CMMC Phase 2 is suspended. Your obligations are not.
The Department of War suspended Phase 2 and the third-party certification requirement on 13 July 2026. Self-assessment, affirmation, DFARS 252.204-7012 and NIST SP 800-171 are untouched.
What changed
On 13 July 2026 the Department of War suspended CMMC Phase 2, along with the pending and future implementation milestones behind it. The central item is the Level 2 third-party certification requirement, which was due to start appearing in solicitations from 10 November 2026 as a condition of award. Assessments by a Certified Third-Party Assessment Organization (C3PAO) are no longer being required on that schedule, government-led assessments are paused for the review period, and contracting officers have been directed to amend active solicitations to remove the requirements and to modify existing contracts before the next option period or scheduled administrative modification.
A CMMC Reform Task Force is conducting a 60-day top-to-bottom review of the programme and is expected to report in mid-September 2026.
The published reasoning was cost and capacity: the assessment burden on small and mid-sized suppliers, against an accredited assessor pool far smaller than the number of companies in the defense industrial base.
Who is affected
Anyone who was working to a November 2026 certification date. That date is gone, and planning against it is now planning against a schedule that does not exist.
Almost nobody else, and this is the part worth being precise about, because the announcement has been read far more broadly than it says.
Unchanged and still in force:
- Federal Acquisition Regulation 52.204-21 — the fifteen basic safeguards for Federal Contract Information.
- Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 — the safeguarding and 72-hour incident reporting obligations for Controlled Unclassified Information.
- National Institute of Standards and Technology (NIST) SP 800-171 Rev 2 — all 110 requirements.
- Phase 1 self-assessment and affirmation at Levels 1 and 2, including the annual affirmation by a senior official.
- The government's audit authority. The pause is on a schedule for third-party certification, not on the right to look.
If you hold Controlled Unclassified Information today, your duty to protect it today is exactly what it was on 12 July.
What you need to do
Reset the date. Do not stand down the programme.
- Take November 2026 out of your plan and replace it with the September review as the next decision point, not as the next deadline.
- Keep the self-assessment current. It was never suspended, the affirmation is still annual, and it is still submitted by a senior official who has to be able to find out whether it is true.
- Finish the scoping work. Where Controlled Unclassified Information is allowed to live drives the cost of every future version of this programme, whatever the review produces. It is the one piece of work that cannot be wasted.
- Do not cancel remediation. Gaps found against NIST SP 800-171 are gaps against an obligation that is still in your contracts. A pause in verification is not a pause in the requirement.
- Watch mid-September. The review reports then. A supplier who has kept moving will read it as an adjustment; one who stopped will read it as a restart with less runway.
The honest summary is unglamorous: the schedule moved, the duty did not, and the work that was worth doing in June is the same work that is worth doing now.
Sources. Department of War announcement, 13 July 2026, as reported in the Crowell & Moring client alert and the Latham & Watkins client alert. Programme rule: 32 CFR Part 170.