In July 2026, the Department of War (DoW) suspended the transition to CMMC Phase 2 — the step that would have made third-party certification (C3PAO assessment) the default path for most Level 2 contracts starting November 10, 2026. A 60-day CMMC Reform Task Force review followed. As of this writing, that review has closed, a report hasn't been publicly released yet, and the pause remains in effect.

If you're a defense contractor or subcontractor, that's created a lot of noise and not much clarity. Here's where things actually stand.

Why the pause happened

The stated reason was cost and administrative burden on the Defense Industrial Base, especially smaller firms. Third-party CMMC Level 2 assessments have been estimated to run as high as $600,000 for a small company, and federal data showed the number of small businesses acting as DoD prime contractors fell roughly a third between 2014 and 2024. An industry feedback request drew more than a thousand responses, with over half supporting some form of reform before Phase 2 moves forward.

What's actually on hold

  • The shift to requiring C3PAO (third-party) certification as the default for Level 2 contracts — originally set for November 10, 2026.
  • Level 3 (DIBCAC-assessed) designations.
  • New solicitations can, for now, only require Level 1 or Level 2 self-assessment — not third-party certification.
  • CMMC waiver procedures, which are paused for the duration of the review.

What has not changed

This is the part that matters most, and the part we see getting lost in the headlines.

  • DFARS 252.204-7012 is still in force. Safeguarding requirements and 72-hour incident reporting obligations haven't moved.
  • Level 1 and Level 2 self-assessment requirements remain in effect under the CMMC program rule.
  • Your SPRS score and annual affirmation are still required — and that affirmation has to be signed by a named senior company official.
  • False Claims Act exposure is real. Your SPRS submission is a legal representation to the government, not a formality. A recent eight-figure settlement tied to inaccurate NIST 800-171 claims is a reminder that enforcement doesn't depend on Phase 2 being active.
  • Primes can still require it. Nothing stops a prime contractor from requiring Level 2 compliance, or even third-party certification, from its own suppliers on its own timeline — independent of what the DoW requires directly.

In other words: the certification requirement is paused. The underlying security obligation, and the risk of getting your self-assessment wrong, is not.

What to do right now

  1. Confirm with your prime. Before you cancel or postpone any planned assessment, ask directly which requirements still apply to your specific contracts. Some primes have kept their own deadlines in place regardless of the DoW's pause.
  2. Scope your CUI. Know exactly where Controlled Unclassified Information enters, is stored, processed, or transmitted in your environment, and document that boundary in your System Security Plan (SSP).
  3. Check your infrastructure. Cloud services handling CUI should be FedRAMP Moderate authorized or equivalent (GCC High and similar government-community clouds are common choices), with FIPS-validated encryption and MFA on anything touching CUI.
  4. Run an honest gap analysis against NIST SP 800-171, document what's missing in a Plan of Action & Milestones (POA&M) with real remediation dates, and keep your policies current.
  5. Submit and affirm accurately. An inflated SPRS score is a bigger liability than a low, honest one with a credible remediation plan behind it.
If you already hold a current Level 2 (C3PAO) certification, none of this changes your position — that work already covers what's still required. This is primarily guidance for contractors who were planning around a Phase 2 timeline that's now paused.

We'll update this post if and when the Reform Task Force report lands with anything concrete. Until then, the safest assumption is the one that was already true before the pause: build to NIST SP 800-171, keep your SPRS score current and accurate, and don't wait for a certification deadline to start.