CMMC Phase 2 Suspended: What DoD Contractors Need to Know Right Now

On July 13, 2026, the Department of War (DoW) announced the suspension of CMMC Phase 2 – specifically the mandatory third-party C3PAO assessment requirements that were scheduled to begin appearing in contracts on November 10, 2026. A 60-day CMMC Reform Task Force will study the program and report back on or about September 13, 2026.

If you handle Federal Contract Information or Controlled Unclassified Information under a DoD contract, here is what this means for you – and more importantly, what it does not mean.

What the DoW Actually Said

Under Secretary of Defense for Acquisition and Sustainment Michael Duffey was direct about the intent of the suspension:

The standard has not changed. The NIST SP 800-171 Rev. 2 requirements are intact. The only question under review is how – and by whom – compliance gets verified. The 32 CFR Part 170 rule and the 48 CFR DFARS acquisition rule both remain in effect and cannot be lawfully changed without going through full federal rulemaking.

What This Means for CMMC Level 1 Contractors

If you handle only Federal Contract Information and fall under CMMC Level 1, nothing has changed for you. Level 1 has always been a self-assessment. You still need to:

• →Complete your annual self-assessment against the 15 FAR 52.204-21 practices
• →Maintain a System Security Plan (SSP) and POA&M to support your score
• →Submit your score and affirmation to SPRS through PIEE
• →Ensure your documentation can withstand scrutiny – DIBCAC can still audit you and DoJ continues to pursue False Claims Act cases

What This Means for CMMC Level 2 Contractors

If you handle Controlled Unclassified Information, this suspension removes the immediate pressure of scheduling a C3PAO assessment – but it does not remove your compliance obligations.

For now, Level 2 requires self-assessment only, with a minimum score of 88 out of 110 NIST SP 800-171 Rev. 2 requirements. That minimum score has not changed. Your SPRS submission and annual affirmation are still required. And DIBCAC retains the authority to conduct assessments at any time.

There is also the prime contractor factor. Major primes – including large defense contractors who flow CUI to their supply chains – have been independently requiring Level 2 documentation from their subcontractors. That pressure does not pause with the DoW announcement. If your prime requires documentation, a self-assessment may not satisfy them regardless of what the federal timeline says.

Our Take: Keep Going

At KyberStorm, we have been working with defense contractors on CMMC compliance since before the final rule was published. We have been through the “CMMC 2.0” rewrite, the rulemaking delays, and every shift in the timeline. This suspension is not the first and will likely not be the last adjustment to the program.

What has never changed is the underlying obligation: protect FCI and CUI to the required standard, document that you are doing it, and be able to prove it. A pause in C3PAO requirements does not change that obligation. It only shifts how verification happens – and temporarily, not necessarily permanently.

The Reform Task Force reports back September 13. C3PAO requirements could return, be modified, or evolve into something new. Organizations that have been building their compliance posture are ahead regardless of the outcome. Organizations that use this pause as a reason to stop are taking a risk on an uncertain timeline.

What to Do Right Now