CMMC Phase 2 Is Suspended — Here's What Defense Contractors Should Actually Do Right Now

If you've been bracing for CMMC Level 2 third-party certification requirements to hit your contracts this November, you can exhale a little. On July 13, 2026, the Department of War suspended the rollout of CMMC Phase 2, the stage that was set to require independent C3PAO assessments for many contractors handling Controlled Unclassified Information (CUI). No replacement date has been announced.

For small and mid-sized defense contractors, this news tends to land one of two ways: relief that a costly, time-consuming certification just got pushed off, or confusion about what's still required in the meantime. Both reactions miss the more important point — the suspension changes when the hardest requirement kicks in, not whether you need to be doing the work.

What's actually paused — and what isn't

It's worth being precise here, because the details matter if you're bidding on or managing a DoD contract right now:

• Suspended: New Level 2 (C3PAO) and Level 3 (DIBCAC) designations. Solicitations that already contain those requirements are expected to be amended, and existing contracts modified before their next option period.

• Still in force: Level 1 and Level 2 self-assessment requirements, safeguarding duties under DFARS 252.204-7012, Supplier Performance Risk System (SPRS) reporting obligations, and your annual affirmations.

In plain terms: the paperwork and self-attestation obligations you've had since Phase 1 began in November 2025 haven't gone anywhere. What's been shelved is the requirement for an outside assessor to come in and verify it.

Why this isn't a reason to stand down

It's tempting to treat a suspended deadline as a suspended priority. That's a mistake, for a few reasons:

The underlying requirement — NIST SP 800-171 — was never in question. CMMC didn't invent these controls; it added a verification layer on top of an obligation that's existed in DoD contracts for years. If you handle CUI, the 110 controls in NIST 800-171 apply to you regardless of what happens to the certification framework built around them.

Suspensions get lifted, often with less notice than the original rollout. Contractors who used the Phase 1 runway to get ahead of assessments are in a materially better position than those who wait for the next hard deadline to reappear. When Phase 2 does return — and most signals point to when, not if — the contractors who kept building their System Security Plan (SSP) and closing out their Plan of Action & Milestones (POA&M) items won't be scrambling.

Self-assessment still carries real exposure. An inaccurate SPRS score or a POA&M that quietly stalls out isn't a compliance footnote — it's a False Claims Act risk. The verification requirement may be paused; the underlying accuracy requirement is not.

Primes are watching their subs regardless of what's federally mandated. Many prime contractors have already built CMMC-equivalent expectations into their own subcontracting requirements, independent of the federal timeline. If you're positioning as a sub, "the government paused it" isn't an answer a prime wants to hear.

What to do between now and whatever comes next

1. Confirm your current CMMC level and self-assessment status are accurate and current in SPRS. This is the one obligation that unambiguously isn't going anywhere.

2. Keep your POA&M moving. Suspended certification requirements don't reset your 180-day closeout clock on existing conditional statuses.

3. Use the pause to close gaps, not to shelve the project. A readiness assessment now — scoping your CUI boundary, mapping controls, identifying POA&M items — costs less and moves faster than the same work done under deadline pressure later.

4. Watch your specific contract clauses, not just the headlines. Whether DFARS 252.204-7021 appears in your contract, and what your contracting officer says about pending amendments, matters more than the general news cycle.

The Phase 2 suspension is genuinely useful information — it changes near-term urgency and bidding calculus for a lot of contractors. But treated as a reason to pause your own readiness work, it becomes a trap. The contractors who come out ahead here are the ones who read this as extra runway, not as a stop sign.

This is a fast-moving area — for how a specific clause or contract applies to your situation, loop in your contracting officer or counsel.