CMMC Phase II Is Suspended: What Contractors Still Owe

That is a meaningful procurement change. Some solicitations expected to require a Level 2 certification during Phase II may not follow the former timeline. It is not, however, a blanket release from every cybersecurity term in an existing contract. The Department’s own CMMC materials say the pause does not eliminate the requirement to protect information under DFARS 252.204-7012. A contractor must still read the clauses incorporated into each solicitation and award, determine the information it handles, and meet the obligations attached to that work.

The practical distinction is simple: CMMC is an assessment and contracting mechanism, while safeguarding requirements can arise from clauses and standards that exist independently of the current phase schedule. Moving an external assessment milestone does not make controlled unclassified information less sensitive. It also does not make a prior self-assessment, affirmation, or representation disposable.

The official announcement contains several points that procurement and security teams should record without embellishment.

First, Phase II was suspended before its scheduled November 10 start. Second, all Phase I self-assessment requirements remain in place. Third, the Department began a review intended to reduce compliance burdens while retaining cybersecurity outcomes. Fourth, during the interim period, the Department said it would enforce NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments.

Those are confirmed statements. What happens after the review is not yet confirmed. A revised phase structure, different assessment thresholds, or other implementation changes may be plausible, but they are forecasts until the Department publishes them. A responsible internal memo should separate the announcement from interpretation:

This discipline matters because teams often convert a proposal or public comment into a procurement assumption. Until a final rule, class deviation, clause update, or solicitation instruction says otherwise, the operative document is the one attached to the transaction in front of you.

The Department’s current CMMC overview describes Phase I as beginning November 10, 2025. Where applicable, solicitations can require Level 1 or Level 2 self-assessment as a condition of award. The precise requirement depends on the contract and the information in scope.

At Level 1, the Department describes an annual self-assessment against 15 safeguarding requirements associated with FAR 52.204-21, with results and affirmation entered into SPRS. Plans of action and milestones are not permitted for Level 1. That means a team cannot simply list missing practices and call the assessment complete.

At Level 2 self-assessment, the Department points to the 110 requirements in NIST SP 800-171 Revision 2 associated with DFARS 252.204-7012. The current program materials describe a three-year assessment cycle, annual affirmation, SPRS submission, and limited POA&M treatment under the applicable rules. The details matter: not every missing practice is eligible for deferral, and conditional status is time-bound.

Do not generalize these statements to every organization. Some companies do not handle federal contract information or CUI for a given engagement. Others have multiple enclaves with different information flows. The contract, data classification, and system boundary decide the workload—not the company’s marketing category.

A contract review should begin with the award and its incorporated clauses. For defense work involving covered contractor information systems, DFARS 252.204-7012 addresses safeguarding covered defense information and reporting cyber incidents. Related clauses may require assessments, SPRS scores, or CMMC status. The presence, date, and wording of each clause should be recorded at contract level.

The review should answer five questions:

This is more useful than asking whether “the company is CMMC compliant.” Compliance is not a permanent product attribute. It is a claim tied to requirements, scope, date, evidence, and operating facts. A new SaaS integration, acquisition, office, identity provider, remote-support path, or backup service can change the boundary without changing the logo on the network diagram.

The pause creates a temptation to postpone documentation work. That may save hours this month and create a much larger recovery job later. Security evidence ages. Screenshots stop matching interfaces. People leave. Service configurations change. Tickets close without preserving the reason for an exception. A system security plan becomes fiction one small drift at a time.

Continue collecting evidence at the cadence the control requires. Examples include access reviews, incident exercises, vulnerability remediation, backup tests, media handling, privileged-account changes, configuration baselines, security training, and supplier reviews. The goal is not a giant folder of screenshots. The goal is a traceable record that connects a requirement to an owner, a technical or procedural implementation, and proof that the implementation operated during the period claimed.

Good evidence is specific enough that another qualified person can follow it. A policy saying “the company reviews accounts” is not the same as a dated review showing the population, reviewer, exceptions, decision, and closure. A firewall invoice is not boundary-protection evidence. A FIPS statement in a brochure is not proof that the exact validated module is deployed and operating in its approved mode.

If the program is revised, disciplined records will be reusable. If the timeline returns quickly, they will shorten preparation. If a customer, contracting officer, or investigator asks about a prior assertion, they will help explain what the organization knew and did at the time.

Cybersecurity representations carry risk because the government can rely on them in award and payment decisions. The appropriate response is not alarmism; it is controlled review.

Before an authorized official submits an affirmation, score, or proposal statement, the security owner and contract owner should confirm the assessment date, boundary, applicable requirements, unresolved deficiencies, and supporting record. If a score is in SPRS, maintain the calculation materials and note which assessment method was used. If a remediation item closed, retain evidence of the changed implementation and validation. If scope changed, determine whether the old result is still a fair description.

Avoid absolute marketing language such as “fully CMMC certified” when the actual state is a Phase I self-assessment for one enclave. Use the program’s defined status and include the scope and date. Precision protects the buyer as well as the contractor.

CMMC does not publish a universal approved-hardware list. Buyers should translate security requirements into capabilities and evidence for the specific architecture. A device can help implement a control, but the purchase order cannot complete the practice by itself.

For endpoints, evaluate supported operating systems, secure boot, device encryption, centralized management, patching, logging, identity integration, and the ability to disable or wipe lost equipment. For network infrastructure, confirm segmentation, authenticated administration, configuration backup, logging, supported firmware, and the intended boundary design. For storage and backup, document encryption, access separation, recovery testing, retention, and disposal. For authentication, map the method to the access scenario and replay-resistance requirement rather than buying a security key solely because the package says “FIDO.”

Procurement evidence should identify the manufacturer, exact model or service, configuration, firmware or software version when material, country-of-origin claims when required, validation certificate when required, support term, and approved substitute process. If a reseller proposes an alternate, security should review whether it preserves the needed capability before the substitution is accepted.

For a fuller translation of controls into buying questions, use CMMC hardware requirements. For authentication-specific decisions, see CMMC MFA and security keys.

When CMMC language appears in a solicitation issued around the suspension, ask a narrow written question. Identify the provision, state the apparent conflict with the current phase status, and request the agency’s interpretation or amendment. Do not ask a supplier to guess what the agency intended.

Proposal teams should preserve the question, response, amendments, and final representation. Subcontract flow-downs deserve the same review. A prime contractor’s internal deadline is not automatically a government requirement, but it can still become a valid subcontract condition if written into the agreement. Separate the legal source from the commercial decision.

When evaluating a supplier, request evidence proportional to the service and information involved. A supplier that never touches FCI or CUI should not receive a generic 110-control questionnaire by reflex. A managed service provider with privileged access to the enclave needs much deeper examination. Scope first, then evidence.

The Department announced a review, so dates and mechanics may change. Monitor primary sources rather than social summaries:

Set a recurring review with a recorded “checked on” date. When an update appears, compare the exact text with the prior version and identify which contracts, system boundaries, assessments, and planned purchases it affects. A headline is not an implementation plan.

Maintain a short, controlled log for program interpretations. For each entry, record the official source, publication and retrieval dates, affected contract or enclave, question, decision, approver, and next review date. Link supporting correspondence rather than paraphrasing it from memory.

This helps when different customers issue different instructions. One contracting officer may clarify that a solicitation remains in Phase I, while a prime contractor maintains a stricter subcontract requirement. The organization can follow both without mislabeling the commercial condition as a government-wide rule.

The log should also show which remediation work continued and why. Tie each project to an existing clause, a real security risk, customer commitment, or readiness objective. That record protects useful work from being dismissed as “only for the old deadline” and makes future funding decisions easier to defend.