CMMC Phase 2 Is Paused. CMMC Level 2 Requirements Are Not.

Sep 4

4 min read

Updated September 4th, 2026 to reflect the September 3rd class deviation, the status of the CMMC Reform Task Force, and recent enforcement actions.

On July 13, the Department of War suspended CMMC Phase 2, the third-party (C3PAO) certification requirements that were set to become a condition of award on November 10, 2026. On September 3, that pause was written into acquisition policy through a formal class deviation, making it more durable than a memo alone.

That has created understandable confusion across the Defense Industrial Base, but one distinction is critical:

The pause applies to the timeline for Phase 2 C3PAO certification. It does not apply to the cybersecurity requirements for organizations handling Controlled Unclassified Information (CUI).

Since the announcement, many defense contractors have asked the same question: Does this mean CMMC Level 2 requirements have changed?

The answer is still no.

What Actually Changed?

The CMMC final rule established a phased schedule that determines when specific assessment requirements become mandatory in DoD contracts. The July 13 memo did not change the CMMC levels or the underlying security requirements. It suspended the Phase 2 transition and all later milestones while a CMMC Reform Task Force reviewed the program.

Phase	Original start date	Status today
Phase 1: Level 1 and Level 2 self-assessments	November 10, 2025	In effect, unchanged
Phase 2: Level 2 C3PAO certification	November 10, 2026	Suspended, new date TBD
Phase 3: Level 3 DIBCAC assessments	November 10, 2027	Suspended, new date TBD
Phase 4: Full implementation	November 10, 2028	Suspended, new date TBD

September 3: the pause moves into acquisition policy

On September 3, DoD signed Class Deviation 2026-O0025, Revision 3. It directs contracting officers to:

Accept CMMC Level 1 and Level 2 self-assessments in place of third-party certification.
Remove or revise third-party assessment requirements in active solicitations and existing contracts, generally at the next modification or option.

As Washington Technology reported, because the pause is now a class deviation rather than a memo, reversing it is a more involved process. But it is not permanent rulemaking either. DoD has not repealed the CMMC Program rule or amended the DFARS clauses, so the program framework remains in place (Smith Currie).

In other words, the implementation schedule changed. The security expectations did not.

What Did Not Change

DFARS 252.204-7012 still requires contractors handling CUI to safeguard it and implement NIST SP 800-171 Revision 2. CMMC is the verification mechanism, not the underlying obligation. As WilmerHale notes, the suspension does not affect the controls required by 7012, and all Phase 1 self-assessment requirements remain in place.

That means organizations handling Federal Contract Information (FCI) and CUI are still expected to:

Implement NIST SP 800-171 Rev. 2 security requirements where contractually required.
Complete required self-assessments and maintain a defensible System Security Plan (SSP).
Keep a current score in the Supplier Performance Risk System (SPRS) and accurate annual affirmations.
Protect CUI in accordance with existing contract requirements.

A contract can still require a self-assessment and a posted SPRS score before award, so your real deadline is set by your specific opportunities, not the rollout calendar. The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) can also still assess contractors at any time.

Self-Assessments Now Carry More Weight, Not Less

With third-party certification paused, the self-assessment and SPRS affirmation are the primary way DoD verifies compliance. Enforcement makes clear that accuracy matters:

June 2026: Logzone settled with the Justice Department for about $507,000 over a nearly perfect self-assessment score that a DoD audit found to be wildly inaccurate (Nextgov).
September 2026: Honeywell Aerospace agreed to pay about $2 million to resolve False Claims Act allegations that one of its networks did not meet NIST SP 800-171 requirements (Washington Times).

An inflated SPRS score or an affirmation you can't back up is now a larger legal risk than a missed certification date.

What Comes Next: The Reform Task Force

The 60-day review has ended, but its findings are not public yet. According to Covington, the Task Force met in early September to work through the more than 1,100 responses to its request for information. Its report was due to the DoW Chief Information Officer on September 11.

The report goes to CIO Kirsten Davies first, and she decides when to release the recommendations. At the Billington Cybersecurity Summit, Davies said her team is having people, not software, read every piece of feedback.

The Department has said the review is meant to evaluate how CMMC is implemented, not whether cybersecurity is necessary. Its stated goals are to make the program more effective, reduce unnecessary burden on industry, especially small businesses, and improve accessibility while keeping strong cybersecurity outcomes.

When the report lands, treat it as recommendations, not regulation. Binding changes would come through a DFARS rule change, a revised class deviation, or an amendment to 32 CFR Part 170.

What This Means for Defense Contractors

If you have already invested in CMMC readiness, that work remains valuable. It supports your current contractual obligations and positions you for Phase 2 once a revised timeline is announced. That work includes:

Identifying where CUI resides
Establishing a defensible CMMC scope
Implementing NIST SP 800-171 controls
Maintaining documentation and evidence
Preparing for future certification

Those obligations also include flowing the appropriate requirements down to subcontractors. Primes and subcontractors alike need visibility into the readiness of partners up and down the supply chain. See our full guide to CMMC flow-down requirements for who owes what, and to whom.

Organizations that pause their cybersecurity efforts because certification dates have shifted may find themselves less prepared, and more exposed, when implementation resumes.

The Bottom Line

The Department of War has paused the implementation timeline for Phase 2 C3PAO certification, and the September 3 class deviation has made that pause more durable. It has not paused the responsibility to protect CUI.

For defense contractors, the focus should stay the same:

Protect sensitive information.
Keep improving your cybersecurity posture.
Make sure your self-assessment, SSP and SPRS score are accurate and defensible.
Review each solicitation and contract modification for its specific requirements.
Watch for the Reform Task Force's recommendations, and treat them as signals until they become rules.

The implementation timeline may have changed. The need to protect CUI has not.

If you have questions about how these changes affect your organization, your SPRS score, your secure enclave, or your overall compliance strategy, we're here to help. Simply Contact Us.