Short answer: The July 2026 suspension paused the move to mandatory third-party CMMC certification. It did not pause your existing cybersecurity obligations. If your contract includes DFARS 252.204-7012 and you handle Controlled Unclassified Information (CUI), you must still implement NIST SP 800-171, keep a current SPRS score, and meet CMMC Phase I self-assessment requirements.
What happened
In memoranda dated July 13, 2026, the Department of War (formerly the Department of Defense) Chief Information Officer suspended implementation of CMMC Phase II and the program’s later implementation milestones while the program is reviewed.
- Phase II was scheduled to begin November 10, 2026. It would have made a third-party (C3PAO) CMMC Level 2 certification a condition of award for many contracts involving CUI.
- Published analyses report that the later Phase III and Phase IV milestones are on hold as well; the official class deviation addresses Phase II.
- Contracting officers were directed to remove the suspended requirements from active solicitations and to update existing contracts at their next option period or scheduled modification. DFARS Class Deviation 2026-O0025 (Revision 3, September 3, 2026) carries this direction and remains in effect until rescinded.
- A CMMC Reform Task Force was formed to review the program and report recommendations. A public request for information closed on August 14, 2026.
Before acting on any change, confirm whether the suspension is still in place on the DoD CIO CMMC page, the official source for the program’s status.
What did NOT change
| Requirement | Status | What it means |
|---|---|---|
| DFARS 252.204-7012 | In effect | Implement the 110 requirements of NIST SP 800-171 to protect CUI; report cyber incidents to DoD within 72 hours; flow requirements down to subcontractors. |
| NIST SP 800-171 DoD assessments | Changed | In new solicitations, DFARS 252.204-7019 no longer appears and 252.204-7020 is replaced by DFARS 252.240-7997, which covers DoD-led Medium and High assessments. Older contracts may still contain 7019/7020 and their SPRS score requirement. See what an SPRS score is. |
| CMMC Phase I | In effect | Level 1 and Level 2 self-assessments and annual affirmations where your contract requires them. |
| False Claims Act exposure | Unchanged | Misrepresenting your cybersecurity compliance — including an inaccurate SPRS score or affirmation — remains a legal risk. |
| Voluntary C3PAO assessments | Available | Contractors can still pursue a Level 2 certification assessment voluntarily. |
In other words: the suspension changed when third-party certification may become mandatory. It did not change what you’re responsible for today.
Why “wait and see” is risky
- Your primes are still asking. Many prime contractors continue to require SPRS scores and evidence of NIST SP 800-171 compliance from subcontractors, regardless of CMMC timing.
- Your score must be accurate now. An SPRS score that doesn’t reflect reality is a contractual and legal problem today — not in some future phase.
- Readiness takes months. Reaching full Level 2 readiness commonly takes many months. Contractors who use the pause to prepare will be ready to bid when requirements return; others will compete for a limited pool of assessors.
- The rules may change, but the controls won’t. Whatever the task force recommends, NIST SP 800-171 remains the underlying standard for protecting CUI.
What to do now
- Confirm what’s in your contracts. Look for DFARS 252.204-7012 and -7021, DFARS 252.240-7997, or (in older contracts) 252.204-7019 and -7020, and identify whether you handle FCI only or CUI.
- Check your SPRS score. Is it current (under three years old)? Is it supported by evidence?
- Define your CUI boundary. Knowing exactly where CUI lives is the single biggest lever on cost and effort.
- Get an honest gap assessment. Measure all 110 requirements against evidence, not assumptions.
- Fix the high-value gaps first. Prioritize by SPRS points, risk, and cost — multi-factor authentication, encryption, logging, and incident response are common gaps.
- Get your documentation in order. You need a System Security Plan (SSP) and, for open items, a Plan of Action & Milestones (POA&M).
How USCIBER can help
Our CMMC Readiness Review — starting at $7,500 — includes a full NIST SP 800-171 gap assessment, an evidence-based SPRS score estimate, and a prioritized remediation roadmap. We can also build your SSP and POA&M.
Sources
- DoD CIO — CMMC program information
- DPAP — DFARS Class Deviation 2026-O0025, Revision 3
- eCFR — 32 CFR Part 170, CMMC Program
- Federal News Network — Pentagon suspends CMMC phase two requirements, launches review of program
- Latham & Watkins — What defense contractors should know about DOD’s suspension of CMMC Phase 2
- Jenner & Block — Department of War suspends CMMC Phase II — but compliance obligations remain
- National Law Review — DoD CIO suspends implementation of CMMC Phase II, launches review
This article is general information, not legal advice. Review your specific contracts with your contracting officer or counsel.