CMMC Phase II Is Suspended — But Phase I Is Not: The Complete Defense Contractor Action Plan for What Comes Next

Published August 28, 2026 | TIKC NewsWire

On July 13, 2026, the Department of Defense made an announcement that sent shockwaves through the Defense Industrial Base: the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect November 10, 2026. The Department’s Chief Information Officer cited a critical assessment bottleneck — more than 100,000 companies needing assessment against roughly 100 authorized C3PAOs — as structurally incompatible with the need to rapidly expand the DIB. The SBA put a number on the burden: total compliance costs can reach approximately $593,800 per CMMC certification for small firms requiring third-party assessment, and about $388,600 for firms eligible for self-assessment. If implemented on its planned launch date, CMMC Phase II would have required more than 120,000 DIB small businesses to seek compliance through a cost-prohibitive system.

What the Suspension Actually Suspends

CMMC Level 2 C3PAO and Level 3 DIBCAC third-party assessment requirements are suspended, and active solicitations and contracts must be amended to remove those designations during the suspension period. The CMMC program rule itself has not been repealed, and the DFARS has not been amended — this is a policy pause, not a regulatory change.

What the Suspension Does NOT Suspend

Phase I self-assessments remain mandatory and fully enforceable. Defense contractors must continue implementing NIST SP 800-171 Revision 2 and maintaining accurate scores in the Supplier Performance Risk System (SPRS) or risk losing contract eligibility.

Core cybersecurity obligations remain enforceable: DFARS 252.204-7012, NIST SP 800-171 Rev. 2 compliance, cloud security requirements, and cyber incident reporting duties are all still in effect.

The Reform Task Force and Mid-September Report

A CMMC Reform Task Force has been created to review the program and will report back in mid-September. DoD officials declined to rule out ending the program entirely, and the Cyber AB was not told before the announcement.

What You Must Do Right Now — The Action Plan

Do not stop your NIST SP 800-171 implementation. DFARS 252.204-7012 is unchanged.

Audit your SPRS score for accuracy — immediately. Your SPRS score is a legal certification. An inaccurate score exposes your organization to False Claims Act liability.

Do not cancel your System Security Plan or POAM. Your SSP and POAM are compliance infrastructure that prime contractors, contracting officers, and eventually assessors will review.

Watch the mid-September Task Force report. Companies preparing for CMMC should watch that process closely.

The Bottom Line

CMMC Phase II is suspended. CMMC Phase I — the self-assessment requirement, DFARS 252.204-7012, NIST SP 800-171, and SPRS scoring — is not. Audit your SPRS score. Maintain your SSP and POAM. Watch mid-September. Brick by brick — the requirement to protect defense information has not changed. Only the certification mechanism is under review.

Frequently Asked Questions

What exactly did DoD suspend on July 13?

DoD suspended CMMC Level 2 third-party assessment (C3PAO) and Level 3 DIBCAC assessment requirements, along with all Phase III, IV, and future implementation milestones. It is a policy pause pending the CMMC Reform Task Force report due in mid-September 2026.

Do I still need to maintain my SPRS score?

Yes — absolutely. SPRS scoring is a Phase I self-assessment requirement that was not suspended. Your SPRS score is a legal certification of your NIST SP 800-171 compliance posture. An inaccurate score creates False Claims Act exposure regardless of Phase II suspension status.

Should I cancel my C3PAO assessment?

The third-party assessment requirement has been suspended, so there is no current legal mandate to obtain a C3PAO assessment. However, continuing your NIST SP 800-171 implementation and SSP/POAM maintenance is still required. Consult with GovCon counsel before canceling scheduled assessments.

References

A-LIGN. (2026, July). What the CMMC Phase II Suspension Means for Defense Contractors. https://www.a-lign.com/articles/cmmc-phase-ii-suspension

Washington Technology. (2026, July 13). DOD suspends CMMC Phase 2, launches 60-day ‘reform’ review. https://www.washingtontechnology.com/contracts/2026/07/dod-suspends-cmmc-phase-2-launches-60-day-reform-review/414739/