Regulatory update
CMMC Phase 2 Suspended Pending Programme Review
The US Department of War suspended CMMC Phase 2 third-party certification requirements on 13 July 2026. Self-assessments, DFARS 7012 and NIST SP 800-171 Rev. 2 obligations continue.
What happened?
On 13 July 2026 the US Department of War (the Department of Defense’s secondary title) announced that Phase 2 of CMMC implementation was suspended. Phase 2 had been scheduled to begin on 10 November 2026. From that date, many contracts involving Controlled Unclassified Information would have required a Level 2 certification assessment by an authorised third-party assessor (C3PAO) at award. Later phases were also paused, and a CMMC Reform Task Force was asked to complete a programme review within 60 days.
What still applies?
- Phase 1 self-assessments. Level 1 and Level 2 self-assessments, posting results in SPRS, and senior-official affirmations.
- DFARS 252.204-7012. Safeguarding covered defence information, reporting cyber incidents, and the cloud requirements.
- NIST SP 800-171 Rev. 2. The Department said it will continue to enforce these requirements through self-assessments and selected government-led assessments.
Why does it matter?
Contractors that were racing to book C3PAO assessments before November now have more time. Their self-attested positions, however, carry legal risk if they are inaccurate. The outcome of the review is unknown, and officials had not ruled out substantial changes to the programme.
What should you do?
Keep implementing and evidencing NIST SP 800-171. Make sure SPRS scores and system security plans are accurate and supportable. Check each contract’s clauses as modifications arrive. See our CMMC guide.
What to watch
- Publication of the task force's recommendations and any revised schedule or rulemaking.
- Contract modifications removing Phase 2 requirements from existing awards.
- Government-led assessments of self-assessed contractors during the pause.
Sources and official references
- Department of War Suspends CMMC Phase II Requirements — Office of Industrial Base Growth, US Department of War (official source)
- Cybersecurity Maturity Model Certification (CMMC) — Office of the DoD CIO (official source)
- Pentagon Suspends CMMC Phase 2 Requirements and Launches Review — WilmerHale (secondary commentary)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
