What the CMMC Phase 2 Suspension Means

Last reviewed October 28, 2026. This update draws on the sourced status section of our CMMC & GCC Compliance page. We’ll update it when the CMMC review is published.

In short: third-party CMMC certification is on hold, but the security requirement isn’t.

Where CMMC stood before the suspension

CMMC is in effect. The program rule, 32 CFR Part 170, took effect December 16, 2024. The DFARS rule that puts CMMC into contracts took effect November 10, 2025 and started Phase 1: Level 1 and Level 2 self-assessments posted in SPRS, with an annual affirmation, when a solicitation or contract calls for them.

What was suspended

On July 13, 2026, the Department of War (also known as the Department of Defense) suspended Phase 2. Phase 2 would have started requiring third-party (C3PAO) Level 2 assessments on November 10, 2026. The Department also set up a CMMC Reform Task Force to review the program.

What still applies

• Phase 1 stays in place. When a contract calls for a CMMC Level 1 or Level 2 self-assessment, you post your results in SPRS and affirm them every year.
• DFARS 252.204-7012 still applies. It requires you to protect CUI with NIST SP 800-171, and the Department says it will enforce that standard through self-assessments and select government-led assessments.
• Self-assessments may be all the program requires for now. While Phase 2 is suspended, the DoD CIO says the program may only require self-assessments.
• Subcontractors are still covered. DFARS 252.204-7021 requires primes to flow the right CMMC level down to subcontractors and suppliers that handle FCI or CUI.

For how SPRS scores and the yearly affirmation work, read SPRS scores and the annual CMMC affirmation, explained.

Talk to us

We get your environment and your evidence ready for CMMC, and we keep it that way with Sierra Experts Managed Services, 24x7. See the full plan on our CMMC & GCC Compliance page, schedule a scoping call, or book a meeting.

Sources: 32 CFR Part 170, 89 FR 83092 · DFARS rule, 90 FR 43560 · Department of War release, July 13, 2026 · DoD CIO: About CMMC

This post is general guidance, not legal or compliance advice. Sierra Experts is not a C3PAO and does not certify CMMC compliance. Confirm your requirements with your compliance or legal advisors.