CMMC Phase 2 is suspended. Your security obligations are not.
On 13 July 2026 the Department of War suspended the third-party assessment mandate and opened a 60-day review of the program. What changed, what did not, what the review can and cannot do, and what to do while it runs.
Key takeaways
- On 13 July 2026 the Department suspended CMMC Phase 2, the rollout of mandatory third-party assessments, and opened a 60-day program review.
- DFARS 252.204-7012, NIST SP 800-171 Revision 2, SPRS scores and annual affirmations are unchanged.
- With no independent assessor in front of your affirmation, the affirmation itself carries the legal weight.
- Nothing changes for you until a class deviation or a published rule follows the review.
What happened
In a memo signed 13 July 2026, the Department of War CIO suspended CMMC Phase 2: the requirement, scheduled to take effect 10 November 2026, that contractors handling CUI obtain a Level 2 certification from a C3PAO, along with the later phases and their milestones.
The stated reasoning was cost and capacity. Roughly 100,000 companies needed third-party assessments and about 100 authorized C3PAOs existed to conduct them, and the Department judged that the squeeze was pushing small businesses out of the industrial base. During the suspension, program managers may designate only Level 1 (Self) or Level 2 (Self) in solicitations, not Level 2 (C3PAO) or Level 3 (DIBCAC).
Alongside the suspension the Department stood up a CMMC Reform Task Force to review the program and report within 60 days, and published a Request for Information whose responses closed on 14 August 2026. The 60-day clock runs to mid-September 2026.
Suspended versus still in force
This is the distinction the headlines blur: the certification mechanism is paused; the security requirements are not.
Suspended
- The Level 2 C3PAO certification mandate scheduled for 10 November 2026
- Level 3 DIBCAC certification designations
- The Phase 3 and Phase 4 rollout milestones
- New CMMC certification requirements in solicitations
Still fully in force
- DFARS 252.204-7012 safeguarding and 72-hour incident reporting
- All 110 requirements of NIST SP 800-171 Revision 2 for CUI
- Level 1 and Level 2 self-assessments
- SPRS scores and annual senior-official affirmations
- Prime-to-subcontractor flow-down
- Government-led DIBCAC audits
Rev. 2, Rev. 3 and the class deviation
The interim guidance issued with the suspension confirmed NIST SP 800-171 Revision 2 as the active baseline for self-assessments, contract requirements and 7012 compliance, and told contractors plainly not to abandon their Revision 2 programs. That is consistent with the standing DoD class deviation that has kept contractors on Revision 2 since NIST published Revision 3.
Two developments sit alongside it. The Department has published its own values for Revision 3's organization-defined parameters, which is preparation for an eventual transition, not adoption. And the proposed FAR CUI rule for civilian agencies, whose comment period closed on 23 July 2026, points at Revision 3, so contractors with both civilian and defense work may eventually carry two baselines. For the defense side, our guide keeps the status and the requirement-by-requirement differences current.
Self-attestation shifts the risk to you
Under the C3PAO model an independent assessor validated your compliance before you certified it. Under self-assessment, your SPRS affirmation stands alone as a representation to the federal government, signed by a senior official of your company.
The Department of Justice's Civil Cyber-Fraud Initiative has used the False Claims Act against contractors whose cybersecurity attestations did not match reality, with settlements reaching into the millions and whistleblower provisions that reward employees who report gaps. The suspension did not lower that exposure. It removed the independent checkpoint that stood in front of it.
The practical takeaway
A self-assessment you can defend, with every determination linked to current evidence and every affirmation backed by a documented review, is now your primary legal protection. An affirmation without an evidence trail is a liability with your signature on it.
What to do now
-
Do not dismantle your compliance program
The requirements you were preparing for are still contract conditions. A reformed certification requirement could return within months, and rebuilding a paused program costs far more than maintaining one.
-
Treat your self-assessment like an audit record
Score all 110 requirements honestly, link evidence to every determination, keep the system security plan current, and track gaps in a POA&M with real milestones. This is the record that defends an affirmation.
-
Keep the SPRS score and affirmation current
They remain mandatory, and primes check them when they select subcontractors. An accurate, documented score is a competitive asset during the uncertainty.
-
Talk to your primes before changing course
Flow-down continues, and some primes keep requiring third-party certification contractually while the mandate is paused. Their expectations, not only the regulation, set your real requirements.
-
Watch for the deviation or the rule, not the commentary
The Task Force report will describe what the program might become. A recommendation is not a requirement. Your obligations change when a class deviation or a published rule changes them.
Questions people ask
Is CMMC going away?
Not yet, and probably not entirely. The July 2026 memo suspended Phase 2 and launched a review. The rule at 32 CFR Part 170 and the DFARS clauses were not rescinded, and self-assessment requirements remain in force. Most observers expect a reformed program rather than elimination.
Do I still have to comply with NIST 800-171?
Yes. DFARS 252.204-7012 remains binding, so implementing all 110 requirements of Revision 2 is still a contract condition for any contractor handling CUI. The suspension paused the certification mechanism, not the standard.
Which revision of NIST 800-171 applies?
Revision 2, held in force by a standing class deviation and confirmed by the interim guidance. Revision 3 is published, not adopted for defense contracts.
Do I still submit SPRS scores and affirmations?
Yes. Level 1 and Level 2 self-assessments, SPRS score submissions and annual affirmations remain mandatory, and flow-down to subcontractors continues.
Should I cancel a scheduled C3PAO assessment?
Not automatically. Voluntary assessments continue through the Cyber AB ecosystem, and a completed certification is strong evidence for primes and a hedge against the program returning in reformed shape. Check your assessment contract's deferral terms and talk to your primes first.
What happens after the review?
The Task Force reports to the CIO with findings and recommendations. Outcomes could range from a restructured phase schedule to a lighter assessment model to broader changes. Contractors who kept their programs running will be positioned for any of them.
Does self-attestation reduce my legal risk?
No. It arguably increases it, because no third party validates your claims before you sign them. Documented, evidence-backed self-assessments are now the primary protection.
Keep the proof, not just the plan.
Bedrock CMMC tracks every objective, links the evidence behind it, calculates the SPRS score and keeps the POA&M honest, in one package with a chain of custody an assessor can follow.