Last reviewed October 13, 2026. DoD’s review of the program is ongoing, and we update this page as official guidance changes.
On July 13, 2026, the Department of Defense suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. Phase 2 was scheduled to start on November 10, 2026, and would have made a third-party Level 2 certification a condition of award on contracts involving Controlled Unclassified Information (CUI). If you handle CUI for DoD, the suspension changes your timeline. It does not change your obligations.
What DoD suspended
- Phase 2. The requirement for a Certified Third-Party Assessor Organization (C3PAO) to assess Level 2 as a condition of award, which was due to begin on November 10, 2026.
- Pending CMMC milestones. The memo pauses the program’s remaining milestones until further notice, including the later phases the rule had scheduled for November 2027 and November 2028.
- Third-party designations in solicitations. While the suspension is in effect, program offices are directed to include only Level 1 (Self) or Level 2 (Self) requirements, not C3PAO or government-led assessment designations.
DoD also launched a 60-day review of the program through a CMMC Reform Task Force. Its stated aims include lowering barriers for small and nontraditional businesses. The review period closed in mid-September 2026. As of this writing, no public report or restart date has been announced.
What did not change
- DFARS 252.204-7012. If your contract includes this clause, you must implement the 110 security requirements of NIST SP 800-171 Rev. 2 on systems that handle CUI, and report cyber incidents. The suspension did not waive or reduce it.
- FAR 52.204-21. The basic safeguarding requirements for Federal Contract Information still apply.
- Phase 1 self-assessments. Level 1 and Level 2 self-assessments, with scores posted to the Supplier Performance Risk System (SPRS) and annual affirmations where required, remain in force.
- Government audits. DoD can still verify your NIST SP 800-171 implementation directly.
- Flow-down. Prime contractors must still pass these requirements to subcontractors that handle CUI.
- False Claims Act exposure. The Department of Justice’s Civil Cyber-Fraud Initiative has pursued contractors that knowingly misrepresented their cybersecurity compliance. An inflated SPRS score is a risk whatever happens to CMMC.
What this means for your planning
Keep implementing the controls. The deadline moved. The requirements did not. Contractors that stop now will face the same work later, on a shorter clock.
Check that your SPRS score is true. Score each of the 110 requirements on what is implemented today, not on what your policies say. Our guide to calculating your SPRS score walks through the method.
Define and shrink your CUI boundary. The fewer systems that touch CUI, the less there is to secure, document and assess.
Read your contracts and solicitations. Look for DFARS 252.204-7012 and the CMMC clauses. If you are unsure whether a requirement was removed, ask your contracting officer.
Plan for change in either direction. The review could soften the program or restructure it. Nothing announced so far changes the 110 requirements in NIST SP 800-171 Rev. 2, which is the baseline most contractors are already measured against.
How Cyberix helps
Cyberix is headquartered in Aurora, CO, with an office in Washington, D.C., has implemented the CMMC Level 2 requirements itself, and holds ISO/IEC 27001 and SOC 2 Type II certifications. For defense contractors, we start with a gap assessment against NIST SP 800-171, then build the system security plan, the plan of action and milestones, and the monitoring that keeps the controls working. See our CMMC and NIST SP 800-171 compliance services or our broader governance, risk and compliance work.
The CMMC timeline at a glance
- December 16, 2024. The CMMC program rule (32 CFR Part 170) took effect.
- November 10, 2025. The DFARS rule took effect and Phase 1 began, with Level 1 and Level 2 self-assessments eligible as conditions of award.
- November 10, 2026. Phase 2 was scheduled to begin, adding third-party Level 2 certification as a condition of award. Suspended on July 13, 2026.
- November 10, 2027 and November 10, 2028. Phases 3 and 4 were scheduled to add Level 3 and full implementation. On hold under the same memo.
Questions to ask your contracting officer or prime
- Does this solicitation or contract include DFARS 252.204-7021 or 252.204-7025, and which CMMC level and assessment type does it call for?
- Has a third-party assessment requirement been removed or amended because of the suspension?
- Which categories of CUI will we handle, and which systems are expected to be in scope?
- What do you require from our subcontractors, and by when?
How the review could play out
DoD has not said how the review will end. The program could resume on a revised schedule, be restructured around a lighter assessment model, or stay paused for longer. In each case, the DFARS 252.204-7012 obligation to implement NIST SP 800-171 continues unless DoD changes the clause, and DoD has announced no such change. Contractors that keep their controls current lose nothing under any of these outcomes.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
Has CMMC been cancelled?
No. Phase 1 self-assessment requirements continue. DoD suspended Phase 2 and the program’s later milestones, and a review is under way. No outcome has been announced.
Do I still need to meet NIST SP 800-171?
Yes, if your contract includes DFARS 252.204-7012. That clause requires the 110 security requirements of NIST SP 800-171 on systems that handle CUI, independent of CMMC.
Do I still need an SPRS score?
If your contract includes the DFARS assessment requirements, yes. The suspension did not remove self-assessment scoring. Make sure the score reflects your actual implementation.
Should I still pursue a third-party certification?
There is no current mandate for one. Whether to pursue it voluntarily depends on your contract pipeline and what your prime contractors and customers expect. Many contractors are using this period to finish remediation so they can move quickly if requirements return.
Where can I find official updates?
Check the DoD CIO’s CMMC program website and the Federal Register. Treat third-party summaries, including this one, as a starting point and confirm against the official source.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.
To see where you stand today, try the free SPRS score calculator.