The short version
| Status | What it means |
|---|---|
| Paused | CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) third-party assessment requirements. No replacement date has been announced. |
| Still in force | Level 1 and Level 2 self-assessments, SPRS submission and annual affirmation, DFARS 252.204-7012, NIST SP 800-171 Rev. 2. |
| Driving the work | Prime contractors can still require certification as a condition of doing business, even while the DoD program is paused. |
What changed on July 13, 2026
Phase 2 is suspended
The Department of War suspended CMMC Phase 2, which was scheduled to begin on November 10, 2026. Level 2 (C3PAO) and Level 3 (DIBCAC) third-party assessment requirements are suspended; active solicitations and contracts carrying those designations are to be amended to remove them during the pause.
A reform task force, not a repeal
DoD stood up a CMMC Reform Task Force and a 60-day review, with an RFI that closed on August 14, 2026. The program is paused, not repealed. The final rule, 32 CFR Part 170, is still on the books.
What is still in force
Self-assessments and SPRS
Level 1 (17 practices) and Level 2 (110 requirements) self-assessments remain. A current SPRS score and annual affirmation are still part of eligibility for many awards, and a self-assessment older than three years is no longer current.
DFARS 252.204-7012
Safeguarding CUI, cyber incident reporting, media preservation and cloud security requirements are unchanged. NIST SP 800-171 Rev. 2 remains the underlying standard for the 110 requirements.
What happens next
The reported 90-day option
A task force summary obtained by Federal News Network in late October proposes restarting Phase 2 over a 90-day period with a narrower population, expanding POA&M eligibility from 180 to 270 days (which would require rulemaking), publishing assessor availability statistics, and considering NIST SP 800-171 Rev. 3. These are recommendations, not operative requirements.
No replacement date
As of November 1, 2026, no replacement Phase 2 date has been announced. Verify the clause in your contract and what your prime requires; do not rely on commentary as if it were an approved assessment rule.
What to do now
- Read the clause. DFARS 252.204-7012, 7019/7020/7021, and any prime flow-down. The clause decides what applies to you.
- Keep SPRS current. Score the 110 requirements, document N/A decisions, and submit the result yourself in SPRS.
- Keep the SSP and POA&M alive. They are the first documents an assessor reads, and they are the evidence base for any future certification.
- Ask your prime. Prime deadlines are not DoD deadlines, but they can still decide whether you keep the work.
- Don't cancel remediation. The NIST SP 800-171 obligation did not move with the Phase 2 date.
Start with your score
The calculator applies the 313-point SPRS method to all 110 requirements and shows the gap by family.
Open the SPRS calculatorSources
- SBA statement, July 13, 2026 — 120,000+ small businesses; cost estimates.
- Troutman Pepper Locke analysis, July 16, 2026 — what is suspended and what remains.
- Federal News Network, October 27, 2026 — reported task force options.
- 32 CFR Part 170 · DFARS 252.204-7012