CMMC Phase 2 is suspended, and what still applies.

What is suspended

Two memoranda, both cleared for open publication on July 13, 2026, carry the suspension. The Department of War Chief Information Officer's memorandum says the November 2026 deadline to move to Phase 2 is suspended and that all pending and future CMMC implementation milestones across Department solicitations and contracts are held in abeyance until further notice. It says program managers and requiring activities "shall only include the need for CMMC Level 1 or Level 2 Self Assessments" in procurement requests and requirement documents, and that all other contractual cybersecurity clauses stay intact. ¹

The Under Secretary for Acquisition and Sustainment's memorandum turns that into instructions for contracting. During the suspension, program managers and requiring activities may not designate Level 2 (C3PAO) or Level 3 (DIBCAC), and the allowed designations are Level 1 (Self) or Level 2 (Self). If a requirements package for a live solicitation included Level 2 (C3PAO) or Level 3 (DIBCAC), the program office must send an amended requirements document to the contracting officer, and the contracting officer must issue the solicitation amendment as soon as practicable. For existing contracts, contracting officers are directed to remove those requirements by modification before the next option period is exercised or at the next scheduled administrative modification. The memorandum also suspends waiver procedures: no CMMC waivers are to be granted during the review. Further guidance is promised at the end of the CIO's 60-day review. ²

The Department's press release and the CIO's CMMC pages say the same thing in shorter form: Phase II is suspended, Phase I self-assessment requirements remain in place, and the program is "paused in Phase 1" and "may only require self-assessments at two levels." ^{3, 5}

DFARS Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, carries this into the contracting rules. It tells contracting officers to work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts in line with the July 13 memorandum. It supersedes Revision 2, issued July 16, 2026. ⁶

Can the Department still require a C3PAO on one contract?

Not through a program office, according to the Under Secretary's memorandum. It says program managers and requiring activities "may not designate" Level 2 (C3PAO) or Level 3 (DIBCAC) during the suspension, and the CIO memorandum limits them to self-assessments. ^{2, 1}

Law-firm commentary does not agree on this point. Holland & Knight's July 31 alert says the Department may still require a C3PAO assessment as a condition of award at its discretion under Phase I authority. That discretion is real in the rule text: 32 CFR 170.3(e)(1) says that in Phase 1 the Department may, at its discretion, require Level 2 (C3PAO) in place of Level 2 (Self), and the rule has not been amended. But neither memorandum says the discretion survives, and the Under Secretary's memorandum says program offices may not designate Level 2 (C3PAO). Crowell & Moring's alert notes the Department did not explicitly address the Phase 1 discretion in its announcement. The memorandum text is the primary source on this question, and the two readings conflict. If a solicitation or contract in front of you still names Level 2 (C3PAO), ask the contracting officer, because the memorandum directs removal. ^{14, 15, 8}

Two related points. First, the Department says it will keep enforcing NIST SP 800-171 Revision 2 through self-assessments and "select government-led assessments," so a Department assessment of your own system remains possible. Second, Holland & Knight reads the memorandum to mean that terms already in an existing contract bind you until the contracting officer issues a modification. The memorandum addresses Department program managers and requiring activities. It does not speak to requirements a prime contractor writes into its own subcontracts, so ask your prime in writing. ^{1, 14}

What did not change

DFARS 252.204-7012 stays in effect. It requires adequate security on covered contractor information systems, which for most contractors means NIST SP 800-171, and it requires you to report a cyber incident within 72 hours of discovery. Both memoranda say so. ^{11, 1}

Level 2 security requirements are identical to NIST SP 800-171 Revision 2, and 32 CFR 170.4 counts 110 of them. NIST's page shows Revision 2 as withdrawn on May 14, 2024 and superseded by Revision 3. The CMMC rule, the DFARS clause, and the July 2026 memoranda still name Revision 2. (32 CFR 170.4, NIST CSRC, CIO memorandum)

32 CFR part 170 is unchanged, and the CMMC clause DFARS 252.204-7021 is still in the DFARS. Its fill-in line still lists all four levels, and the July 13 memoranda control which of them a program office may pick. ^{8, 12}

The schedule on paper

32 CFR 170.3 sets four phases. Phase 1 begins on the effective date of the DFARS CMMC rule, which was November 10, 2025. In Phase 1 the Department intends to require Level 1 (Self) or Level 2 (Self) as a condition of award, and may instead require Level 2 (C3PAO). Phase 2 begins one calendar year later. The CMMC hub records that date in the section on how the phases were written in the rule. It would have added Level 2 (C3PAO) as a condition of award, with an option to delay that requirement to an option period, and Level 3 (DIBCAC) at the Department's discretion. Phase 3 follows a year after that, and Phase 4, full implementation, a year after Phase 3. ^{8, 10}

The DFARS rule (Federal Register document 2025-17359, effective November 10, 2025) has its own clock for the contract clause. For three years, the clause goes in a contract only when the program office decides the contractor needs a specific CMMC level. On and after November 10, 2028, it goes in whenever the contractor will process, store, or transmit federal contract information or CUI on its own systems. The September 3, 2026 class deviation repeats those two dates in its version of DFARS part 240. ^{10, 7}

Who the program covers

32 CFR 170.3 applies to DoD contract and subcontract awardees that will process, store, or transmit federal contract information or CUI on contractor information systems, and to the private-sector organizations in the assessment ecosystem. It does not apply to federal information systems that contractors operate on behalf of the Government. It reaches solicitations and contracts, including commercial items other than those exclusively for commercially available off-the-shelf items, valued above the micro-purchase threshold. The program manager or requiring activity picks the CMMC status from the type of information involved. ⁸

Self-assessment versus a C3PAO

Level 2 (Self) is your own assessment, scored under 32 CFR 170.24 and entered in the Supplier Performance Risk System. A conditional status is allowed only if the plan of action and milestones meets 32 CFR 170.21, and a final status needs a passing score. An affirmation goes into SPRS at the assessment and every year after that, and the assessment is repeated every three years. ⁹

Level 2 (C3PAO) is a certification assessment by a C3PAO on the Accreditation Body's list. The C3PAO submits results into the CMMC instance of eMASS, which transmits them to SPRS. The conditional and final pattern and the 180-day closeout are the same, and a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope. (32 CFR 170.17)

DFARS 252.204-7021 is the clause that makes you maintain the CMMC status the contracting officer names. In that clause a conditional Level 2 status stays current for 180 days, a final Level 2 status for 3 years, and the affirmation for 1 year. ¹²

What happens next

The CIO memorandum created the CMMC Reform Task Force for a 60-day review and says further guidance will come "in the coming months." Sixty days from July 13 ended on September 11. The Department has not published the Task Force's recommendations or a new date, and the CIO's CMMC pages still show the July 13 suspension as the current position. Until the Department publishes something, the memoranda and the solicitation in front of you decide what a given award requires. ^{1, 4, 5}

Sources checked October 16, 2026. Not legal advice.