CMMC Phase 2 Is Suspended. Here's What Still Applies to Level 1.

If you’ve seen headlines about CMMC being paused and wondered whether you can stop worrying about it, here’s the short answer: if you’re a Level 1 contractor, nothing changed for you.

The pause is real, and it’s significant — but it applies to a part of the program that was never about you. This is what happened, what still applies, and what to do about it.

What actually got suspended

On 13 July 2026, the Department of War suspended Phase 2 of the CMMC rollout. Phase 2 was the stage that would have required contractors handling Controlled Unclassified Information to pass an assessment by an outside auditor — a C3PAO — before they could be awarded a contract. It had been scheduled to begin on 10 November 2026.

That requirement is on hold while a reform task force reviews the program. Contracting officers were told they may include only self-assessment requirements in procurement documents, and may not require a third-party or government assessment during the review.

So the thing that got paused was the outside auditor, for the contractors who handle CUI.

What still applies to you

The Department’s own language on this was unambiguous: all Phase 1 self-assessment requirements remain firmly in place.

In practical terms, if you handle Federal Contract Information:

• The 15 basic safeguarding requirements still apply. They come from FAR 52.204-21, which the pause did not touch.
• You still assess yourself against those 15 requirements.
• A senior official still affirms the results are accurate.
• You still submit to SPRS, and contracting officers can still require Level 1 (Self) in solicitations.
• You still repeat it annually.

Nothing on that list moved. The process you were going to follow in November is the process you follow now.

The part people miss

A pause in the assessment requirement is not a pause in the obligation to protect the information.

FAR 52.204-21 is a contract clause. If it’s in your contract, you agreed to it, and that agreement doesn’t depend on whether anyone is scheduled to come and check. The same is true of the affirmation: when a senior person in your company attests that your self-assessment is accurate, that attestation carries weight regardless of the enforcement calendar. The Justice Department’s civil cyber-fraud work — which has already produced settlements against contractors who misrepresented their security posture — has not paused.

The quiet risk in a pause is that it invites people to submit a score they haven’t earned, on the theory that nobody’s looking. An inaccurate affirmation is a problem whether or not an auditor shows up.

If you were heading toward Level 2

This is where the pause genuinely changes your decision.

If you handle CUI and you were about to sign with a C3PAO, stop and wait. You cannot currently be required to produce a third-party assessment, the waiver process has been halted along with it, and the program may come back in a different shape. A Level 2 assessment runs well into five figures. Spending that now, against requirements that are under active review, is buying something you may not need in the form you’re buying it.

Keep implementing the underlying security controls — those obligations under DFARS 252.204-7012 are unchanged. Just don’t buy the assessment yet.

What happens next

The task force was given 60 days from 13 July to review the program, and the Department ran a public request for information that drew roughly 1,100 responses totalling more than 11,000 pages. As of late October the official report had not been released, though reporting on an internal summary described options that included restarting Phase 2 for a narrower set of contractors.

Nothing has been decided, and no new rule or memo has been published. Treat anything you read about a specific restart date as speculation until it appears in a published rule.

The bottom line

If you handle FCI, you’re a Level 1 contractor, and this pause did not change your obligations. The 15 requirements, the self-assessment, the affirmation, the SPRS submission and the annual repeat are all still there.

The sensible response is the same as it was in June: work through the 15 requirements honestly, document what you did, and keep the record. If a prime asks tomorrow, you have an answer. If the program resumes in a different shape, you’ve built the thing every version of it is based on.

For a full walkthrough, start with the Plain English CMMC Level 1 Guide. If you’re not certain which level applies to you, FCI vs. CUI is the place to settle it.