CMMC Status Tracker
- Home
- CMMC Status
"Phase 2 is paused. Your NIST 800-171 obligations are not."
Where CMMC Stands Today
On 13 July 2026 the Department of War suspended CMMC Phase 2, the step that would have required Level 2 certification by a C3PAO in solicitations from 10 November 2026. While the CMMC Reform Task Force review continues, new solicitations can require only Level 1 (Self) or Level 2 (Self).
What did not change: NIST SP 800-171 under DFARS 252.204-7012, your SPRS score, and the responsibility to report accurately on both. Primes will keep asking for the score, and contracts already carry these clauses.
The short version
- Phase 2 (C3PAO requirement): suspended
- Level 1 and Level 2 self-assessments: continue
- NIST SP 800-171 Rev. 2 and DFARS 7012: in force
- SPRS score: still required and visible to the DoD
- Restart date: none announced
What you still have to do
- Implement the 110 requirements of NIST SP 800-171 Revision 2 through DFARS 252.204-7012
- Report cyber incidents to the DoD within 72 hours under DFARS 252.204-7012
- Use cloud services that meet FedRAMP Moderate or equivalent for covered defense information
- Apply the FAR 52.204-21 basic safeguarding requirements to Federal Contract Information
- Keep an SPRS score that matches what your environment can demonstrate
- Meet Level 1 (Self) or Level 2 (Self) requirements, including annual affirmations, where a contract includes them
- Flow requirements down to subcontractors that handle FCI or CUI
What is on hold
- Phase 2 (was 10 November 2026): Level 2 C3PAO certification as a condition of award
- Phase 3 (was 10 November 2027) and Phase 4 (was 10 November 2028)
- Level 2 (C3PAO) and Level 3 requirements in solicitations; contracting officers are to remove or revise them
- Voluntary C3PAO assessments. The Cyber AB has said assessments, training and exams continue during the pause.
Timeline
| Date | What happened |
|---|---|
| 15 Oct 2024 | CMMC Program rule (32 CFR Part 170) published; effective 16 December 2024. |
| 10 Sep 2025 | DFARS rule published that puts CMMC requirements into DoD solicitations and contracts; effective 10 November 2025. |
| 10 Nov 2025 | Phase 1 begins: Level 1 and Level 2 self-assessment requirements can appear in solicitations and new contracts. |
| 13 Jul 2026 | Department of War memo suspends Phase 2, which was due on 10 November 2026, and later milestones. A CMMC Reform Task Force starts a 60-day review. |
| 14 Aug 2026 | Task force request for information from industry closes. |
| 3 Sep 2026 | DFARS Class Deviation 2026-O0025, Revision 3, carries the pause into contract language: only Level 1 (Self) or Level 2 (Self), with NIST SP 800-171 Revision 2 required through DFARS 252.204-7012. |
| Mid-Sep 2026 | The 60-day review period ends. |
| 30 Sep 2026 | A published recap of the Cyber AB's September town hall reports its chief executive's estimate: the task force report in the second half of October at the earliest. |
| 9 Oct 2026 | No public task force report, no new memo and no Phase 2 restart date found. |
What to Do While Phase 2 Is Paused
The pause changes when a C3PAO is required, not what a good program looks like. When certification requirements return, you will want to be ready rather than starting over.
Book a Free Consultation- Keep your SPRS score honest. Re-check it against your evidence; a score you cannot support is a False Claims Act risk.
- Keep closing POA&M items. Under a C3PAO assessment only certain requirements can sit on a POA&M, and open items must close within 180 days.
- Settle your CUI scope. A well-drawn CUI enclave keeps the eventual assessment smaller.
- Keep affirmations current wherever your contracts carry a CMMC status requirement.
- Ask your primes what they will require. Primes set their own supplier requirements and flow down contract clauses.
- Decide whether a voluntary C3PAO assessment makes sense. A Final Level 2 (C3PAO) status is valid for three years.
CMMC Status Questions
Is CMMC cancelled?
No. The CMMC Program rule (32 CFR Part 170) and the DFARS rule that puts CMMC into contracts are still in place. On 13 July 2026 the Department of War suspended Phase 2 and later milestones by memo while a CMMC Reform Task Force reviews the program, and DFARS Class Deviation 2026-O0025 (Revision 3, 3 September 2026) carried that pause into contract language. Level 1 (Self) and Level 2 (Self) requirements can still appear in solicitations.
Do we still need a C3PAO assessment?
Not for new solicitations while the suspension lasts: contracting officers can require only Level 1 (Self) or Level 2 (Self). C3PAO assessments remain available if you choose one, and a Final Level 2 (C3PAO) status is valid for three years with annual affirmations. Whether it is worth doing now depends on your contracts and your primes.
Does NIST SP 800-171 still apply?
Yes. DFARS 252.204-7012 still requires the 110 requirements of NIST SP 800-171 Revision 2 on systems that handle covered defense information, along with 72-hour cyber incident reporting. Your SPRS score from a NIST SP 800-171 self-assessment still matters, and a score your evidence cannot support creates False Claims Act exposure.
When will Phase 2 restart?
No restart date had been announced as of 9 October 2026. The task force's 60-day review period ended in mid-September 2026; on 30 September the chief executive of the Cyber AB estimated the report would come in the second half of October at the earliest, and it could come later. We update this page when the Department publishes a change.
Does VIS certify contractors or perform CMMC assessments?
No. VIS is a readiness and architecture consultancy, not a C3PAO. We help you prepare and stay ready; certified CMMC assessments are carried out by an accredited C3PAO you choose. This page summarizes public sources and is not legal advice or a determination about your company.
Sources
Checked 2026-10-09. Some government pages block automated access, so confirm the primary sources directly before relying on them.
- eCFR: 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program
- DoD CIO: CMMC program page
- Federal News Network: Pentagon suspends CMMC phase two requirements, launches review (13 July 2026)
- Greenberg Traurig: DoD suspends CMMC deadlines and seeks to reassess requirements (15 July 2026)
- SBA Office of Advocacy: DoW requests information for CMMC Reform Task Force (20 July 2026)
- Pivot Point Security: Revision 3 of DARS Class Deviation 2026-O0025
- Arnold & Porter: CMMC final rule key takeaways (September 2025)
- CMMC.com: September 2026 Cyber AB town hall recap (30 September 2026)
- The Cyber AB
This page summarizes public information for general guidance. It is not legal advice and not a compliance determination about any company. VIS is not a C3PAO and does not perform CMMC certification assessments.