CMMC Phase II Is Suspended. Your Phase I Obligations Are Not.

On 13 July 2026 the Department of War announced an immediate suspension of Phase II of the Cybersecurity Maturity Model Certification program, which had been scheduled to take effect 10 November 2026. The suspension also halts the pending Phase III and Phase IV milestones and directs a 60-day review of the program. A newly established CMMC Reform Task Force is to recommend changes at the end of that review.

What is suspended, and what is not

The suspension applies to the introduction of third-party assessment as a prerequisite for award. It does not touch the underlying cybersecurity obligations. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, remains in force. So do the Phase I requirements that took effect 10 November 2025, under which applicable solicitations carry a CMMC Level 1 or Level 2 self-assessment requirement. The Department also retains discretion to include a Level 2 third-party assessment requirement in applicable solicitations.

The distinction is worth stating plainly because it is being widely misread. This is a pause in assessment, not a pause in compliance. A self-assessment submitted to SPRS is still a representation, and the enforcement exposure that attaches to an inaccurate one is unchanged.

There is a live deadline

The Department has invited Defense Industrial Base stakeholders to submit feedback to the task force through a request for information, with responses due 14 August 2026. For small and mid-size contractors, this is a narrow and genuine opportunity to put assessment cost, C3PAO capacity, and flow-down burden in front of the people writing the recommendation. That window is short.

What it means for planning

For anyone budgeting compliance, the suspension defers an assessment cost. It does not defer the control implementation cost that sits underneath it. Organizations that had sequenced NIST SP 800-171 remediation against a November assessment date now have schedule relief, but the work itself still has to happen, and doing it under time pressure later is more expensive than doing it deliberately now. Treating the suspension as a reason to stop is the expensive reading.

The other planning question is what the task force actually recommends. A 60-day review that touches phase timing, assessment tiers, and flow-down could change the shape of the requirement rather than just its date. Until those recommendations are public, the prudent assumption is that the substantive controls survive in some form.

Primary sources

DFARS 252.204-7012, 252.204-7021, and 252.204-7025, acquisition.gov. Department of War announcement of CMMC Phase II suspension, 13 July 2026. CMMC Reform Task Force request for information, responses due 14 August 2026. Confirm the RFI submission mechanism and any extension against the notice itself before relying on the date.