department's Acquisition Transformation Strategy and its push for fewer regulations.

The announcement stresses that the suspension doesn't remove the duty to protect federal data. NIST SP 800-171 will be enforced through self-assessments and select government-led assessments.

CMMC Phase 2 Suspension: What Changed in 2026

Two memos dated July 13, 2026, set out the changes. On September 3, 2026, DFARS Class Deviation 2026-O0025, Revision 3, reaffirmed instructions for contracting officers to remove or revise suspended CMMC requirements in new and existing solicitations and contracts. In practice:

• Phase 2 is suspended. Mandatory Level 2 C3PAO assessments won't start on November 10, 2026.
• Later milestones are on hold. Pending and future milestones, including Level 3, are "in abeyance until further notice."
• New solicitations change. Program offices should only require Level 1 (Self) or Level 2 (Self). Active solicitations calling for Level 2 (C3PAO) or Level 3 are to be amended.
• Existing contracts change later. They're modified before the next option period or at the next scheduled administrative modification. Until then, the terms still apply.
• A Reform Task Force is reviewing the program. It ran a 60-day review and gathered industry input through a public request for information.

CMMC Level 1 vs Level 2 Requirements

Level 3 applies to a small set of contracts, so the choice is usually between Level 1 and Level 2. It depends on the type of information you handle.

What CMMC Requirements Still Apply in 2026?

The DoW says "all Phase I self-assessment requirements remain firmly in place." That covers:

• Phase 1 self-assessments. Solicitations can require Level 1 (Self) or Level 2 (Self). Contractors must submit the required results and affirmations in SPRS before award. Level 1 records a compliance result; Level 2 uses a numerical assessment score.
• Annual affirmations. A senior official affirms continuing compliance each year. It's a statement to the government, so it has to match reality.
• DFARS 252.204-7012. You still need "adequate security," NIST SP 800-171 Rev. 2, incident reporting within 72 hours, preserved images of affected systems, and flow-down to subcontractors.
• FAR 52.204-21. The 15 basic safeguarding requirements still apply to systems that handle FCI.
• Contracts already signed. A contract that requires Level 2 C3PAO certification stays in effect until it's formally modified. Confirm the timing with your contracting officer.
• Government-led assessments. The DoW will keep verifying NIST SP 800-171 through select government-led assessments, such as DIBCAC reviews.

Also Read: Penetration Testing vs Vulnerability Assessment

What the Suspension Means for Defense Contractors

If you are already certified

Your certificate still shows an independent assessor checked your controls. Some primes ask for that evidence even when the contract doesn't.

If you were preparing for a C3PAO assessment

You have more time, not a reason to stop. The controls are the ones DFARS 252.204-7012 already requires. Talk to your primes before you cancel anything.

If you have not started

The suspension doesn't remove existing safeguarding obligations. If DFARS 252.204-7012 applies to your contract, you must implement NIST SP 800-171 Rev. 2, and submit SPRS assessments and CMMC affirmations where your contract requires them.

Legal exposure is unchanged

The Department of Justice still pursues contractors that misrepresent their cybersecurity under the False Claims Act. In March 2025, MORSECORP agreed to pay $4.6 million to resolve allegations that included reporting an SPRS score of 104 when a third-party consultant later put it at -142.

How Defense Contractors Should Prepare for CMMC Compliance

These steps hold up whether Phase 2 returns as written, in a lighter form, or as something new.

1. Review Current CMMC Contract Requirements

Check the CMMC and DFARS clauses in each contract and open bid: the level, self or C3PAO, and upcoming options or modifications. Ask primes what their flow-downs require.

2. Identify FCI and CUI

Work out which data you receive or create under each contract. Check markings and the DoD CUI Registry, and get written answers where marking is unclear.

3. Determine the Applicable CMMC Level

FCI only usually means Level 1, and CUI usually means Level 2. Then define the systems, people, and facilities in scope. A smaller, well-segmented CUI enclave cuts cost and limits how far an attacker can move after initial access.

4. Assess Security Controls Against NIST SP 800-171

For Level 2, assess all 110 NIST SP 800-171 Rev. 2 requirements using the applicable methodology, and verify that the controls actually work. In an Active Directory takeover we documented, laptops that didn't strictly validate the Wi-Fi authentication certificate plus an AD CS certificate template misconfiguration led straight to Domain Admin. No alerts fired. A document review alone would not have caught it.

5. Identify and Remediate Security Gaps

Rank gaps by risk and point value. Under 32 CFR 170.21, requirements worth more than 1 point, such as multifactor authentication, can't go on a POA&M, with a narrow exception for CUI encryption.

Related: Vulnerability Prioritization: Beat Patching Paralysis

6. Complete Required Self-Assessments and Documentation

For Level 2, maintain an SSP, document permitted POA&M items with owners and deadlines, and submit your numerical assessment score in SPRS. For Level 1, submit the required compliance result and affirmation. Retain supporting evidence and any relevant test report.

7. Monitor CMMC Policy Changes

Watch for the Task Force report, new DoW memos, FAQ updates, and rulemaking. DoD has signaled a future move to NIST SP 800-171 Rev. 3, but CMMC references Rev. 2 until a new rule is published.

CMMC Compliance Checklist

• CMMC and DFARS clauses reviewed in every contract and open bid.
• Primes asked in writing what they expect from suppliers.
• FCI and CUI identified for each contract.
• Assessment scope defined: systems, people, and facilities.
• Network diagram and asset inventory up to date.
• Cloud services handling CUI are FedRAMP Moderate authorized or meet equivalent requirements per DoD policy.
• System Security Plan written and current.
• For Level 2, all 110 NIST SP 800-171 Rev. 2 requirements assessed, with supporting evidence.
• MFA enforced for remote, privileged, and network access.
• FIPS-validated cryptography used where encryption protects CUI confidentiality.
• Logs collected, kept, and reviewed.
• Incident response plan tested, including 72-hour DoD reporting.
• POA&M items limited to allowed requirements, with owners and dates.
• Required assessment result submitted in SPRS (Level 1 compliance result or Level 2 numerical score).
• Annual affirmation scheduled with the affirming official.
• Flow-down requirements sent to subcontractors.
• Someone assigned to track CMMC policy changes.

Common CMMC Compliance Mistakes

• Treating the suspension as a pause on security. DFARS 252.204-7012 has required NIST SP 800-171 since the end of 2017. The suspension changes how compliance is verified, not the requirement.
• Posting an optimistic SPRS score. A score that doesn't match your environment is a liability. Score each requirement honestly and keep the evidence.
• Scoping too broadly or too narrowly. Letting CUI spread puts every system in scope. Drawing the boundary too tight leaves out systems that touch CUI, which an assessment can surface.
• Using non-compliant cloud services. Email, file sharing, and backup services that handle CUI need FedRAMP Moderate authorization or DoD-recognized equivalency. This was one of the issues in the MORSECORP case.
• Relying on paper controls. Policies nobody follows, and tools that aren't configured, fail when tested. A policy requiring MFA doesn't help if a legacy VPN skips it, and MFA alone doesn't stop every account takeover.
• Ignoring subcontractors. If you share CUI with a supplier, they need to protect it too. Flow-down is part of your obligation.

Must Read: Firebase Security Mistakes That Leak User Data

CMMC Compliance Best Practices During the Suspension

• Keep the program funded. Use the time to close gaps properly instead of cutting budget and restarting later.
• Shrink your CUI footprint. Fewer systems handling CUI means fewer controls to implement and assess.
• Test your controls. Levels 1 and 2 don't explicitly require penetration testing, but a test shows whether access control and logging hold up. Level 3 requirement CA.L3-3.12.1e requires one at least annually or after significant changes.
• Keep SPRS submissions accurate. Review Level 1 compliance results or Level 2 scores when your controls or scope change.
• Consider a voluntary C3PAO assessment. Certification is still available and may help with primes and CUI bids.
• Brief leadership regularly. The affirming official carries real responsibility and should know where the program stands.

Helpful for you: How Often Should You Do a Pentest?

How OraSec Can Help

OraSec is not a C3PAO and doesn't issue CMMC certificates. What our internal penetration testing shows is whether your NIST SP 800-171 controls hold up when someone actually tries to break them.

• Internal and Active Directory testing of access control, authentication, and segmentation around CUI.
• External and cloud testing for exposed services, weak remote access, and misconfigured storage.
• Clear reporting that maps findings to the relevant NIST SP 800-171 requirements, so your team can prioritize remediation and spot controls that may need reassessment.
• Retesting to confirm fixes before you update your SSP, POA&M, or SPRS score.

Conclusion

The suspension removes the November 2026 deadline for third-party Level 2 assessments, but the core obligations stay. If your contract covers CUI, keep meeting its NIST SP 800-171 requirements, and submit accurate SPRS results and annual CMMC affirmations wherever your contract requires them. The Reform Task Force may change how compliance is verified, but until any changes are formally adopted, existing cybersecurity and contractual obligations remain in place. To see how your CUI environment holds up against a real attacker, talk to our team.

Frequently Asked Questions

Does the suspension change DFARS 252.204-7012?

No. It still requires adequate security for covered defense information, which generally means NIST SP 800-171 Rev. 2, plus 72-hour incident reporting.

What happens to contracts that already require a C3PAO assessment?

They're modified at the next option period or scheduled administrative modification. Until then, the requirement stands, so confirm timing with your contracting officer.

Should we cancel a scheduled C3PAO assessment?

Not automatically. Assessments are still available and some primes still expect them. Check your contract terms and customer expectations first.

Can a POA&M be used for CMMC Level 2?

Yes, with limits under 32 CFR 170.21: a score of at least 88 of 110, mostly 1-point requirements, and closeout within 180 days.

Will NIST SP 800-171 Rev. 3 replace Rev. 2 for CMMC?

DoD has signaled a move to Rev. 3 through future rulemaking. Until a rule is published, CMMC and DFARS 252.204-7012 use Rev. 2.

Is CMMC Phase 2 cancelled?

Not formally. It's suspended pending the Task Force review, and 32 CFR Part 170 remains in place. Watch official DoW announcements.