CMMC Phase 2 was supposed to start on November 10, 2026. On that date, most defense contracts that involve Controlled Unclassified Information (CUI) would have required a third-party Level 2 certification. However, the Department of War paused CMMC Phase 2 on July 13, 2026, and the review is still open. This article explains what the pause changed, what it did not change, and what contractors in regulated industries should do now.
What the CMMC Phase 2 pause changed
The CMMC program rule (32 CFR Part 170) and the DFARS acquisition rule set a four-phase rollout. Phase 1 began on November 10, 2025, and it allowed self-assessments. Phase 2 was the step that made certified third-party assessments, performed by a C3PAO, a common condition of award for contracts with CUI.
On July 13, 2026, the DoW CIO suspended that transition and launched a 60-day program review. In addition, an implementing memo from acquisition leadership told program offices to amend active solicitations that called for Level 2 (C3PAO) or Level 3 (DIBCAC) assessments. Contracting officers were also told to remove those requirements from existing contracts at the next option period or the next scheduled administrative modification. Then, on September 3, 2026, Revision 3 of Class Deviation 2026-O0025 carried that direction into contract instructions.
As of this writing, DoD has not published the review results or a new Phase 2 date. In short, the November 10 deadline is paused, not replaced.
What CMMC Phase 2 did not change
The pause removed a certification gate. It did not remove the security obligations behind it. According to the implementing memo, the following still apply:
- DFARS 252.204-7012, which requires contractors to safeguard covered defense information and report cyber incidents to DoD within 72 hours.
- Baseline compliance with NIST SP 800-171 Revision 2, which defines 110 security requirements for systems that handle CUI.
- CMMC Level 1 (Self) and Level 2 (Self) assessments, which program offices may still require in solicitations.
- Select government-led assessments, along with annual affirmations where the contract calls for them.
There is also a legal point that many teams overlook. A self-assessment score and an annual affirmation are statements to the government. If they are inaccurate, the company can face False Claims Act exposure, which the Department of Justice has pursued through its Civil Cyber-Fraud Initiative since 2021. Consequently, the pause shifts more weight onto the accuracy of your own scores.
Who should still treat CMMC Phase 2 as a planning date
Several groups should keep working as if CMMC Phase 2 will return. For example, primes are still asking suppliers about their CMMC status, and many flow-down clauses remain in place. Similarly, regulated organizations outside defense see the same controls in other frameworks. Banks map them to FFIEC expectations, health plans to the HIPAA Security Rule, and state agencies to their own security standards.
| Your situation | Recommended posture |
|---|---|
| Prime or subcontractor with CUI today | Keep NIST SP 800-171 work on schedule and keep your SPRS score current and defensible. |
| Already booked a C3PAO assessment | Keep the slot if you are ready. Certification remains available, and it may become a competitive advantage. |
| Planning to bid on DoD work in 2027 | Scope your CUI enclave now. Readiness takes months, not weeks. |
| Commercial firm in finance, healthcare, or government | Reuse the same control set to answer customer and regulator questions. |
A 30-day CMMC Phase 2 action plan for regulated contractors
First, confirm what each contract actually requires. Ask your contracting officer or prime whether a modification has removed or changed the CMMC clause. Do not assume the change has already reached your contract.
Next, revalidate your SPRS score before CMMC Phase 2 returns. Walk through all 110 requirements with the people who run the systems, not only the compliance team. Then update the System Security Plan (SSP) and the plan of action and milestones so both match reality.
After that, tighten identity and access. Most failed controls trace back to accounts, privileges, and multifactor authentication. Therefore, single sign-on, automated provisioning, and regular access reviews are quick wins. If you run Jira or Confluence, the same applies to your Atlassian organization; our guide to Atlassian Guard with Okta shows one way to do it.
Also, look at your delivery pipeline. CUI often leaks into tickets, wikis, build logs, and test data. A DevSecOps review can find where sensitive data flows, and it can add automated checks before code ships. For software suppliers, the CISA 2026 SBOM minimum elements belong in the same plan.
Finally, prepare for incidents, because they matter with or without CMMC Phase 2. Test the 72-hour reporting path with a tabletop exercise, and make sure someone owns the DoD report.
What to watch next
Three signals will shape CMMC Phase 2 over the next six months. The first is the CMMC Reform Task Force report and any new Phase 2 date. The second is whether DoD moves the CMMC rule from NIST SP 800-171 Revision 2 to Revision 3, which NIST published in May 2024. The third is how quickly contracting officers modify existing contracts. Until those signals arrive, the safest plan is to stay ready for certification.
Frequently asked questions
Is CMMC Phase 2 canceled?
No. The July 13, 2026 memo suspended the Phase 2 transition during a program review. Further guidance is expected when the review concludes, but no new date has been announced.
Do I still need to meet NIST SP 800-171?
Yes. DFARS 252.204-7012 and baseline compliance with NIST SP 800-171 Revision 2 remain in effect. Self-assessments and SPRS scores still matter for contract eligibility.
Should we cancel our C3PAO assessment?
Not necessarily. Certification remains available. If your controls are ready, a certificate shows primes that your program is real. If you are not ready, use the time to close gaps first.
How VTPMO can help
VTPMO supports regulated organizations, including the Federal Reserve Banks, Wells Fargo, and Indiana FSSA. Our team runs readiness reviews, identity and access cleanups, and DevSecOps improvements for teams that handle sensitive data. Learn more about our DevSecOps services, our work with government organizations, and our Atlassian platform services. You can also talk with us about a 30-day readiness review.