CMMC Phase 2 Suspended: What It Means for Your Self-Assessment

What was announced

The Department of War (the renamed Department of Defense) announced the immediate suspension of CMMC Phase II requirements, which were originally scheduled to take effect on November 10, 2026. The announcement also suspends pending and future CMMC implementation milestones across the Department's solicitations and contracts.

At the same time, the Department stood up a CMMC Reform Task Force to run a 60-day, top-to-bottom review of the program — informed by a public Request for Information (RFI) on compliance costs — with the stated goal of recommending more scalable, lower-burden security measures, especially for small and non-traditional businesses.

What Phase 2 actually was

CMMC was rolling out in four phases under 32 CFR 170.3(e). Phase 1 — in effect since November 10, 2025 — makes Level 1 and Level 2 self-assessments a condition of award. Phase 2 was the step that would have begun requiring Level 2 contracts involving CUI to obtain a third-party certification from a C3PAO — an independent assessment, not a self-assessment. That certification phase-in is what is now on hold.

In other words, what is suspended is the move to mandatory third-party certification — not the requirement to assess and protect your systems.

What still applies — the part that matters

The release is explicit that this does not relax your obligation to protect federal data. Three things remain in force:

• •Phase 1 self-assessments stay in place — Level 1 (FCI) and Level 2 (CUI) self-assessments, where applicable.
• •The interim enforced standard is NIST SP 800-171 Rev 2, verified through self-assessments and select government-led assessments.
• •DFARS 252.204-7012 still binds every contractor and subcontractor to safeguard covered defense information — and DFARS 252.204-7019/7020 still require a current self-assessment score posted in SPRS as a condition of award.

What this doesn't change about your score

Because Rev 2 self-assessment is exactly what is still enforced, the scoring mechanics do not change. You still start from a baseline of 110 and subtract weighted points for each unimplemented requirement; 110 is a Final self-assessment, 88 to 109 is Conditional with a POA&M, and below 88 you cannot affirm. Your level determination is also unchanged: whether you handle CUI, and whether that CUI is in the DoD Organizational Index Grouping, still decides whether your minimum is a Level 2 self-assessment or Level 2 (C3PAO).

The practical upshot: keep going. A current SPRS score is still the number a contracting officer looks for.

What to watch over the next 60 days

This is a policy announcement plus a review, not a repeal. Expect the Reform Task Force to report back around mid-September 2026, and watch for whether the outcome is a revised, more scalable framework, a change in standard, or a formal rule or class-deviation action that writes the change into the FAR/DFARS. Until then, treat the phase-in dates beyond Phase 1 as suspended, and verify current status at dodcio.defense.gov/CMMC before making a contract decision.

What to do now

The lowest-risk move is to use the pause productively: complete or refresh a Level 1 or Level 2 self-assessment, post an accurate SPRS score, and close real gaps voluntarily. If Phase II returns in some form, you will be ahead; if it returns changed, a completed Rev 2 self-assessment is still the foundation everything else builds on.