CMMC After the Phase 2 Suspension: What Contractors Still Have to Do in 2026

Short answer: on July 13, 2026, the Department of War suspended the move to CMMC Phase 2, which was due on November 10, 2026. Phase 1 did not go away. Contractors still need a CMMC Level 1 or Level 2 self-assessment where a contract calls for one, their results and score in SPRS, and an annual affirmation from a senior official. Safeguarding and incident-reporting duties under DFARS 252.204-7012 also continue.

Last checked: November 2, 2026. This guide is free, has no sign-up, and every rule below is tied to an official source listed at the end. It is general information, not legal advice. Your contract and your contracting officer decide what applies to you.

What happened on July 13, 2026

The Department of War announced the immediate suspension of the Phase 2 requirements that were scheduled to begin on November 10, 2026. Its news release says all Phase 1 self-assessment requirements remain in place and that a review of the whole program is under way, led by a CMMC Reform Task Force with a 60-day timeline. The same day, the Under Secretary of War for Acquisition and Sustainment issued implementing memorandum 26-P-1023.

The memo says that during the suspension, program offices may only ask for CMMC Level 1 (Self) or Level 2 (Self). They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments. Active solicitations that asked for those levels must be amended, and existing contracts must have them removed by modification before the next option is exercised or at the next scheduled administrative modification. The memo also says no waivers will be granted during the review.

What is paused and what still applies

The suspension is a policy decision, not a rewrite of the regulation. The eCFR text of 32 CFR 170.3 we read (issue date October 29, 2026) still describes the four phases. The September 3 class deviation tells contracting officers to follow the suspension, and it keeps the rule that they check SPRS before award and before exercising an option.

Phase 1 self-assessments

Level 1 (Self)

Level 1 covers Federal Contract Information and the basic safeguarding requirements of FAR 52.204-21. Under 32 CFR 170.15:

• You must meet every requirement. There is no partial credit and no plan of action and milestones (POA&M) is allowed.
• You self-assess every year and submit the result in SPRS. The entry includes the CMMC level, status date, assessment scope, the CAGE codes for the systems in scope, and the compliance result.
• An affirmation is required with every Level 1 self-assessment.
• Keep the evidence you used for six years from the status date.
• Before award of a contract that requires Level 1 (Self), you need both the status and a filed affirmation.

Level 2 (Self)

Level 2 covers Controlled Unclassified Information and maps to NIST SP 800-171 Revision 2, which has 110 requirements. Under 32 CFR 170.16 and 170.21:

• You self-assess against NIST SP 800-171A and score the result with the rule’s scoring method, then upload it to SPRS. The entry includes the overall score, for example 105 out of 110, and any POA&M status.
• You repeat the self-assessment every three years and affirm every year.
• A Conditional Level 2 (Self) status is possible if your score divided by 110 is at least 0.8, which is 88 points. Every item on the POA&M must be worth one point or less, with one exception: SC.L2-3.13.11 (CUI encryption) can be listed if encryption is used but is not FIPS-validated.
• Some requirements can never go on a POA&M, including the system security plan (CA.L2-3.12.4), external connections (AC.L2-3.1.20), control of public information (AC.L2-3.1.22) and the three physical access requirements (PE.L2-3.10.3, 3.10.4 and 3.10.5).
• You have 180 days from the conditional status date to close out the POA&M with a closeout self-assessment. If you miss it, the conditional status expires.
• A Level 2 (Self) status also satisfies Level 1 for the same scope.

Your SPRS score

SPRS is the Supplier Performance Risk System. It stores results; it does not perform the assessment. To enter results, your company needs a PIEE account with the SPRS Cyber Vendor User role, according to the SPRS NIST SP 800-171 page.

The score starts at 110, the number of NIST SP 800-171 Revision 2 requirements. For each requirement that is not fully met, you subtract its value. The DoD Assessment Methodology and 32 CFR 170.24 give each requirement a value:

• The score can go below zero if enough requirements are missing.
• A POA&M is not a substitute for a finished requirement. A requirement that is not implemented counts as not met whether or not a plan exists.
• You must have a current system security plan. Without one, the method says the assessment cannot be completed.
• Evidence has to be in final form. The rule says drafts, working papers and unapproved policies do not count.

Annual affirmations

An affirming official is a senior representative of your company who is responsible for CMMC compliance and has authority to affirm it. 32 CFR 170.22 says the official must submit an affirmation in SPRS:

• when you reach a Conditional CMMC status
• when you reach a Final CMMC status
• after a POA&M closeout assessment
• every year after the Final status date

Each affirmation names the official, with title and contact details, and states that your company has implemented and will maintain all applicable requirements for its status across the systems in scope.

Affirmations keep a status current. In the revised DFARS text issued with the class deviation, a Final Level 1 (Self) status counts as current for one year, a Final Level 2 (Self) status for three years, and in both cases the affirmation can be no more than one year old. A Conditional status counts as current for 180 days.

What stays the same under DFARS 252.204-7012

The memo says the cybersecurity requirements in DFARS 252.204-7012 remain in effect, and the Department says it will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments during the suspension. The clause requires adequate security on covered contractor information systems and reporting of cyber incidents within 72 hours of discovery. The DoD news release adds that the action does not remove the duty to protect federal data.

A practical checklist

1. Read the CMMC level and clauses in each solicitation and contract. Contracts and amendments may change during the suspension.
2. List every system that handles Federal Contract Information or CUI, and write down the scope.
3. Complete the Level 1 self-assessment if you handle FCI, or the Level 2 self-assessment if you handle CUI. Score it honestly using the 110-point method.
4. Write or update the system security plan and a POA&M for any gaps.
5. Enter results in SPRS through PIEE and have the affirming official file the affirmation.
6. Put the annual affirmation, the three-year Level 2 reassessment and the 180-day POA&M deadline on a calendar.
7. Keep the assessment evidence for six years.
8. Check the DoD CIO CMMC page and your contracting officer before any decision that assumes Phase 2 will or will not return.

What we could not verify

• No Federal Register notice. We searched the Federal Register for 2026 documents about CMMC and found none announcing the suspension. The suspension is documented in Department of War and DoD CIO materials, the memo and the class deviation, not in a published rule.
• Review results. The memo promised further guidance after the 60-day review. As of November 2, 2026, the DoD CIO CMMC page still describes the July 13 suspension and we did not find an official restart date or final recommendations.
• Existing certificates. We found no official statement on how the suspension treats companies that already hold a Level 2 (C3PAO) certificate, so ask your contracting officer.
• New clause numbers. The revised DFARS text issued with the class deviation prescribes a clause numbered 252.240-7997 for NIST SP 800-171 DoD Assessment Requirements, where older text used 252.204-7019 and 252.204-7020. Use the clause your solicitation actually names.

FAQ

Sources

• DoD CIO: Cybersecurity Maturity Model Certification page (July 13, 2026 suspension notice)
• Memorandum 26-P-1023, Implementing the suspension of CMMC Phase 2 (July 13, 2026)
• Department of War news release, July 13, 2026
• Class Deviation 2026-O0025, Revision 3 (September 3, 2026)
• 32 CFR part 170, CMMC Program (sections 170.3, 170.15, 170.16, 170.21, 170.22, 170.24)
• Federal Register, DFARS Case 2019-D041 final rule, 90 FR 43560
• NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
• SPRS: NIST SP 800-171 information

Related reading: Cybersecurity laws and regulations in 2026 and DoD 8140 approved certifications.

CyberExperts Editorial Team

CyberExperts guides are researched from official certification body sources and fact-checked by the CyberExperts editorial team.