For most of the past year, defense contractors had one date circled: November 10, 2026. On that date CMMC Phase 2 was due to begin. From then on, solicitations that handle Controlled Unclassified Information could require a Level 2 certification from an accredited third-party assessor (a C3PAO) instead of a self-assessment. Many small firms budgeted for the audit and booked an assessor.
On July 13, 2026, the Department suspended Phase 2, along with the other pending CMMC milestones, and opened a reform review. A class deviation issued in early September carried the pause into contracting instructions. The November date no longer means what it did.
Some firms have read that as "CMMC is off". It is not, and the gap between the two is where bids get lost.
What was suspended
The suspension covers the step-up the phased rollout had scheduled: solicitations requiring a Level 2 certification from a C3PAO as a condition of award. During the pause, contracting officers are told to use the self-assessment levels instead.
For contracts that already carry a third-party certification requirement, the instruction is to remove it by modification, at the next option exercise or administrative modification. Until that modification is signed, the clause in your contract still applies as written. Read your own contracts, not the press release.
What still applies
Everything that existed before Phase 2 is still in force:
- DFARS 252.204-7012 and the security requirements of NIST SP 800-171 Rev. 2 for any system that handles Controlled Unclassified Information, including the 72-hour cyber incident reporting.
- CMMC Phase 1: Level 1 and Level 2 self-assessments where a solicitation calls for them, with results posted in SPRS and the annual affirmation by a senior official.
- Your SPRS score. Contracting officers can still check it before award. A missing or expired score is still a problem.
- Flowdown. The suspension instructs government personnel. It does not rewrite your prime's subcontract. If your subcontract requires a certification, it requires one until the prime changes it in writing.
The affirmation matters more than it looks. A senior official signs it, and the government relies on it. A self-assessment score that the systems behind it cannot support is a False Claims Act problem, not a paperwork problem. A pause in third-party audits makes the self-assessment carry more weight, not less.
What to check on a defense solicitation now
When a DoD solicitation lands, look for these before you decide to bid:
- Which CMMC level and assessment type it names. Under the pause, expect "Level 1 (Self)" or "Level 2 (Self)". If it still names a C3PAO certification, ask about it in the Q&A period. It may be an older template, or the program may have a reason.
- Whether the work involves CUI at all. Federal Contract Information alone points to Level 1. CUI points to NIST SP 800-171. The answer decides which systems are in scope.
- Whether your SPRS entry is current and covers the systems that will actually touch the contract's data. Assessments have to be renewed, and a score for one enclave does not cover another.
- What your prime is flowing down, if you are bidding as a subcontractor. Get any relief from the prime in writing.
- What the solicitation says about the pause. Amendments are how a pending solicitation catches up with a policy change. Read every one.
Should you still get certified?
Assessors can still certify voluntarily, and an existing Level 2 certification still satisfies a lower requirement during the pause. Whether to spend the money now is a business call, not a compliance one. Three questions decide it:
- Do your primes ask for it regardless of what the DoD requires?
- Does your pipeline include programs where a certification will be a discriminator once the reform review ends?
- Would the work of preparing for an assessment also fix the gaps behind your self-assessment score?
The reform review may change the levels, the timeline or the assessment model. It is unlikely to remove the underlying controls. Firms that keep implementing NIST SP 800-171 lose nothing whatever the review decides. Firms that stopped because the deadline moved may find the next deadline set with less notice.
Related reading: the five documents that sink a public tender.
