CMMC Phase 2 status: suspended. Here is what still applies.

CMMC status at a glance

What November 10, 2026 means now

November 10, 2026 was the date Phase 2 was scheduled to start, when contracts handling Controlled Unclassified Information would have required a Level 2 certification from a C3PAO. With Phase 2 suspended, that date passes without a new requirement. November 10, 2026 is simply the first anniversary of Phase 1.

Voluntary C3PAO assessments are still available, and the Cyber AB says assessments, training and oversight continue.

The September 2026 class deviation

On September 3, 2026 the DoD issued Class Deviation 2026-O0025, Revision 3, which contracting officers use in place of the codified DFARS text for information security (DFARS part 240). It keeps DFARS 252.204-7012, moves the NIST SP 800-171 DoD Assessment and SPRS requirements into DFARS 252.240-7997, and sets when the CMMC clause goes into contracts: until November 9, 2028 only where the program office requires a specific CMMC level, and from November 10, 2028 in every contract where the contractor processes Federal Contract Information or CUI.

What changed on July 13, 2026

The Department of War (DoD) suspended the Phase 2 rollout, the step that would have required certification by a Certified Third-Party Assessment Organization (C3PAO) for contracts that handle Controlled Unclassified Information. Phases 3 and 4 were suspended with it.

At the same time it launched a 60-day CMMC Reform Task Force review, with a request for information that closed on August 14, 2026. No new Phase 2 date has been announced.

What still applies today

• Self-assessments for contracts that carry a CMMC clause: Level 1 every year, against the 15 FAR 52.204-21 requirements; Level 2 every three years, against the 110 NIST SP 800-171 Rev 2 requirements.
• A current SPRS score before award, and the government’s right to assess, under DFARS 252.240-7997 (formerly 252.204-7019 and 7020).
• Annual affirmations of continued compliance by a senior official.
• DFARS 252.204-7012: safeguarding covered defense information and reporting cyber incidents within 72 hours.

What to keep doing during the pause

• Keep your SPRS score accurate. A score that overstates your controls is a False Claims Act risk, pause or no pause.
• Keep your System Security Plan and POA&M current, and close open POA&M items.
• Keep collecting evidence now. When Phase 2 restarts, an assessor will want to see that controls held over time, not that they were switched on the week before.
• Keep the technical controls that assessments sample most: multi-factor authentication, audit logging, encryption, least-privilege access and configuration baselines.

NIST SP 800-171 Rev 2 or Rev 3?

For DoD contracts, Rev 2 is still the standard: DFARS 252.204-7012, as revised by class deviation 2026-O0025 Rev 3, names NIST SP 800-171 Revision 2, and SPRS scores follow Rev 2. Rev 3 has 97 requirements against Rev 2’s 110. Moving to Rev 3 is one of the options under review, so map your work to Rev 2 for scoring and track Rev 3 for the future.

What happens next

• Publication of the CMMC Reform Task Force report. Federal News Network reported on October 26, 2026 that it is delayed.
• A decision on the options in the request-for-information summary that Federal News Network obtained on October 27, 2026: restarting Phase 2 for a narrower group of contractors, longer POA&M windows, and moving to NIST SP 800-171 Rev 3. These are options, not decisions.
• Any amendment to the CMMC program rule (32 CFR Part 170) or the acquisition rule (48 CFR).
• A new effective date for Phase 2 certification.

We update this page when any of these change.

How Obsinto helps while CMMC is paused

Obsinto keeps the technical side of your security program current. It checks your cloud, identity and code against NIST SP 800-53, the catalog NIST SP 800-171 is derived from, fixes gaps with your approval, re-checks them, and records every change. When Phase 2 restarts, your evidence already covers the months before the assessment.