CMMC Phase II Is Suspended. Your Phase I Obligations Are Not.

On 13 July 2026 the Department of War announced an immediate suspension of Phase II of the Cybersecurity Maturity Model Certification program, which had been scheduled to take effect 10 November 2026. The suspension also halts the pending Phase III and Phase IV milestones and directs a 60-day review of the program. A newly established CMMC Reform Task Force is to recommend changes at the end of that review.

What is suspended, and what is not

The suspension applies to the introduction of third-party assessment as a prerequisite for award. It does not touch the underlying cybersecurity obligations. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, remains in force. So do the Phase I requirements that took effect 10 November 2025, under which applicable solicitations carry a CMMC Level 1 or Level 2 self-assessment requirement. The Department also retains discretion to include a Level 2 third-party assessment requirement in applicable solicitations.

The distinction is worth stating plainly because it is being widely misread. This is a pause in assessment, not a pause in compliance. A self-assessment submitted to SPRS is still a representation, and the enforcement exposure that attaches to an inaccurate one is unchanged.

There was a live deadline

The Department invited Defense Industrial Base stakeholders to submit feedback to the task force through a request for information, with responses due 14 August 2026. That window has now closed. For small and mid-size contractors it was a narrow and genuine opportunity to put assessment cost, C3PAO capacity, and flow-down burden in front of the people writing the recommendation.

What it means for planning

For anyone budgeting compliance, the suspension defers an assessment cost. It does not defer the control implementation cost that sits underneath it. Organizations that had sequenced NIST SP 800-171 remediation against a November assessment date now have schedule relief, but the work itself still has to happen, and doing it under time pressure later is more expensive than doing it deliberately now. Treating the suspension as a reason to stop is the expensive reading.

The other planning question is what the task force actually recommends. A 60-day review that touches phase timing, assessment tiers, and flow-down could change the shape of the requirement rather than just its date. Until those recommendations are public, the prudent assumption is that the substantive controls survive in some form.

Update, 14 September 2026

The 60-day review milestone fell on or about 13 September 2026. As of today no task force report or recommendation has been published by the Department of War Chief Information Officer, no amendment to 32 CFR part 170 has issued, and no new class deviation has changed the CMMC clauses. A good deal of commentary is circulating about what the report will say. None of it is a document, and none of it changes a contract term.

The operative acquisition instruction is now Class Deviation 2026-O0025, Revision 3, Revolutionary FAR Overhaul Part 40, DFARS Part 240, posted 3 September 2026, which revises and supersedes Revision 2 of 16 July 2026. It carries forward the Revision 2 direction that contracting officers collaborate with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts in line with the 13 July 2026 Chief Information Officer memorandum. In practice that means solicitation amendments as soon as practicable, and removal from existing contracts by modification before the next option exercise or at the next scheduled administrative modification. It also restates that baseline compliance with NIST SP 800-171 Rev 2 under DFARS 252.204-7012 is required, and that requiring activities may still include Level 1 or Level 2 self-assessments.

The deviation's DFARS text is worth reading directly on one point. DFARS 240.371-5(a) prescribes the clause at 252.204-7021 on two different bases, split at a date. Until 9 November 2028, it goes in where the program office or requiring activity determines the contractor is required to have a specific CMMC level. On or after 10 November 2028, it goes in where the requiring activity determines that contractor information systems will be used in performance to process, store or transmit federal contract information or controlled unclassified information. The provision at 252.204-7025 goes in any solicitation containing 252.204-7021. Both prescriptions are subject to 32 CFR 170.5(d).

One caveat on that date, because it is being reported loosely. The November 2028 split is quoted here from the currently posted Revision 3 text. Whether Revision 3 introduced it or carried it forward from an earlier revision cannot be checked, because the superseded revisions are no longer posted on the DPCAP class deviation page. Treat 10 November 2028 as what the current deviation says, not as a newly announced extension.

Primary sources

DFARS 252.204-7012, 252.204-7021 and 252.204-7025, acquisition.gov. Department of War Chief Information Officer memorandum, Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, 13 July 2026. Class Deviation 2026-O0025, Revision 3, and its DFARS Part 240 attachment, posted at acq.osd.mil/dpap/dars/dfars_far_overhaul_class_deviations.html. CMMC Reform Task Force request for information, responses due 14 August 2026.