If you saw the headlines and wondered whether your CMMC work just became pointless, the answer is no. Something real happened, and it is worth understanding precisely, because the gap between what was suspended and what remains is where most of the confusion is.
What happened
On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memo suspending CMMC Phase 2 and launching a 60 day top to bottom review of the program. A CMMC Reform Task Force will submit findings and recommendations within 60 days. Responses to the associated Request for Information are due by 12pm ET on August 14, 2026.
Phase 2 was the stage that would have phased third party C3PAO assessment requirements into applicable DoD solicitations starting November 10, 2026. That date is suspended and is no longer something to plan around.
What changed
- November 10, 2026 is no longer an operative deadline. Nothing phases in on that date.
- No C3PAO certification is required by a deadline. The third party assessment stage is paused.
- The program itself is under review, so the shape of CMMC after roughly September 11, 2026 is genuinely open.
What did not change
This is the part the headlines mostly skipped, and it is the part that decides what you actually do on Monday.
| Obligation | Status after July 13, 2026 |
|---|---|
| Phase 1 CMMC self assessment on applicable contracts | In force. Untouched. |
| DFARS 252.204-7012 | In force. Untouched. |
| NIST SP 800-171 Rev 2 baseline compliance | In force. Untouched. |
| DIB self assessments and select government led assessments | Still enforced. |
| Annual affirmation in SPRS | Still required where applicable. |
| False Claims Act exposure for false affirmations | Unchanged. |
| 32 CFR Part 170 program rule (eff. Dec 16, 2024) | Still on the books. |
| 48 CFR DFARS acquisition rule (eff. Nov 10, 2025) | Still on the books. |
Level 2: the self assessment is the current path
CMMC Level 2 has always had two tracks against the same 110 requirements:
- A self assessment filed in SPRS with an annual affirmation, accepted by many contracts.
- Certification by an accredited third party assessor, a C3PAO, required by some contracts.
Phase 2 was about phasing the C3PAO track into solicitations on a schedule. That phase in is what got suspended. The self assessment track is current, and it is what a CUI contractor files today. The same SSP, the same scope, and the same evidence serve both tracks, so the readiness work is identical either way.
Why DoD paused it
The memo is unusually direct about the reason. It cites the combination of prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines, and says those are actively forcing innovative new entrants and small businesses to opt out of DoD contracts and freezing critical suppliers out of the market. The current program, in the memo's framing, is structurally incompatible with rapidly expanding the defense industrial base.
In other words: the assessment machinery was the bottleneck, not the security requirements. That distinction is why the baseline obligations survived the pause and the certification stage did not.
What to do now
If you handle FCI only (Level 1)
Nothing changed for you. Phase 1 is in force, Level 1 is 15 safeguarding requirements from FAR 52.204-21, it is self assessed, no C3PAO was ever involved, and your annual affirmation is still due. Carry on.
If you handle CUI (Level 2)
Keep going. File the self assessment, keep your NIST SP 800-171 posture current, and keep your POA&M honest. Your DFARS 252.204-7012 obligation never paused, primes still flow requirements down, and if the Task Force brings certification back in some form, the org with a current SSP and real evidence is the one that absorbs it without drama.
If you were about to start
Start. The work is the same work, the deadline stress is gone, and you now have a window to do it properly instead of in a panic. That is a better position than the one you were in last week.
If you want to influence the outcome
RFI responses are due by 12pm ET on August 14, 2026. If the program's cost and assessor availability hurt your business, that is the venue for saying so.
Dates that matter
| Date | What it is |
|---|---|
| Dec 16, 2024 | 32 CFR Part 170, the CMMC program rule, effective. Still in force. |
| Nov 10, 2025 | 48 CFR DFARS acquisition rule effective, Phase 1 begins. Still in force. |
| Jul 13, 2026 | DoD suspends Phase 2, opens a 60 day top to bottom review. |
| Aug 14, 2026 | RFI responses due by 12pm ET. |
| ~Sep 11, 2026 | CMMC Reform Task Force findings and recommendations due. |
| Nov 10, 2026 | Former Phase 2 start. Suspended. No longer operative. |
Frequently asked questions
Is CMMC cancelled?
No. CMMC Phase 2 is suspended, not cancelled. On July 13, 2026 DoD suspended the Phase 2 rollout and opened a 60 day review of the program. The 32 CFR Part 170 program rule and the 48 CFR DFARS acquisition rule are both still on the books, and Phase 1 self assessment requirements remain in force on applicable contracts.
Do I still need a CMMC self assessment?
Yes, if your contracts carry the requirement. Phase 1 took effect in November 2025 and was not touched by the suspension. Applicable contracts still require a CMMC self assessment, filed in SPRS with an annual affirmation. That obligation did not move.
Do I need a C3PAO certification now?
Not by a deadline. Phase 2 was the stage that would have phased third party C3PAO assessment requirements into applicable solicitations starting November 10, 2026. That stage is suspended, so no C3PAO certification is required by a deadline right now. Individual contracts can still specify what they specify, so read your solicitation.
What is the current path for Level 2?
The Level 2 self assessment. Level 2 has always had two tracks against the same 110 requirements: a self assessment filed in SPRS with an annual affirmation, or certification by a C3PAO. The suspension paused the certification track's phase in. The self assessment track is current and unaffected, and the same SSP and evidence serve both.
Why did DoD suspend CMMC Phase 2?
The July 13, 2026 memo signed by DoD Chief Information Officer Kirsten Davies cites prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines that were forcing new entrants and small businesses to opt out of DoD contracts. A CMMC Reform Task Force will report findings and recommendations within 60 days.
Does DFARS 252.204-7012 still apply?
Yes. DFARS 252.204-7012 is unaffected by the suspension. So is NIST SP 800-171 Rev 2 baseline compliance, DIB self assessments, and select government led assessments. If you handle CUI, your obligation to safeguard it and report incidents is exactly what it was before July 13.
Should I stop my CMMC readiness work?
No. The suspension removed deadline pressure, not the requirement. The underlying obligations that drive the work, DFARS 252.204-7012 and NIST SP 800-171, are untouched, primes still flow requirements down, and false affirmations are still False Claims Act exposure. Readiness work done now retains its value, and the Task Force reports in roughly 60 days.