CMMC Phase 2 Suspended: What Still Applies
Phase 2 paused the C3PAO certification requirement, not CMMC. What's still required (NIST SP 800-171, SPRS, self-assessments, affirmations), what's on hold, and what to do now.
The CMMC Phase 2 suspension paused one thing: the requirement that contractors handling CUI earn a third-party (C3PAO) certification before they can win a contract. Almost everything else still applies. DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 Rev 2 are still in your contracts. Level 1 and Level 2 self-assessments and annual affirmations are still required, and so is a current SPRS score wherever your contract still carries DFARS 252.204-7019 or 7020. And the score you post and the affirmation your senior official signs are still statements to the government that have to be true.
- Paused: C3PAO certification as a condition of contract award, including the November 10, 2026 Phase 2 start.
- Still required: NIST SP 800-171 Rev 2 under DFARS 252.204-7012, 72-hour incident reporting, a current SPRS score where your contract still carries DFARS 252.204-7019 or 7020, Level 1 or Level 2 self-assessments, and annual affirmations.
- Not paused: enforcement. Inaccurate scores and affirmations are False Claims Act risk, breach or no breach.
- C3PAOs are still certifying, and existing certificates are still valid.
Phase 2 is suspended. The CMMC Reform Task Force was due to report to the Department of War CIO in September, and no recommendations have been published. We'll update this post when they are, or when the suspension changes.
What exactly was suspended?
On July 13, 2026, the Department of War suspended Phase 2 of CMMC. Phase 2 was the stage where most contracts involving CUI would require a Level 2 certification from a C3PAO before award, starting November 10, 2026. The same announcement stood up a Reform Task Force to review the program over 60 days.
The change has since been written into procurement rules. A DFARS class deviation, 2026-O0025, wrote it in with its second revision on July 16, 2026: contracting officers can require only Level 1 and Level 2 self-assessments, in new solicitations and, by modification before the next option period, in existing contracts. The third revision (September 3, 2026) carries that forward. The CMMC program rule itself (32 CFR part 170) didn't change.
That's the whole suspension. It removed a certification gate. It didn't remove the security requirements behind it.
- Nov 10, 2025Phase 1 begins. New DoD contracts can start requiring CMMC Level 1 or Level 2 self-assessments and affirmations.
- Jul 13, 2026Phase 2 suspended. The planned C3PAO certification requirement is paused, and a 60-day Reform Task Force review begins.
- Jul 16, 2026Deviation, revision 2. Contracts can require only Level 1 or Level 2 self-assessments, new and existing.
- Sep 3, 2026Deviation, revision 3. Carries the limit forward.
- Sep 2026Task force report due. It was due to the DoW CIO within 60 days; nothing has been published.
- NextTo be announced. No reinstatement date or replacement has been set.
What still applies?
IN FORCE TODAY
What you still owe
- DFARS 252.204-7012Implement NIST SP 800-171 Rev 2 wherever you handle CUI
- Incident reportingReport cyber incidents to DoD within 72 hours
- SPRS scoreA current, accurate self-assessment score in SPRS, where your contract still carries DFARS 252.204-7019 or 7020
- CMMC self-assessmentsLevel 1 every year; Level 2 every three years, when your contract calls for it
- Annual affirmationsA senior official affirms compliance every year
SUSPENDED
What’s on hold
- C3PAO certificationNo longer a condition of award in new solicitations
- Phase 2 start dateNovember 10, 2026 no longer applies
- Replacement timelineNone announced yet
- C3PAO assessmentsStill available; certificates still issue and stay valid
- Government assessmentsDoD can still assess your NIST SP 800-171 implementation
The Cyber AB said it plainly at its September 2026 Town Hall: the CMMC program itself is not paused. C3PAOs are still conducting Level 2 assessments, SPRS is still processing certifications, and DFARS 7012 remains in force. The certificate count kept climbing, too, to 2,362 final Level 2 certificates by September.
Why "paused" doesn't mean "relaxed"
The part of CMMC that carries legal weight was never the certificate. It's what you tell the government.
When you post a score in SPRS or your Affirming Official signs an annual affirmation, you're making a representation that your security matches the requirements in your contract. If it doesn't, that's exposure under the False Claims Act. On September 1, 2026, Honeywell Aerospace agreed to pay more than $2 million to resolve allegations that a business unit didn't meet NIST SP 800-171 on one network covered by a DoD contract. No breach was alleged. The case started with a whistleblower.
The certification gate is paused. The obligation to tell the truth about your security never was.
A C3PAO assessment would have checked your implementation before award. With that check paused, your own self-assessment is the main thing standing between your score and reality. That makes an accurate self-assessment more important, not less.
What should you do now?
- Confirm your level. Level 1 if you handle only Federal Contract Information; Level 2 if you handle CUI. Not sure? Take our three-question CMMC level check.
- Re-check your SPRS score. Make sure it reflects how your environment works today, not how it worked when you first scored it.
- Affirm only what's true. Your Affirming Official should know what they're signing and have evidence behind it.
- Keep evidence current. Policies, your system security plan, and proof of controls drift as people and systems change.
- Decide on certification on your own terms. C3PAOs are still assessing, and primes may still ask. A Level 2 certificate earned now stays valid and satisfies any lesser requirement.
THE PHASE 2 PAUSE · YOUR 5-STEP CHECKLIST- 01Confirm your levelLevel 1 for FCI, Level 2 for CUI
- 02Re-check your scoreSPRS should match today’s environment
- 03Affirm what’s trueEvidence behind every signature
- 04Keep evidence currentPolicies, SSP, and proof of controls
- 05Time certificationC3PAOs are still assessing
If certification is still your goal, the pause can work in your favor. Assessments in progress dipped in September, so getting on a C3PAO's calendar may be easier than it was heading toward November.
What happens next?
Nobody outside the Department knows yet. The task force's recommendations haven't been released, and no replacement timeline has been set. At the September Town Hall, Cyber AB leadership offered what they labeled pure speculation: more emphasis on continuous validation over point-in-time assessments, operational technology, NIST CSF 2.0, and reciprocity with other frameworks.
What's unlikely to change is the foundation. Whatever replaces Phase 2 will still start from protecting the information you handle, and from an honest account of how well you do it. The work you do now on NIST SP 800-171 and your self-assessment carries forward.
Where an assessor can help
Our CMMC Certified Assessors review self-assessments the way an assessor would, so your score and your affirmation hold up if anyone checks. See how readiness and Level 1 and Level 2 self-assessment support works, or how continuous compliance keeps your affirmations accurate year to year.