CMMC Phase 2 is suspended. The Department of War (DoW, also DoD) is removing or revising CMMC requirements in its contracts under Class Deviation 2026-O0025 Rev 3, signed September 3, 2026. NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline, CMMC Level 2 (Self) can still be required, and DCMA assessments continue.
Is CMMC suspended?
Partly. What is suspended is Phase 2, the planned November 10, 2026 step that would have made CMMC Level 2 (C3PAO) assessments a condition of award. DoW (DoD) is removing or revising CMMC requirements in its contracts; NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline. DoW has not repealed the CMMC rule, and CMMC Level 1 (Self) and Level 2 (Self) can still appear in contracts while it reviews the program.
What changed, and when?
| Date | Event | Effect |
|---|---|---|
| Nov 10, 2025 | CMMC Phase 1 takes effect | Solicitations can require Level 1 (Self) or Level 2 (Self) |
| Jun 23, 2026 | FAR CUI rule re-proposed | Would move federal contracts toward NIST SP 800-171 Rev 3; not final |
| Jul 13, 2026 | DoW CIO suspends the November 2026 Phase 2 transition | No Level 2 (C3PAO) or Level 3 designations during the review; no waivers |
| Jul 16, 2026 | Class Deviation 2026-O0025 Rev 2 | Writes the pause into contract text |
| Sep 3, 2026 | Class Deviation 2026-O0025 Rev 3 supersedes Rev 2 | Contracting officers remove or revise CMMC requirements in new and existing contracts |
| Sep 11, 2026 | The CIO’s 60-day review period ends | Report not published as of the last review of this guide |
| Next | Further CIO guidance after the review | No date published |
What is still required?
- NIST SP 800-171 Rev 2 under DFARS 252.204-7012 wherever you handle covered defense information.
- The DFARS 252.204-7008 representation: every offer represents that you implement NIST SP 800-171.
- Cyber incident reporting to DoW within 72 hours.
- CMMC Level 1 (Self) or Level 2 (Self), with annual affirmation, where a contract includes it.
- DCMA Medium and High assessments under DFARS 252.240-7997, whose results take precedence over any other assessment.
- Whatever your prime asks of you in its flow-down terms.
Who is affected, and how?
Prime contractors
Your new solicitations may drop CMMC clauses, but DFARS 7012 and the 7008 representation stay. Decide what you will ask of subcontractors, because your flow-down terms now carry more of the weight that CMMC was meant to carry.
Subcontractors
Expect primes to keep asking for evidence: a current SSP, an accurate SPRS score where required, or a third-party assessment. The suspension changes DoW’s contract terms, not your prime’s risk.
Companies preparing for a C3PAO assessment
The work is not wasted. A voluntary C3PAO assessment remains available, the same evidence supports a self-assessment or a DCMA assessment, and the requirements behind it have not changed.
Companies already certified
Keep the status current. CMMC status depends on the annual affirmation, and the certificate is only as strong as the environment that still matches it.
What should you do this quarter?
- Read the CMMC and DFARS clauses in each active contract and note which still apply.
- Confirm your System Security Plan matches the systems you run today.
- Check that any posted SPRS score matches what is in place.
- Obtain the DoD medium assurance certificate if you do not have one.
- Ask your primes what they will require of you in 2027.
What does this mean for existing contracts?
Contracting officers must remove CMMC requirements from existing contracts by modification, before the next option period is exercised or at the next scheduled administrative modification. Until then, the contract you signed applies. The DFARS 7012 obligations stay either way, and no waivers are granted during the review.
Is CMMC “not required until 2028”?
No. The 2028 date that circulates, November 10, 2028, is the CMMC rule’s Phase 4 full-implementation date, which has been in the rule since 2025. The CIO memo sets no end date for the suspension; it says further guidance will follow the CIO’s 60-day review.
What happens next?
Three developments could change the picture: the CIO’s further guidance after the review, the FAR CUI rule and its move toward NIST SP 800-171 Rev 3, and any restart of third-party assessment as a condition of award. We review this guide every month and update the date at the top when anything changes.
How do you stay ready?
The safest position does not depend on how CMMC ends up. Implement NIST SP 800-171 Rev 2 in a way you can prove, keep the representation in your offers accurate, and be ready for a third-party assessment if a prime or DoW asks for one. CMMC Level 2 →
SENTRE was built for that position: a managed CUI enclave built by ITG, based on the environment ITG had assessed by a C3PAO at 110 of 110, after more than 10 months of work on its own build. An assessment is something you are ready for, whenever it returns. customer-zero case study →
Frequently asked questions
Is CMMC required in 2026?
CMMC Level 1 (Self) or Level 2 (Self) is required only where a contract includes it. NIST SP 800-171 Rev 2 under DFARS 7012 is required wherever you handle covered defense information, and every offer represents that you implement it. DFARS 7012 guide →
Is C3PAO certification still possible?
Yes. Third-party assessments remain available voluntarily, and some primes ask suppliers for them. DoW may not designate Level 2 (C3PAO) in new procurements during the suspension, but a voluntary assessment still produces a CMMC status that primes and DoW can see.
When does CMMC Phase 2 resume?
No date has been published. The CIO memo says further guidance follows the 60-day review, which ended on September 11, 2026; its report had not been published at the last review of this guide. We update this answer every month.
Do we still need an SPRS score?
Only where your contract requires one: CMMC Level 2 (Self), or a legacy contract still carrying DFARS 7019 or 7020 until it is modified. DCMA posts its own assessment results, which take precedence over any score you post yourself, so the two should never tell different stories. SPRS score →
Does the False Claims Act still apply?
Yes. The suspension did not change the False Claims Act or the DOJ Civil Cyber-Fraud Initiative. An offer under DFARS 7012 still represents that you implement NIST SP 800-171, so an overstated representation carries the same exposure it did before the suspension. False Claims Act risk →
Should we stop preparing for CMMC?
No. The requirements behind CMMC Level 2 are the NIST SP 800-171 Rev 2 requirements that DFARS 7012 already imposes, and DCMA can assess them at any time. Preparation that implements and documents those requirements keeps its value whatever the CIO decides after the review.
Why do some documents say DoW and others DoD?
An executive order of September 5, 2025 authorized “Department of War” as a secondary title. The statutory name remains Department of Defense until Congress acts, so contracts, clauses and legal citations still use DoD and DFARS names. Both refer to the same department.
Sources
- DoW CIO, Attachment 1, Cybersecurity Maturity Model Certification Procedures (cleared 26-P-1023, July 13, 2026).
- Class Deviation 2026-O0025 Rev 3, DFARS Part 240 (September 3, 2026).
- 32 CFR part 170 (CMMC Program).
Want to know where your contracts stand and how SENTRE fits? Request a Discovery Session →