The CMMC Phase 2 pause: what changed and what still applies

The short version of the pause

On July 13, 2026, the Department of Defense suspended plans to introduce Phase 2 of the Cybersecurity Maturity Model Certification program, along with all pending and future CMMC milestones, "until further notice." The third-party assessment that many owners had been budgeting for is off the calendar. The obligation to protect the information has not moved at all.

That gap between the two is where small contractors get hurt. A pause in one assessment type is easy to read as a pause in the whole program, and it is nothing of the kind. Phase 1 self-assessments remain in force. So do the contract clauses that have required NIST SP 800-171 for years, and the annual affirmation an officer of your company signs.

What the July 13 memo did

The memo, signed by DoD Chief Information Officer Kirsten Davies, did three things. It suspended Phase 2 and every later milestone. It launched a 60-day, "top-to-bottom" review by a CMMC Reform Task Force. And it told the buying side of the department how to behave during the suspension. The department is also styled the Department of War under Executive Order 14347, but the statute and the DFARS still say DoD, so this article does too.

The buying instructions are the part that changes your paperwork. Program managers and requiring activities "must only include the need for CMMC Level 1 (Self) or Level 2 (Self) assessments." Contracting officers were directed to amend active solicitations to remove third-party (C3PAO) and DIBCAC assessment requirements, and to modify existing contracts to remove them before the next option period or scheduled administrative modification. Program offices are barred from designating DIBCAC assessments during the review, and no waivers will be granted while that bar stands.

What Phase 2 would have done

The CMMC program rule at 32 CFR Part 170 took effect December 16, 2024. The DFARS rule that puts CMMC into contracts was published September 10, 2025, and Phase 1 began November 10, 2025. Under 32 CFR 170.3(e), Phase 2 begins one calendar year after Phase 1, which would have been November 10, 2026.

Phase 2 is where DoD intended to require a Level 2 (C3PAO) status as a condition of award on applicable contracts. That means an outside assessment organization examining your evidence and issuing the result. Phase 1 lets a company assess itself and report the result. The suspension keeps the program in that first state for now.

What still binds you today

Everything below applies with or without Phase 2. If a contract carries the clause, the duty runs for the life of that contract.

Requirement	Source	What it asks of you
Basic safeguarding of FCI	FAR 52.204-21	The 15 safeguarding requirements, which are also the CMMC Level 1 requirements
Adequate security for CUI	DFARS 252.204-7012	Implement NIST SP 800-171 on covered systems, and rapidly report cyber incidents, defined as within 72 hours of discovery
Current CMMC status	DFARS 252.204-7021	Have and maintain the status named in the contract for its duration, on every system that handles FCI or CUI
Annual affirmation	DFARS 252.204-7021, 32 CFR 170.22	An affirming official attests in SPRS to continuing compliance, at each assessment and annually
Flowdown	DFARS 252.204-7021, 32 CFR 170.23	Pass the correct level to lower tiers that will handle FCI or CUI

Level 2 remains tied to NIST SP 800-171 Revision 2: 32 CFR 170.14 says the Level 2 requirements are identical to that revision, all 110 of them. A company that handles CUI and has never scored itself against those 110 requirements was exposed before the pause and is exposed now.

The mechanics of Level 2 (Self) are also unchanged. A Conditional status requires a score of at least 80 percent, which is 88 of 110, with only limited requirements allowed on the plan of action and milestones. The open items must be closed and confirmed within 180 days, or the Conditional status expires. A Final status means every requirement is met, and it stays current for three years as long as the affirmation behind it is no older than one year.

Your SPRS score is still a statement to the government

The suspension does not soften what a self-assessment means. A Level 2 (Self) status rests on a score your company calculates and enters in the Supplier Performance Risk System, and an affirmation that a named senior official submits there. Those entries are representations the government relies on when it awards and pays.

The Justice Department has kept bringing cybersecurity cases under the False Claims Act. In September 2026, after the memo, Honeywell Aerospace agreed to pay $2,042,518 over alleged NIST SP 800-171 failures on one network. On November 3, 2026, ILC Dover and ILC Astrospace agreed to pay $13 million over alleged gaps that included missing current assessments. Both releases state that the claims are allegations only and that there has been no determination of liability. Neither date suggests enforcement is waiting on the task force.

A pause in one assessment type is easy to read as a pause in the whole program, and it is nothing of the kind.

Government-led assessments did not go away

DoD said that during the suspension it will continue using self-assessments and "select government-led assessments." Separately, 32 CFR 170.16 reserves the department's right to conduct a DCMA DIBCAC assessment of a company holding a Level 2 (Self) status, and says those results take precedence over the existing status if they show the requirements were not achieved or maintained. The memo bars program offices from designating DIBCAC assessments while the review runs. The rule's reservation of the right remains on the books.

The practical reading: a self-score may still be examined by someone who does not work for you. Build the file as if it will be, and keep it in final form. Under 32 CFR 170.24, working papers, drafts and unofficial or unapproved policies do not count as evidence.

When your contract still names a C3PAO

Some program offices had begun requiring third-party audits ahead of the November date, so some solicitations and contracts still carry that language. The memo says it should come out. Read each active solicitation and each contract with an upcoming option for it.

If you find a C3PAO requirement in a solicitation issued or still open after July 13, ask the contracting officer in writing whether it will be amended, and answer the solicitation as written until it is. If it is in an existing contract, note the next option date and raise it before then. Keep the exchange in your contract file. If a customer higher in the supply chain still demands a C3PAO certificate, that is a commercial term in your agreement with them, and you should read that agreement on its own.

Where the review stands

In October 2026, Federal News Network reported on the task force's summary of industry comments, which said that over a 90-day period DoD could restart Phase 2 with a narrower population while working longer-term recommendations through rulemaking. That is an option described in a summary. Nothing has been decided, and as of early November 2026, no restart date has been announced.

Two things follow from that. Do not plan around a date nobody has published. And do not assume a restart would spare you, because a defense supplier cannot know in advance whether it falls inside a narrower population.

Why stopping now costs more than continuing

A firm that halts its CMMC work today does not save the cost. It moves the cost to a later quarter and adds the price of restarting: the people who knew the configuration have moved on, the evidence has aged, and the plan no longer describes the network. Meanwhile the clauses in the table keep running and the annual affirmation keeps coming due.

The pause is useful for one thing. It takes the assessor's calendar off your neck and gives you time to do the work properly. The companies that use it to build an honest score and a file that holds up will be in the best position whatever the task force recommends.

What to do this quarter

• Pull every active DoD contract and solicitation and list which of 52.204-21, 252.204-7012 and 252.204-7021 each one carries, and at what level
• Check for leftover C3PAO or DIBCAC language and ask the contracting officer about it in writing
• Confirm your SPRS entries are current, including the score, the status date and the affirmation date
• Re-score against all 110 requirements using the assessment objectives in NIST SP 800-171A, and correct SPRS if the number has moved
• Calendar the next affirmation and name the person who will sign it
• Check your lower tiers: who receives FCI or CUI from you, and what status they have told you they hold

Three misreadings to avoid

• "CMMC is canceled." Phase 2 and later milestones are suspended. The rule at 32 CFR Part 170 and Phase 1 remain
• "We can stop paying for the security work." DFARS 252.204-7012 has required NIST SP 800-171 since well before CMMC existed
• "A self-assessment is informal." It is scored by a set method, entered in a government system and backed by a named official's affirmation

Frequently asked questions