CMMC Phase 2 Is on Hold, So What Still Applies to Defense Contractors
CMMC Phase 2 was scheduled to start on November 10, 2026. The Department of War suspended it in July, and the review that followed has not produced a published decision. The pause stopped one change. It did not remove the cybersecurity requirements defense contractors already carry.
Quick Answer
Phase 2, the step that would have made a C3PAO assessment the default condition of award for most CUI contracts, is suspended. DFARS 252.204-7012, the 110 requirements in NIST SP 800-171 Rev 2, your SPRS score, Phase 1 self-assessments with annual affirmations, and prime contractor flowdown all still apply. False Claims Act enforcement also continues.
What Did the Department of War Suspend?
On July 13, 2026, the Department of War suspended the move to CMMC Phase 2, held the Phase 3 and Phase 4 milestones, and created a CMMC Reform Task Force to review the program (Department of War release). Phase 2 would have made a Level 2 assessment by a Certified Third-Party Assessment Organization (C3PAO) the default for most contracts involving Controlled Unclassified Information (CUI).
In September, Class Deviation 2026-O0025 Revision 3 carried the pause into contract language. Contracting officers now accept Level 1 and Level 2 self-assessments and remove third-party assessment requirements at the next option or modification.
| Paused during the review | Still in force |
|---|---|
| The Phase 2 transition that was set for November 10, 2026 | NIST SP 800-171 Rev 2 compliance |
| Level 2 (C3PAO) and Level 3 (DIBCAC) requirements in solicitations | CMMC Level 1 and Level 2 self-assessments |
| C3PAO and DIBCAC language in active contracts, removed at the next option or modification | SPRS score checks before award and an annual affirmation by a senior official |
| Phase 3 and Phase 4 milestones | DFARS 252.204-7012 safeguarding and incident reporting |
| False Claims Act exposure and prime contractor flowdown |
Which Requirements Still Apply?
Most of what a CMMC Level 2 assessment would have checked is already required by DFARS clauses in current contracts. The suspension changed who verifies the work, not whether the work is expected.
| Requirement | What it asks of you |
|---|---|
| DFARS 252.204-7012 | Protect covered defense information using NIST SP 800-171, report cyber incidents to DoD within 72 hours, keep images of affected systems for 90 days, and flow the clause down to subcontractors. |
| NIST SP 800-171 Rev 2 | Implement the 110 security requirements. Rev 2 is the version in force. Rev 3 is under discussion and has not been adopted for DoD contracts. |
| DFARS 252.204-7019 and 252.204-7020 | Keep a NIST SP 800-171 DoD Assessment score in SPRS that is no more than three years old, and give DoD access if it requests a Medium or High assessment. |
| DFARS 252.204-7021 (Phase 1) | Complete the Level 1 or Level 2 self-assessment a contract calls for, post the result in SPRS, and have a senior official affirm compliance every year. |
| Prime contractor flowdown | Meet the requirements in your subcontract, which can go further than the current DoD minimum. |
What Has Happened Since the Suspension?
Here is the record from July through October 2026, drawn from public reporting (Secureframe CMMC news log).
| Date | What happened |
|---|---|
| Jul 13, 2026 | The Department of War suspends Phase 2 and later milestones and forms the CMMC Reform Task Force. |
| Sep 1, 2026 | Honeywell Aerospace agrees to pay $2,042,518 to settle a False Claims Act case over NIST SP 800-171 gaps on a DoD contract. |
| Sep 3, 2026 | Class Deviation 2026-O0025 Revision 3 writes the pause into DFARS and FAR contract text. |
| Sep 11, 2026 | The 60-day review period closes. The Task Force report has not been published. |
| Oct 1, 2026 | A Redspin survey finds 78.2% of respondents still working toward Level 2 certification or already certified. |
| Oct 27, 2026 | Federal News Network reports on an internal summary of reform options, including a narrower Phase 2 restart within about 90 days and a move to NIST SP 800-171 Rev 3. DoD has not announced a decision. |
Why Does the False Claims Act Still Matter?
The Honeywell settlement shows that enforcement does not depend on Phase 2. The case covered a single network on a DoD contract from April 2020 to December 2023, and it started with a former employee’s whistleblower suit. The whistleblower receives $375,823 of the settlement.
Every annual affirmation in SPRS is a statement that your controls are in place. If the affirmation and the environment do not match, the exposure exists whether or not a C3PAO ever visits.
What Might Your Prime Still Expect?
Primes set their own supplier requirements, and many have not changed them. In July, Elbit America told suppliers to keep meeting existing cybersecurity requirements and to confirm with their buyer before scheduling or cancelling a C3PAO assessment. L3Harris Missile Solutions kept a July 30 deadline for proof of Level 2 certification that it had set in April.
Redspin’s October survey found that 23.3% of primes were relaxing Phase 2 expectations for suppliers, 39.5% were still deciding, and 76.6% of subcontractors had heard nothing from their primes about the pause. If your prime has not told you where it stands, ask in writing.
What Should Defense Contractors Do Now?
- Check your SPRS score. Confirm it is less than three years old and still matches your environment. Update it before your next bid if anything has changed.
- Keep your SSP and POA&M current. Your System Security Plan should describe the environment as it runs today, and open POA&M items should have owners and dates.
- Test incident reporting. Confirm who files a DIBNet report, that a medium assurance certificate is in hand, and that your team can report within 72 hours.
- Ask your primes in writing. Find out whether each prime still expects Level 2 certification, and by when.
- Keep improving the controls that protect operations. Multifactor authentication, continuous monitoring, and tested backups reduce real risk no matter how the assessment rules change.
Status as of November 9, 2026. The Department of War has not published the Task Force report or a decision on restarting Phase 2. We will update this post when that changes.
SSP, POA&M and SPRS ExplainedHow the three documents fit together and what DoD expects in each.
Frequently Asked Questions
Is CMMC cancelled?
Do I still need an SPRS score?
Can a contract still require a C3PAO assessment?
Is NIST SP 800-171 Rev 3 required now?
Should we keep preparing for Level 2 certification?
Want your program ready for whatever CMMC becomes?
Sentinel Blue’s Shield program combines managed IT, managed GRC, and managed security operations to keep NIST SP 800-171 controls, SPRS scores, and incident response in place.
