If you saw the headlines and wondered whether your CMMC work just became pointless, the answer is no. Something real happened, and it is worth understanding precisely, because the gap between what was suspended and what remains is where most of the confusion is.
Update: the September 3, 2026 class deviation
On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment.
The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set. Source: DFARS class deviation 2026-O0025 Revision 3 (September 3, 2026), normally published on the Defense Pricing, Contracting and Acquisition Policy class deviations page (not listed there when checked on September 22, 2026); reported by Kiteworks, Pivot Point Security, Fortreum, Redspin, Sera-Brynn and CyberZ. Revision 3 carries forward Revision 2 (July 16, 2026), which implemented the July 13, 2026 DoD CIO memorandum.
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
What happened
On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memo suspending CMMC Phase 2 and launching a 60 day top to bottom review of the program. A CMMC Reform Task Force was to submit findings and recommendations within 60 days. Responses to the associated Request for Information were due by 12pm ET on August 14, 2026.
Phase 2 was the stage that would have phased third party C3PAO assessment requirements into applicable DoD solicitations starting November 10, 2026. That date is suspended and is no longer something to plan around.
What changed
- November 10, 2026 is no longer an operative deadline. Nothing phases in on that date.
- No C3PAO certification is required by a deadline. The third party assessment stage is paused.
- The program itself is under review, so the shape of CMMC after the review is genuinely open. A report alone changes no contract obligation; only a deviation, a DFARS rule change, or an amendment to 32 CFR Part 170 does.
What did not change
This is the part the headlines mostly skipped, and it is the part that decides what you actually do on Monday.
| Obligation | Status after July 13, 2026 |
|---|---|
| Phase 1 CMMC self assessment on applicable contracts | In force. Untouched. |
| DFARS 252.204-7012 | In force. Untouched. |
| NIST SP 800-171 Rev 2 baseline compliance | In force. Untouched. |
| DIB self assessments and select government led assessments | Still enforced. |
| Annual affirmation in SPRS | Still required where applicable. |
| False Claims Act exposure for false affirmations | Unchanged. |
| 32 CFR Part 170 program rule (eff. Dec 16, 2024) | Still on the books. |
| 48 CFR DFARS acquisition rule (eff. Nov 10, 2025) | Still on the books. |
Level 2: the self assessment is the current path
CMMC Level 2 has always had two tracks against the same 110 requirements:
- A self assessment filed in SPRS with an annual affirmation, accepted by many contracts.
- Certification by an accredited third party assessor, a C3PAO, required by some contracts.
Phase 2 was about phasing the C3PAO track into solicitations on a schedule. That phase in is what got suspended, and since September 3, 2026 contracting officers are directed to remove third party assessment requirements from contracts, so the solicitation sets the track. The self assessment track is current, and it is what a CUI contractor files today. The same SSP, the same scope, and the same evidence serve both tracks, so the readiness work is identical either way.
Why DoD paused it
The memo is unusually direct about the reason. It cites the combination of prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines, and says those are actively forcing innovative new entrants and small businesses to opt out of DoD contracts and freezing critical suppliers out of the market. The current program, in the memo's framing, is structurally incompatible with rapidly expanding the defense industrial base.
In other words: the assessment machinery was the bottleneck, not the security requirements. That distinction is why the baseline obligations survived the pause and the certification stage did not.
What to do now
If you handle FCI only (Level 1)
Nothing changed for you. Phase 1 is in force, Level 1 is 15 safeguarding requirements from FAR 52.204-21, it is self assessed, no C3PAO was ever involved, and your annual affirmation is still due. Carry on.
If you handle CUI (Level 2)
Keep going. File the self assessment, keep your NIST SP 800-171 posture current, and keep your POA&M honest. Your DFARS 252.204-7012 obligation never paused, primes still flow requirements down, and if the Task Force brings certification back in some form, the org with a current SSP and real evidence is the one that absorbs it without drama.
If you were about to start
Start. The work is the same work, the deadline stress is gone, and you now have a window to do it properly instead of in a panic. That is a better position than the one you were in last week.
If you want to influence the outcome
RFI responses were due by 12pm ET on August 14, 2026. The next venue is whatever the Department publishes after the review; we will link it from the state of CMMC timeline when it lands.
Dates that matter
| Date | What it is |
|---|---|
| Dec 16, 2024 | 32 CFR Part 170, the CMMC program rule, effective. Still in force. |
| Nov 10, 2025 | 48 CFR DFARS acquisition rule effective, Phase 1 begins. Still in force. |
| Jul 13, 2026 | DoD suspends Phase 2, opens a 60 day top to bottom review. |
| Aug 14, 2026 | RFI responses due by 12pm ET. |
| Sep 3, 2026 | DFARS class deviation 2026-O0025 Revision 3: the suspension becomes binding direction to contracting officers. Level 1 and Level 2 may be satisfied by self assessment. No new date set. |
| Sep 11, 2026 | CMMC Reform Task Force report date. A report alone changes no contract obligation. |
| Nov 10, 2026 | Former Phase 2 start. Suspended. No longer operative. |
Frequently asked questions
Is CMMC cancelled?
No. CMMC Phase 2 is suspended, not cancelled. On July 13, 2026 DoD suspended the Phase 2 rollout and opened a 60 day review of the program. The 32 CFR Part 170 program rule and the 48 CFR DFARS acquisition rule are both still on the books, and Phase 1 self assessment requirements remain in force on applicable contracts.
What did the September 3, 2026 class deviation change?
On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment. The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set.
Do I still need a CMMC self assessment?
Yes, if your contracts carry the requirement. Phase 1 took effect in November 2025 and was not touched by the suspension. Applicable contracts still require a CMMC self assessment, filed in SPRS with an annual affirmation. That obligation did not move.
Do I need a C3PAO certification now?
Not unless your solicitation names it. As of September 3, 2026, a DFARS class deviation directs contracting officers to remove third party assessment requirements from contracts, and Level 1 and Level 2 may be satisfied by self assessment. The program rule still provides for certification, so the solicitation sets the track. DFARS 252.204-7012, NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation are unchanged.
What is the current path for Level 2?
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. The same SSP and evidence serve both tracks.
Why did DoD suspend CMMC Phase 2?
The July 13, 2026 memo signed by DoD Chief Information Officer Kirsten Davies cites prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines that were forcing new entrants and small businesses to opt out of DoD contracts. A CMMC Reform Task Force was to report within 60 days; on September 3, 2026 a class deviation made the suspension binding on contracting officers.
Does DFARS 252.204-7012 still apply?
Yes. DFARS 252.204-7012 is unaffected by the suspension. So is NIST SP 800-171 Rev 2 baseline compliance, DIB self assessments, and select government led assessments. If you handle CUI, your obligation to safeguard it and report incidents is exactly what it was before July 13.
Should I stop my CMMC readiness work?
No. The suspension removed deadline pressure, not the requirement. The underlying obligations that drive the work, DFARS 252.204-7012 and NIST SP 800-171, are untouched, primes still flow requirements down, and false affirmations are still False Claims Act exposure. Readiness work done now retains its value; the September 3, 2026 class deviation continued the suspension without a new date.