CMMC Phase 2 suspended: what still applies
The Department of War suspended CMMC Phase 2 on July 13, 2026. Phase 1 self-assessments, DFARS 7012, and SPRS obligations remain in force.
On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase 2 requirements, which had been scheduled to take effect on November 10, 2026. Pending and future implementation milestones were held in abeyance at the same time, and the Department opened a 60-day review of the program.
What was suspended
Phase 2 would have made Level 2 certification by a Certified Third-Party Assessment Organization a condition of contract award. During the suspension, contracting officers may include only Level 1 (Self) or Level 2 (Self) assessment requirements.
What was not suspended
This is the part that matters for planning:
- Phase 1 self-assessment requirements, in force since November 2025, remain in force.
- DFARS 252.204-7012 safeguarding obligations are unchanged.
- NIST SP 800-171 Revision 2 remains the contractual baseline for protecting CUI.
- SPRS score submission and annual affirmations continue.
- False Claims Act exposure for misrepresenting compliance is unaffected.
What we would do about it
Treat this as the removal of a deadline, not the removal of an obligation. The security requirements in your contracts did not change on July 13. If your organization was working toward Level 2 readiness, the work still needs doing. It simply lost its forcing function.
The practical risk is stopping. If the review restores a deadline, organizations that paused will restart from a standing stop and compete for assessor capacity against everyone else who also paused. The capacity shortage was one of the stated reasons for the suspension in the first place.
We are not predicting the outcome of the review. Officials declined to rule out deeper restructuring, and anyone telling you confidently what September brings is guessing.