CMMC Phase 2 Suspended and What Defense Contractors Need to Know

On July 13, 2026 the Department of War suspended CMMC Phase 2, the stage of the rollout that would have required a third-party assessment as a condition of contract award beginning November 10, 2026. Phase 1 self-assessment, NIST 800-171, and the underlying DFARS obligations all remain in force. A reform task force is reviewing the program and will report within 60 days. The legal duty to protect defense information did not change.

The announcement moved quickly through the defense industrial base, and much of the early commentary framed it as the end of CMMC. It is not. The suspension affects one phase of the rollout, and the requirement it exists to enforce has been in federal contracts for years.

The following is a precise account of what the memo changes, what it leaves untouched, and how contractors should respond.

What did the CMMC Phase 2 suspension actually change?

Phase 2 was the planned expansion of DFARS clause 252.204-7021 into a broader set of contracts. That clause directs a contractor to demonstrate CMMC compliance, which is an assessment of the security requirements already imposed elsewhere. Phase 2 would have moved many contractors from a self-assessment reported through SPRS to a third party assessment performed by a Certified Third Party Assessment Organization, or C3PAO, as a condition of award.

That expansion is what has been suspended. The Department also paused the pending and future CMMC milestones across its solicitations, including the Phase 3 introduction of government led Level 3 assessments under NIST 800-172.

What was not suspended is the substance. DFARS clause 252.204-7020 was not repealed, and the requirement to implement security controls remains exactly where it was.

Which compliance requirements remain in force?

Most of them. This is the point most likely to be misread, so it warrants a clear statement.

• Phase 1 self-assessment remains required. The release states these requirements remain firmly in place.
• NIST SP 800-171 Rev 2 remains enforced, through self-assessment and through government-led assessments.
• DFARS clause 252.204-7012, which directs contractors to implement NIST 800-171, has been in defense contracts since 2017 and is untouched.
• DFARS clause 252.204-7019 still requires a score in SPRS to be eligible to bid, and the affirming official who certifies that score remains personally accountable for its accuracy.
• 32 CFR Part 170, the rule that established the program, remains law.

Stated plainly, the suspension changed who verifies the work, not whether the work is required.

Why the assessment was never the expensive part

A common reaction to the suspension is relief about cost. That relief is misplaced, and understanding why is central to making a sound decision.

The expensive part of compliance is implementing the security requirements, and that obligation has existed for roughly eight years. The third party assessment is the smallest cost in the process. What the suspension removed is a verification step, not the underlying program of work that a contractor must complete to protect controlled unclassified information.

The heaviest lift is rarely the technology. It is internal governance, defining how the organization handles data, and getting security, IT, contracts, and operations to work from the same requirements. None of that was affected by the memo, and it does not become easier by waiting. Kieri’s CMMC gap analysis and compliance documentation exist to carry most of that burden for you.

Why enforcement risk has increased, not decreased

Removing the third party assessment requirement returns many contractors to self-attestation, and self-attestation concentrates risk on the company and on the individual who signs it.

The record shows that a significant share of organizations were not self-assessing accurately. For years, a contractor could post a low or even negative SPRS score, on a scale that runs from 110 down to negative 203, and still win awards. Many contractors, however, posted very high scores, for fear that a low score would preclude them from winning the contract. A third party assessment exists precisely because self reported scores proved unreliable, and because an independent assessor absorbs the risk of standing behind the result.

The Department of Justice has grown materially more aggressive here. It has pursued contractors under the False Claims Act for posting inflated scores, and it has begun pursuing the affirming officials who certified them. A suspended assessment phase does not reduce that exposure. It increases it, because the layer of independent validation between a contractor and the government is now optional rather than required.

Why did the Department of War suspend Phase 2?

The stated reasons concern cost and capacity rather than any judgment that the security requirements are wrong. The Department cited compliance costs pricing small businesses out of defense work, projected future costs in the billions for small and mid sized firms, and a shortage of assessment capacity. A March 2026 GAO report had already warned that the standards could prove too costly for some small businesses.

One figure in the announcement deserves correction. The Department suggested roughly 100 assessors were available against more than 100,000 companies. That understates the ecosystem. There are just over 100 authorized C3PAOs and more than a thousand certified assessors. Capacity is a genuine constraint, but it is not as severe as the stated figure implies, and it is one reason acting during the current lull is an advantage rather than a risk.

Does the suspension mean CMMC is being cancelled?

No party can guarantee the outcome of the review. The program’s history, however, is instructive and should inform any decision made in response to a headline.

CMMC has been paused or frozen five times since 2019, and it has never been cancelled. The closest parallel to the present situation is 2021, when the same concerns, small business cost and burden, produced a full review and a pause. Eleven months later the program returned as CMMC 2.0, reduced from five levels to three and permitting self-assessment at the lower tiers. It emerged narrower and later, not eliminated.

A four year interval also illustrates the pattern. From late 2021 the enforcement clause sat suspended, and much of the market treated the pause as permanent. Enforcement then began on November 10, 2025, the exact date the Department had named. Nearly every deadline in the program’s history has slipped, yet not one has been withdrawn.

One caution belongs here. The Request for Information issued with this pause asks which controls deliver the most measurable risk reduction and which impose the greatest burden for the least benefit. The control set itself may therefore be refined, not only the assessment process. What is not in question is the foundation. Every version of this program has been built on NIST 800-171, and that foundation is not going away.

How long is the CMMC pause expected to last?

Longer than the headline number suggests. The CMMC Reform Task Force convened on July 16 and has 60 days to produce recommendations. A public comment window is open until August 14. The 60-day period applies to the recommendations, not to the pause, and the suspension of further phases is open ended.

On a realistic timeline, the task force reports in late September or early October. Any change that follows must proceed through its own rulemaking, a process that has historically taken this program one to three years. Meaningful clarity is most likely to arrive in late 2026 or the first quarter of 2027, not within 60 days.

What subcontractors should expect from prime contractors

The government requirement is not the only requirement that matters. A prime contractor carries its own contractual risk when a subcontractor is not compliant, and 32 CFR Part 170 and the DFARS flow down obligations remain unchanged.

A prime may continue to require a C3PAO assessment of its subcontractors, and it may flow the requirement down exactly as written or add to it. Subcontractors should confirm expectations directly with their primes and their contracting officers. A contract that will not be awarded for another six months is unaffected by a 60 day extension, and a contractor who is not ready when the requirement returns will not win the award.

Kieri’s recommendation for contractors on the path to compliance

For contractors already progressing toward compliance, Kieri’s recommendation is to continue. The reasoning rests on three points.

• Assessment capacity is available now. With many contractors pausing, C3PAO schedules have room. That capacity does not expand during a suspension, and demand will return in a concentrated wave once the review concludes.
• Readiness does not remain current. Evidence ages, environments change, and staff turn over. A contractor who defers by six months will repeat work already completed and paid for.
• Finished contractors hold a competitive position. When clarity arrives, an organization that has completed its assessment can respond to a prime’s requirements immediately, while others return to the queue.

A completed assessment also retains its value today. C3PAOs continue to operate under 32 CFR Part 170, the Cyber AB and the eMASS program office remain active, and an assessment still yields a certificate that primes recognize. At Kieri, no client on the assessment schedule has cancelled in response to the suspension.

Kieri helps defense contractors reach and maintain compliance, from a gap analysis and a reference architecture through a full CMMC assessment. Our case studies show how contractors have reached Level 2 with our support. If you are uncertain what the suspension means for your specific contract, book a consultation and we will review it with you directly.

Frequently asked questions

Is CMMC cancelled?

No. Phase 2 of the rollout, the third party assessment requirement, is suspended while the whole program is reviewed. Phase 1 of the rollout, Level 1 and 2 self-assessments, remains in effect. The program has been paused five times since 2019 and never cancelled.

Do I still need to meet NIST 800-171?

Yes. NIST 800-171 Rev 2 remains enforced through self-assessment and government led assessment, and DFARS 252.204-7012 still requires contractors to protect covered defense information.

When was Phase 2 scheduled to begin?

November 10, 2026. The November 10, 2025 date that has already passed was Phase 1, which took effect on schedule.

How long will the suspension last?

The task force has 60 days to issue recommendations, but the pause itself is open ended. Given the rulemaking required for any change, meaningful clarity is most likely to arrive in late 2026 or early 2027.

Should I cancel my assessment?

For most contractors, no. Assessments continue under 32 CFR Part 170, the certificate still uploads to eMASS, and capacity tightens once the pause ends. If timing is a genuine problem, reschedule to a specific date rather than withdrawing. Kieri can help you plan the right timing.

Will prime contractors still require a C3PAO assessment?

They may. Primes carry their own risk for noncompliant subcontractors and can require or flow down a third party assessment regardless of the government pause. Confirm expectations with your prime and contracting officer.

Can I still submit feedback to the government?

Yes. The Request for Information is open on SAM.gov, with responses due August 14, 2026.