CMMC Phase 2 Is Suspended — What Defense Contractors Should Actually Do Now

August 3, 2026 · CMMC911 Team

If you supply DoD primes, someone has probably already forwarded you a headline about CMMC being “paused.” Here’s what actually happened, and what it means for your shop.

What did DoD actually suspend?

On July 13, 2026, DoD suspended Phase 2 of CMMC implementation — the stage, scheduled for November 10, 2026, that would have started requiring third-party (C3PAO) Level 2 certifications in many contract awards. DoD also launched a broader review of the program, with a Reform Task Force expected to report around mid-September 2026.

That’s the suspension. Now the part the headlines skip.

What is still required?

Everything your shop was already obligated to do last month:

• Phase 1 is in force. Since November 10, 2025, new DoD solicitations require CMMC Level 1 or Level 2 self-assessments at award, with annual affirmations posted in SPRS.
• DFARS 252.204-7012 never paused. If you handle CUI, you’re contractually required to implement NIST SP 800-171 and report cyber incidents within 72 hours.
• SPRS still matters. Your self-assessment score sits in a DoD system your primes and contracting officers can check. A missing or stale score is a red flag on your next PO.
• Affirmations are still certifications. Signing one you can’t support is False Claims Act exposure, and cybersecurity enforcement is active.

So why does the suspension matter at all?

Two reasons. First, if you were racing to schedule a C3PAO assessment before November, that pressure is off — for now. Second, the Task Force review could genuinely reshape the program: assessment requirements, timelines, maybe structure. Nobody knows yet.

What should a defense contractor do this month?

Keep going, calmly. The math is simple:

• If Phase 2 comes back with a new date, shops that kept working are at the front of the line. Assessor capacity was already a bottleneck before the pause — a restart will make the queue worse, not better.
• If requirements get lighter, you’ve built real security for a shop that handles controlled drawings anyway — and your SPRS score keeps winning you work in the meantime.
• If you pause and guess wrong, you restart cold with a stale SSP, an old score, and a prime asking questions.

The suspension changed the assessment schedule. It did not change what your contracts require, what your primes check, or what signing an affirmation means.

Where to watch for updates

We maintain a live CMMC status page and update it the day DoD announces anything. The Task Force report expected in September is the next big date — we’ll break down what it means for suppliers the day it lands.

This is general information, not legal advice. For contract-specific questions, talk to your government-contracts counsel — and for everything it takes to actually implement and maintain compliance, talk to us.