Current status: CMMC Phase 2 is suspended
On July 13, 2026, the Department of War (DoD) announced the suspension of CMMC Phase 2, which was scheduled to begin November 10, 2026. Program offices cannot designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while it lasts, and contracting activities were directed to remove those requirements from solicitations and existing contracts. A CMMC Reform Task Force is reviewing the program, and no restart date has been announced. Read the DoD announcement.
The suspension does not withdraw the program rule. Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all continue to apply where your contracts require them, and primes can keep their own third-party requirements. This status was last checked on November 6, 2026.
For most companies doing business with the Department of Defense, some level of the program applies. The useful question is not whether you are affected in principle but which level, on what timeline, and whether it sits on the critical path of a pursuit you actually care about.
That is answerable from documents you already have. You do not need a consultant to reach a first determination, and you should reach one before you buy anything.
Five questions that determine your answer
Work through these in order. Most companies have a defensible answer by the end of the third.
- 1
Do you hold, or intend to bid, DoD contracts or subcontracts?
If no, and you have no plans to, the program is not your immediate concern — although the broader federal move toward supply chain security means it is worth watching. If yes, continue.
- 2
Do your contracts contain the safeguarding clauses?
Search every active contract and subcontract for FAR 52.204-21, DFARS 252.204-7012, 252.204-7019 and 252.204-7020, plus any CMMC clause such as 252.204-7021. These show what your contract allows for, not what you hold: 7012 appears in nearly every DoD contract except those solely for COTS items, so on its own it does not mean you handle CUI.
This costs an afternoon and tells you what to ask next. Some clause numbers may differ in newer contracts because of FAR and DFARS revisions, so search for the clause titles as well, such as Basic Safeguarding of Covered Contractor Information Systems.
- 3
What information do you actually receive and generate?
Inventory what the government and your primes send you: drawings, specifications, data packages, deliverables, correspondence. Look for CUI markings, export control notices and distribution statements. Then check anything ambiguous against the categories in the CUI Registry.
- 4
What do your primes intend to flow down?
If you subcontract, ask each prime directly what data types they will share and what level they expect of their supply chain. Many primes are making these decisions now, and the answer can impose an obligation your own prime contracts never would have.
- 5
What does your target pipeline require?
Look at the solicitations you intend to bid over the next 18 to 24 months. Where a CMMC requirement applies, the solicitation states the level. This is what converts a general obligation into a dated one.
Where to start if you only do two things
Steps two and three. Your clauses show what a contract allows for, and an inventory of what you actually receive shows what applies. Together they give you more signal than any amount of general reading, and they are the evidence any advisor will ask for first.
What your answer probably looks like
Three broad situations cover most small and mid-sized contractors.
| Situation | Likely level | What to do next |
|---|---|---|
| DoD work with non-public contract information, and no CUI received or generated | Level 1 | Work through the 15 FAR 52.204-21 requirements internally; document what you do; prepare for the annual affirmation |
| You receive or generate CUI, whether directly or through a prime | Level 2 (Self) at minimum, or Level 2 (C3PAO) if a contract or prime requires it | Scope where CUI lives before costing anything; build the System Security Plan; then decide on outside help |
| No DoD work today, but defense expansion is in the plan | Determined by future pursuits | Research target agencies and programs first, then scope compliance to what those pursuits actually require |
This is a first-pass orientation, not a determination. Confirm against your contract documents and, where the answer carries real cost, qualified advice.
The subcontractor trap
The most common way a company is caught out is not a solicitation. It is a prime.
Primes are responsible for the security of information they share down their supply chain, and many have begun asking suppliers to evidence their posture well ahead of any formal requirement reaching those suppliers directly. A company whose own contracts contain nothing alarming can still lose subcontract work because a prime decided its supply chain needed to be further along.
If a meaningful share of your defense revenue comes through primes, your effective deadline is set by their procurement decisions rather than by the program's schedule. The July 2026 suspension does not change that, because primes can keep their own third-party requirements. Ask them. The conversation is uncomfortable exactly once and informative every time.
Deciding when, not just whether
Two facts should shape timing. Self-assessment requirements apply now, so a contract that calls for Level 1 or Level 2 (Self) needs them met before award. And the third-party requirement is suspended rather than repealed, so it may return, possibly in a different form.
Taken together: the suspension is not a reason to stop, and it is not a reason to panic. If you handle CUI, your NIST SP 800-171 obligations did not pause. Work backward from the pursuits you intend to win, build what they actually require, and watch for what the task force decides.
Confirm the current schedule yourself
Phase timing has moved before and is the detail most likely to be stale in any written summary. Check the DoD CIO CMMC program page for the current position rather than relying on secondhand accounts.
Free help exists before you buy anything
Small contractors routinely pay for orientation that is available at no cost. Exhaust these before engaging a paid provider.
- APEX Accelerators — DoD-funded procurement assistance centers offering no-cost counseling, including cybersecurity readiness help. There is one covering your region.
- Project Spectrum — DoD-sponsored readiness resources and training aimed at the defense industrial base.
- DoD Office of Small Business Programs — guidance and small business advocates attached to defense agencies.
- The Cyber AB — the accreditation body, and the authoritative place to confirm whether a provider claiming authorization actually holds it.
Answer the pipeline question first
Every version of this decision resolves to the same underlying question: which defense work are you actually going after? Compliance scoped without that answer is guesswork, and usually expensive guesswork.
Establish what you are pursuing
- Federal Agency Profiles
Identify which defense agencies and buying offices purchase your capability.
- Opportunity Explorer
Read current solicitations in your space and check what safeguarding requirements they carry.
- Federal Contractor Directory
Find the primes whose supply chain you would join, then ask them what they flow down.
Sources
- 32 CFR Part 170 — CMMC Program — The rule that establishes the CMMC program, its levels and assessment types
- DoD CIO — CMMC Program — DoD's official CMMC program office and documentation library
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems — defines FCI
- NARA CUI Registry — The authoritative list of CUI categories
- APEX Accelerators — DoD-funded no-cost procurement assistance, including CMMC readiness help
- Department of War: CMMC Phase II suspension announcement — July 2026 announcement suspending Phase 2 requirements