CMMC status in 2026: what's paused and what isn't
Phase 2 third-party assessments are suspended while the program is reviewed. Level 1 self-assessments and annual affirmations are still required.
Last updated: October 2026
The bottom line
- Phase 1 is in effect. It started November 10, 2025 and covers Level 1 and Level 2 self-assessments.
- Phase 2 is suspended. On July 13, 2026, the Department of War suspended Phase 2, the Level 2 third-party (C3PAO) assessment requirement that was set to start November 10, 2026.
- A reform review is underway. A CMMC Reform Task Force was set up to review the program. As of late October 2026, its report hasn't been publicly released.
- Level 1 hasn't changed. If your contract requires Level 1, you still self-assess and affirm in SPRS every year.
How we got here
| # | Date | What happened |
|---|---|---|
| 1 | Sept 10, 2025 | DoD published the final DFARS rule that puts CMMC requirements into contracts, effective November 10, 2025. |
| 2 | Nov 10, 2025 | Phase 1 began: Level 1 and Level 2 self-assessments, with results and affirmations in SPRS. |
| 3 | July 13, 2026 | The Department of War suspended Phase 2 and held later CMMC milestones in abeyance until further notice. It created a CMMC Reform Task Force with 60 days to deliver recommendations to the DoW Chief Information Officer, and issued a public request for information. |
| 4 | Aug 14, 2026 | Responses to the request for information were due. |
| 5 | Sept 11, 2026 | The task force report was due to the Chief Information Officer. |
| 6 | Late Oct 2026 | No official public report. Press reports have described a summary of the findings, but DoD hasn't published the report. |
What's paused
- Level 2 third-party assessments by C3PAOs, and Level 3 government-led (DIBCAC) assessments, can't be required as a condition of award while the suspension lasts.
- Later rollout milestones are on hold until further notice.
- For existing contracts that already include Phase 2 or Phase 3 requirements, contracting officers are to remove them by modification.
What's still required
- Level 1 self-assessments and annual affirmations for contracts that require them. The DoD CIO's CMMC page says "All Phase I self-assessment requirements remain firmly in place."
- Level 2 self-assessments, with scores posted in SPRS.
- FAR 52.204-21 and its 15 basic safeguarding requirements.
- DFARS 252.204-7012 and NIST SP 800-171 for companies handling CUI. During the pause, the Department says it will enforce NIST SP 800-171 Rev. 2 through self-assessments and selected government-led assessments.
The suspension also doesn't change False Claims Act exposure. Law firms advising contractors have pointed out that inaccurate self-assessments or unsupported affirmations can still create contractual, administrative and False Claims Act risk.
What this means for a Level 1 shop
Very little changes. If your contract or subcontract carries a Level 1 requirement, keep your annual cycle: assess against the 15 requirements, keep your evidence, and have your Affirming Official affirm in SPRS before the one-year mark. See the Level 1 self-assessment guide and the SPRS affirmation guide.
What we don't know yet
We don't know what the task force will recommend, when Phase 2 will restart, or whether Level 1 itself will change. We won't guess. We'll update this page when DoD publishes something official.
Common questions
Is CMMC cancelled?
No. Phase 2 is suspended pending a reform review, but Phase 1 self-assessment requirements, including Level 1, remain in place.
Do we still need a Level 1 self-assessment?
Yes, if your contract or subcontract requires CMMC Level 1. The annual self-assessment and affirmation in SPRS are still required.
When will Phase 2 restart?
No new date has been announced as of late October 2026. The original November 10, 2026 start date is suspended.
Did the suspension pause annual affirmations?
No. The annual affirmation requirement under 32 CFR 170.22 isn't affected by the Phase 2 suspension.
Has the task force report been released?
Not publicly, as of late October 2026. The report was due to the DoW Chief Information Officer on September 11, 2026.
Find out where you stand in 20 minutes.
Free, no obligation. If you're already covered, we'll tell you.
Sources
- DoD CIO, About CMMC
- WilmerHale, Pentagon suspends CMMC Phase 2 requirements (July 20, 2026)
- DLA Piper, Department of War suspends CMMC Phase 2 assessment requirements (Aug 2026)
- Morgan Lewis, DoW suspends CMMC Phase II, but cybersecurity obligations remain (July 2026)
- Crowell & Moring, CMMC Phase II suspended: active solicitations (July 15, 2026)
- Covington, Inside Government Contracts: CMMC Reform Task Force updates (Sept 2026)
- Federal News Network, RFI offers path forward for DoD with CMMC (Oct 27, 2026)
- Cozen O'Connor, CMMC goes into effect on November 10, 2025
- 32 CFR 170.3, phased implementation (Cornell LII)
General information, not legal advice. Back to Onyx home.