Cybersecurity Maturity Model Certification (CMMC 2.0), 32 CFR Part 170
CMMC Status
Published
Who this applies to
Any DoD contractor or subcontractor handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), at every tier of the supply chain.
What we know
The suspension covers implementation milestones. It does not withdraw the rule or change DFARS 252.204-7012. Level 1 and Level 2 self-assessments remain required and SPRS score submission continues.
The memo, signed by the Department of War CIO on July 10, 2026 and announced July 13, suspends the Level 2 (C3PAO) and Level 3 (DIBCAC) assessment requirements that Phase II would have made the default on November 10, 2026. Contracting officers were directed to amend active solicitations to remove those requirements and to modify existing contracts before the next option period or scheduled administrative modification.
A CMMC Reform Task Force is running a 60-day review of the program. A Request for Information on reducing compliance burden closed on August 14, 2026. Existing Level 2 (C3PAO) certifications remain valid for three years and satisfy any award that calls for Level 1 (Self) or Level 2 assessments.
Primes are setting supplier timelines independently of the pause, and several have published requirements that did not move when the announcement landed.
What we don't know yet
No published date for when milestones resume, and no statement on whether the phase-in restarts from the beginning or picks up where it stopped.
No guidance on whether C3PAO assessments already scheduled for late 2026 will count toward a future requirement, or how assessors who invested in capacity are expected to hold it.
The task force has not said whether its recommendations will change the 32 CFR Part 170 rule itself or only the acquisition-side timing in 48 CFR. The task force has not said what replaces third-party verification if Phase II doesn't return in its current form.
What to do now
- Confirm your SPRS score is submitted and accurate.
- Ask your prime directly what their compliance timeline is now.
- Keep remediation moving against the 110 practices.
- Hold your C3PAO slot rather than cancelling it.
ISI's read
The pause changes the deadline pressure, not the underlying work. The contractors handling this well are treating the suspension as schedule relief and continuing to close gaps.
Our expert read is opinion, not fact.
Learn how to make the most of the pause.
Read moreStatus history
Every change ISI has logged for CMMC, newest first. Dates are when the event happened, not when it was recorded.
-
Comment period closes on the CMMC reform Request for Information
What changed
The Request for Information titled "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base" closed at noon Eastern on August 14, 2026. Responses went by email rather than through regulations.gov. The questions were aimed mainly at small and mid-sized businesses.
Why it matters
This was the only fixed deadline of the interim period and the one formal channel for contractors to shape what happens next with Phase II. Industry input now sits with the task force, whose report to the CIO is the next expected milestone.
Source: Department of War, SAM.gov notice Published agency guidance
-
Department of War suspends CMMC Phase II and all pending implementation milestones
Status set to Suspended
What changed
A memo signed by the Department of War CIO on July 10 and announced July 13 suspended the Level 2 (C3PAO) and Level 3 (DIBCAC) requirements set to become the default on November 10, 2026. Contracting officers were told to strip those requirements from active solicitations and existing contracts. A CMMC Reform Task Force began a 60-day review.
Why it matters
Third-party certification is no longer a near-term award condition, but nothing else moved. Level 1 and Level 2 self-assessments, SPRS submission, DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 all remain binding. Primes may keep their own C3PAO requirements, and self-attestation now carries the full weight of verification.
Source: Department of War DoD or DoW memo
-
CMMC Phase 1 takes effect. Self-assessments start appearing in DoD solicitations
Status set to In effect
What changed
The 48 CFR final rule (DFARS Case 2019-D041) took effect on November 10, 2025, opening Phase 1 of the CMMC 2.0 rollout. Contracting officers could begin requiring Level 1 (Self) and Level 2 (Self) assessments as a condition of award. Phase 2, adding Level 2 (C3PAO) third-party assessments, was scheduled for November 10, 2026.
Why it matters
For the first time, a CMMC level became an award condition rather than a future promise. Contractors handling FCI or CUI needed a current self-assessment score in SPRS and an annual affirmation from a senior official to remain eligible for new awards and option years.
Source: Federal Register, 48 CFR final rule (DFARS Case 2019-D041) Federal Register
-
Cyber AB officially launches Level 2 (C3PAO) assessments.
What changed
In response to the final CMMC programmatic rule’s publication, the Cyber AB published a “Notice to the CMMC Ecosystem” to inform them that eligible C3PAOs could begin conducting CMMC Level 2 (C3PAO) assessments on January 2, 2025. This was a significant milestone in activating the CMMC ecosystem.
Source: Cyber AB, Notice to the CMMC Ecosystem Published agency guidance
-
CMMC 2.0 programmatic rule goes into effect.
What changed
This rule officially activated the CMMC 2.0 ecosystem, providing a final scoring methodology, established C3PAOs as the third-party assessing OSCs, and validated the three-year phased rollout of the CMMC 2.0 program. However, the requirement for Contracting Officers to include CMMC in DoW solicitations would come in a different rulemaking process.
Source: eCFR, 32 CFR Part 170 Federal Register
Questions contractors are asking
Is CMMC still required in 2026?
Yes. The July 13, 2026, suspension paused the third-party assessment milestones, not the program. Level 1 and Level 2 self-assessments still appear in DoD solicitations, SPRS scores still have to be current, and DFARS 252.204-7012 still requires NIST SP 800-171 controls for anyone handling CUI.
What exactly did the Department of War suspend?
The implementation of the Phase 2 and Phase 3 milestones, which would have focused on including Level 2 (C3PAO) and Level 3 (DIBCAC) for eligible contracts. Contracting officers were directed to remove those requirements from active solicitations and existing contracts. Self-assessment requirements, SPRS submission, and the underlying NIST SP 800-171 controls were not suspended.
Do I still need to submit an SPRS score?
Yes. The self-assessment and SPRS submission requirements under Phase 1 are unchanged, along with the annual affirmation from a senior company official. The paused element is third-party verification of that score, which means an inaccurate self-attestation now carries more risk, not less.
Should I cancel a C3PAO assessment I already have scheduled?
Not without checking your pipeline first. Existing Level 2 (C3PAO) certifications remain valid for three years and satisfy any Level 1 or Level 2 self-assessment requirement. Several primes still require certification regardless of the federal pause, and assessor capacity has not expanded, so a held slot is hard to replace and can serve you for several years if and when Phase II resumes.
Will my prime contractor still require CMMC Level 2 (C3PAO) certification?
Possibly. Primes set supply chain requirements independently, and can ask for more assurances. While it may not be a contractual obligation, third-party verification could be included in their supplier evaluations and requirements going forward. Our CMMC Prime Tracker compiles the latest published guidance from Lockheed Martin, Boeing, Raytheon, and others.
When will CMMC Phase II resume?
No date has been published. The CMMC Reform Task Force is expected to deliver its report to the Department of War CIO around September 11, 2026, with formal determinations expected in mid-October. Whether Phase II restarts on its original schedule, picks up where it stopped, or changes shape depends on those decisions.