CMMC Phase 2 Is Suspended: What Still Applies to Your Contracts

The suspension covers the phased implementation schedule that the CMMC program rule at 32 CFR Part 170 laid out and the DFARS acquisition rule operationalized. Phase 2 — scheduled to begin November 10, 2026, and the point at which CMMC Level 2 certification by a Certified Third-Party Assessment Organization (C3PAO) would have become a condition of award in applicable solicitations — is on hold. So are Phase 3 (2027) and Phase 4 (2028), along with the pending milestones attached to them.

The stated reason is a review. DoD stood up a CMMC Reform Task Force with roughly 60 days to report, and issued a request for information to collect industry input; the comment window runs to August 14, 2026, and a report is expected around mid-September 2026. No replacement dates have been announced, and the department has not described what the program looks like on the other side.

There is one operational consequence contractors will see immediately: contracts and solicitations already carrying Level 2 C3PAO or Level 3 requirements are to be modified to remove them. If you are mid-capture on a bid that named a C3PAO certificate, expect an amendment. If you are already under contract with one of those clauses, expect a modification — but confirm it in writing with your contracting officer rather than assuming it happened.

We are not going to speculate about what the task force recommends, and neither should anyone quoting you hardware. In July 2026 a prediction about Phase 2's return is a prediction, not a planning input.

Phase 1 has been in effect since November 10, 2025 — the effective date of the DFARS acquisition rule published September 10, 2025 under DFARS Case 2019-D041, which added clause 252.204-7021 and provision 252.204-7025. Under Phase 1, DoD may require a Level 1 or Level 2 self-assessment in new solicitations, with the result posted in the Supplier Performance Risk System and affirmed by a senior official. That requirement is unaffected by the July 13 suspension.

Level 1 applies to contractors handling Federal Contract Information only. It is 15 requirements drawn from FAR 52.204-21, self-assessed annually, affirmed in SPRS, and scored strictly MET or NOT MET — no Plan of Action and Milestones is permitted. If you have seen '17 practices' written somewhere, that is the 2021-era framing that stuck around on the open web; 32 CFR 170.15 says 15.

Level 2 applies to contractors handling Controlled Unclassified Information and is 110 requirements mapped one-to-one to NIST SP 800-171 Rev 2, assessed against 320 objectives. Whether a given contract calls for self-assessment or C3PAO certification depends on what the solicitation specifies. The scoring model is unchanged: you start at 110, the floor is -203, a score of 88 or better supports Conditional Level 2 status with a POA&M, 110 with no POA&M is a Final status, and Conditional status carries a 180-day closeout clock.

The revision you are assessed against did not move either. DoD Class Deviation 2024-O0013 pins the requirement to NIST SP 800-171 Rev 2. Rev 3 timing remains uncertain, and putting a date on it in a procurement plan would be inventing one.

CMMC is an assessment and verification layer. It is not the source of the underlying obligation. DFARS 252.204-7012 has required contractors handling covered defense information to implement NIST SP 800-171 and to report cyber incidents within 72 hours since 2017. Suspending phases of a verification program does not suspend a safeguarding clause sitting in contracts you have already signed.

That distinction matters more than usual right now, because the enforcement that has actually cost contractors money has not arrived through failed assessments. It has arrived through the False Claims Act — specifically, the theory that representing compliance you do not have is a false claim for payment. DOJ recovered more than $52 million across nine cybersecurity False Claims Act settlements in fiscal year 2025.

The settlements are not confined to primes. Raytheon agreed to pay $8.4 million to resolve allegations that it failed to meet cybersecurity requirements on DoD contracts. In June 2026, LOGZONE settled for $507,144. The dollar figures differ by two orders of magnitude; the exposure model does not. A senior official's affirmation in SPRS is a representation to the government, and it does not become less of one because the audit that would have checked it has been postponed.

Here is the practical translation. What DoD moved is the date on which someone else checks your work. What it did not move is the work. A boundary that is not segmented, a CUI share that is not encrypted with a validated module, an administrator account reachable with a password and a texted code — those are contract gaps today, under a clause in force since 2017, whether or not a C3PAO is ever scheduled.

A meaningful share of them are hardware gaps, and hardware gaps have lead times that paperwork does not. FIPS-validated cryptography where cryptography protects CUI (3.13.11), encryption of CUI at rest (3.13.16), boundary protection at every external interface (3.13.1), replay-resistant multifactor authentication for network and privileged access (3.5.3), media protection across removable devices (3.8.x) — each ends in a line item on a purchase order, and each takes longer to procure, stage and deploy than it takes to write the policy describing it.

To be explicit about what buying does and does not do: no purchase — hardware, license or service — confers certification on its own, and what a supplier can do is make the controls implementable. There is no CMMC-certified switch, drive or firewall, and a datasheet claiming otherwise is describing something that does not exist. What we quote is the capability behind the control — the equipment, the software licensing that runs on it and the integration work around both — never a Uniqcli certification, and we quote against the SSP you already have, not a generic bundle.