CMMC Phase 2 Is Suspended: Only Level 1 and Level 2 Self-Assessments May Be Required

Key takeaways

On July 13, 2026, the Department suspended advancement to CMMC Phase 2. An official release that day said Phase 2 had been scheduled to take effect on November 10, 2026.
Implementing memo 26-P-1023 allows a solicitation or contract to require only Level 1 (Self) or Level 2 (Self). It may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) while the review is underway.
Contracting officers must amend active solicitations and must modify existing contracts before the next option period or the next administrative modification. The memo states that waivers are not available during the review.
NIST SP 800-171 Revision 2 requirements under DFARS 252.204-7012 remain in effect and are to be enforced through self-assessments and selected government-led assessments.
The published DFARS text at 204.7504, effective May 7, 2026, still sets later dates for use of clause 252.204-7021, including November 10, 2028 for contractor systems that will process, store, or transmit FCI or CUI (with a COTS exception). The official sources opened for this report do not show that text as superseded.

Findings

On July 13, 2026, Under Secretary of War for Acquisition and Sustainment Michael P. Duffey signed memorandum 26-P-1023, “Implementing the [CIO] Suspension of Advancement to CMMC Phase 2,” cleared the same day. The memo implements the Department of War Chief Information Officer’s decision to suspend advancement to Phase 2 and attaches implementing instructions.

Attachment 1 limits what a contracting officer may require during the review. A solicitation or contract may designate only CMMC Level 1 (Self) or Level 2 (Self). It may not designate Level 2 (C3PAO) or Level 3 (DIBCAC). Active solicitations must be amended to conform. Existing contracts must be modified before the next option period or the next administrative modification, whichever occurs first. The memo states that waivers of these instructions are not available during the review. It directs continued enforcement of NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments, and it states that DFARS 252.204-7012 remains in effect. Further implementation guidance is to follow the 60-day review.

An official Department release dated July 13, 2026 — opened from the Internet Archive capture of the official URL — states that CMMC Phase II had been scheduled to take effect on November 10, 2026, and that Phase I self-assessments remain in effect. The release announces a 60-day study and quotes Chief Information Officer Kirsten A. Davies. It says a CMMC Reform Task Force will deliver a final report to the DoW CIO within 60 days. This report does not treat a later delivery or publication of that task-force report as confirmed, because no official document opened for this briefing establishes those later facts.

The CMMC contractual framework itself remains in the DFARS. DoD issued a final DFARS rule, published at 90 FR 43560 on September 10, 2025 and effective November 10, 2025, to incorporate contractual requirements related to the CMMC program rule. The program rule at 32 CFR part 170 was published on October 15, 2024 (89 FR 83092) and became effective December 16, 2024. Those rules created the phased certification structure that the July 13, 2026 memo now pauses at Phase 2.

Separately, the current DFARS text at 204.7504, as published on Acquisition.gov with Change 5/7/2026 and effective May 7, 2026, still tells contracting officers when to use clause 252.204-7021. Until November 9, 2028, the clause is used if a specific CMMC level is required. On or after November 10, 2028, the clause is used if contractor information systems will process, store, or transmit federal contract information or controlled unclassified information, except for commercially available off-the-shelf items. This report cites that official text as it stands. It does not treat later unofficial claims about a class-deviation revision as established.

GAO report GAO-26-107955, opened from the official PDF via an archived copy of the gao.gov URL, evaluated CMMC implementation planning. GAO found that, as of September 2025, DoD’s implementation plans addressed six of seven key elements of a comprehensive strategy, but that DoD had not systematically assessed and documented external factors that could affect the program, including the risk that private-sector capacity to conduct assessments would be insufficient. GAO recommended that DoD document those factors and develop approaches to address them. DoD concurred. The report does not, in the text opened, establish a count of certified companies.

What it means for contractors

Bid strategy

For solicitations issued or amended under the memo, offerors should expect a CMMC requirement, if any, to be Level 1 (Self) or Level 2 (Self) only. Pricing, teaming, or proposal language that assumes a designated Level 2 (C3PAO) or Level 3 (DIBCAC) assessment as a condition of award is inconsistent with the implementing instructions now in effect. DFARS 252.204-7012 and NIST SP 800-171 Revision 2 still apply, so a proposal still has to show how the offeror will protect CUI and related covered defense information under those existing obligations.

Compliance cost

The memo removes, for now, the ability of a contracting officer to designate a third-party or DIBCAC assessment as the required CMMC level. That changes near-term assessment-scoping and certification spend. It does not pause the cost of maintaining a Revision 2 self-assessment posture, affirming compliance, and meeting 252.204-7012 incident-reporting and flow-down duties. Companies that already invested in a C3PAO assessment are not directed by the memo to discard that work; the memo simply provides that such a level may not be designated as a contract requirement during the review.

Execution

Contractors with active solicitations should watch for amendments that strip C3PAO or Level 3 designations and substitute self-assessment levels. Holders of existing contracts should expect a modification before the next option or the next administrative modification. The memo states that waivers are not available during the review, so contractors should not plan on a waiver path to keep a Phase 2 designation in place. The November 2028 DFARS 204.7504 dates remain in the published regulation and should be tracked until official text changes them.

Watch next

November 9, 2028 and November 10, 2028: dates in the opened DFARS 204.7504 text for the later application of clause 252.204-7021.

The July 13 memo said further guidance would follow a 60-day review. The official sources opened for this report do not announce a date for that follow-on guidance or confirm delivery or publication of the task-force report.

Sources

Department of War / Department of Defense, Memorandum 26-P-1023, “Implementing the [CIO] Suspension of Advancement to CMMC Phase 2,” signed by Michael P. Duffey, July 13, 2026. Official URL: dodcio.defense.gov (PDF). Opened via the Internet Archive capture of that official URL, October 18, 2026 capture.
Department official release on the CMMC Phase II suspension and 60-day study, July 13, 2026, quoting CIO Kirsten A. Davies and directing a CMMC Reform Task Force report to the DoW CIO within 60 days. Opened via the Internet Archive capture of the official URL.
DFARS 204.7504, Acquisition.gov, Change 5/7/2026, effective May 7, 2026. acquisition.gov/dfars/204.7504.
Defense Federal Acquisition Regulation Supplement; Assessing Contractor Implementation of Cybersecurity Requirements (CMMC), final rule, 90 FR 43560, September 10, 2025, effective November 10, 2025 (FR Doc. 2025-17359).
Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, final rule, 89 FR 83092, October 15, 2024, effective December 16, 2024 (FR Doc. 2024-22905).
U.S. Government Accountability Office, Defense Contractor Cybersecurity: DOD Should Address External Factors That Could Impede Program Implementation, GAO-26-107955, PDF dated March 2026 (findings as of September 2025). Official URL: gao.gov/assets/gao-26-107955.pdf. Opened via the Internet Archive capture of that official URL.

← Back to Cyber & Compliance