The Department of War paused third-party certification in July 2026. Here’s what was suspended, what still applies to your contracts, and how to prepare for whatever comes next.
November 10, 2026 is no longer a CMMC deadline. On July 13, 2026, the Department of War (DoW) suspended the Phase 2 requirement for Level 2 certification (a C3PAO assessment) pending a program review, and contracting officers have been directed to accept Level 1 and Level 2 self-assessments. What did not change: Phase 1 self-assessment requirements, DFARS 252.204-7012, and NIST SP 800-171 Rev 2 all remain in force — and with certification paused, the self-assessment score you submit is what the government relies on.
For most of 2026, November 10 was the most-discussed date in defense contracting: the start of Phase 2, when applicable new solicitations involving CUI would begin requiring Level 2 certification as a condition of award. On July 13 the Department suspended that transition "effective immediately" and launched a 60-day, top-to-bottom review of the program by a CMMC Reform Task Force.
The suspension changed how compliance is verified. It did not change what contractors are required to do.
| Requirement | Status | What it means for you |
|---|---|---|
| Phase 1 self-assessments | In force | Level 1 and Level 2 self-assessments in applicable solicitations. The Department says these "remain firmly in place." |
| DFARS 252.204-7012 | In force | Safeguard covered defense information and report cyber incidents within 72 hours of discovery. |
| NIST SP 800-171 Rev 2 | The baseline | Compliance is enforced against Rev 2 through self-assessments and select government-led assessments. Any move to Rev 3 will come through future rulemaking. |
| SPRS score and annual affirmation | In force | Your self-assessment score is posted in SPRS and affirmed by a senior official — a representation you make to the government. |
| Prime flow-downs | Varies by prime | Primes can still ask subcontractors for evidence, or for certification, as a teaming condition. |
It is tempting to read the suspension as a reprieve. It's closer to the opposite. With no third-party assessor between you and the government, your SPRS score and annual affirmation are representations you make directly — and the Department of Justice's Civil Cyber-Fraud Initiative has already produced multiple False Claims Act settlements built on overstated self-assessment scores. A self-assessment that wouldn't survive a C3PAO is a liability whether or not a C3PAO ever shows up.
The practical standard hasn't moved: each of the 110 requirements and 320 assessment objectives needs implementation evidence that an assessor could verify.
The Task Force's review window closed in September, but as of this update its report has not been published and no restart date has been announced. Late-October reporting described options under discussion — including restarting Phase 2 within roughly 90 days for a narrower set of contractors, expanding which requirements can be carried on a POA&M, and moving the baseline to NIST SP 800-171 Rev 3. Those are deliberative options, not decisions.
Two things are worth planning around whatever the outcome:
When a C3PAO assessment applies, Conditional CMMC Status remains a bridge — but the bar is specific. You need a score of at least 88 points (80% of the 110-point maximum), every open item must be eligible for a POA&M (generally 1-point requirements, with a short list of named exceptions), and you get a 180-day window to close those items, followed by a closeout assessment. It is a bridge for organizations close to the line, not a strategy for organizations that haven't started.
The silent killer in CMMC preparation isn't implementing controls — it's documentation and evidence: building the SSP, producing policies and procedures for 110 requirements, and linking evidence to controls in an assessor-ready package. One sub-50-person technology company completed that entire evidence workstream in 18 hours using PRISM's AI-assisted document analysis and template library. Read the case study.
PRISM assesses your environment against all 110 Level 2 requirements—with AI-powered document analysis and evidence mapping that turns months of preparation into hours.