CMMC Phase II is suspended. Here is what still applies.

What happened

On July 13, 2026, the Department of War, as the Department of Defense now refers to itself, announced the immediate suspension of CMMC Phase II requirements. Phase II was scheduled to take effect on November 10, 2026, and would have begun requiring third-party certification assessments for many contracts that involve Controlled Unclassified Information.

The announcement also launched a comprehensive review of the CMMC program. The Under Secretary for Acquisition and Sustainment issued an implementing memorandum the same day, and further guidance is expected at the end of the Chief Information Officer's 60-day review.

What the suspension changes

• Only self-assessments in new requirements. Program managers and requiring activities may include only CMMC Level 1 (Self) or CMMC Level 2 (Self) in procurement requests and requirement documents. They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during the suspension.
• Active solicitations will be amended. If a solicitation included a Level 2 (C3PAO) or Level 3 (DIBCAC) requirement, the requiring activity must initiate an amendment removing it.
• Existing contracts will be modified. Contracting officers are directed to remove those requirements before the next option is exercised or during the next scheduled administrative modification.
• No waivers during the review. Because certification requirements cannot be designated, waiver procedures are suspended.

What still applies

The suspension pauses the move to certification. It does not remove the security requirements that already sit in defense contracts.

• Phase I self-assessments. All Phase I requirements remain in place, including Level 1 self-assessments against FAR 52.204-21 and Level 2 self-assessments against NIST SP 800-171 Rev 2.
• NIST SP 800-171 Rev 2. The implementing memo states that the Department will enforce baseline compliance through CMMC self-assessments and select government-led assessments.
• DFARS 252.204-7012. Safeguarding covered defense information and reporting cyber incidents within 72 hours remain contract requirements.
• SPRS scores. DFARS 252.204-7019 still requires a current NIST SP 800-171 DoD Assessment score in SPRS, no more than three years old, to be considered for award.

What to do now

• Keep implementing NIST SP 800-171. The requirements have not changed, and the government can still assess them.
• Confirm that your SPRS score is current and that you can support it with a system security plan and plans of action.
• Watch for amendments to active solicitations and modifications to existing contracts that remove certification requirements.
• Plan for what follows the review. The Department has not said what the review will conclude, so organizations that keep their programs current will be ready either way.

HARDAC helps contractors maintain their NIST SP 800-171 programs and prepare self-assessments they can stand behind. Learn about our CMMC readiness services.