CMMC Phase 2 Remains Paused, but Existing Contractor Cybersecurity Duties Continue

The Department of War (DoW) suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program on July 13, 2026, ahead of its scheduled November 10 start. As of November 12, no restart date has been announced, and the review expected to follow the pause has not been published. The delay matters to defense contractors because Phase 2 was intended to make third-party assessments the default when CMMC was included in a contract, subject to program-manager approval and the expectation that Controlled Unclassified Information (CUI) would be handled in performance. It was not the date on which CMMC would become a default requirement in every contract; that broader step was scheduled for November 10, 2028.

The pause concerns the rollout of CMMC assessment requirements, not the underlying cybersecurity obligations. Contractors handling Federal Contract Information (FCI) remain subject to applicable controls in FAR 52.204-21 and may need a Level 1 self-assessment when CMMC is required by the solicitation or contract. For contractors handling CUI, the relevant requirements include NIST SP 800-171, including revision 2 as described in the cited guidance, and a Level 2 self-assessment where CMMC is required. The applicable clauses and requirements must be checked against each solicitation and contract; a program-wide pause does not itself amend signed terms.

The immediate procurement implication is that contractors should avoid treating the pause either as a universal exemption from assessment or as confirmation that third-party assessments will begin on the original schedule. The source material emphasizes that DFARS 252.204-7012 remains relevant, and contractors should continue to meet any incident-reporting obligations in their clauses, including the cited 72-hour reporting requirement where applicable. Companies should also keep Supplier Performance Risk System (SPRS) records current, maintain required affirmations, and retain evidence for award, option, or extension reviews. Subcontractors should validate obligations with their prime contractors, since flow-down terms and solicitation-specific requirements may still call for Level 1 or Level 2 self-assessments.

The eventual policy decision could preserve third-party assessments with a delay, limit them to particular categories of CUI or introduce a phased approach, or eliminate them through further rulemaking. The cited legal analysis cautions that rescinding the requirement could be difficult because of the lengthy rulemaking history supporting third-party assessments. Meanwhile, the DoW CIO has sought information about which NIST SP 800-171 controls are hardest to implement and has highlighted protection of Operational Technology. Contractors should therefore continue compliance work and monitor official guidance rather than assume the pause ends enforcement. As Ian Garrett, Founder of Shadowbear LLC, put it: “The pause moved one deadline. It did not change the contract clauses most subcontractors have already signed.”

• Phase 2 status: The DoW suspension began July 13, 2026; the planned November 10 start passed without a restart date or published review.
• Scope of the pause: The suspension delays the planned third-party assessment requirement; it does not repeal underlying cybersecurity controls or existing contract clauses.
• CUI obligations: Continue to assess applicable NIST SP 800-171 requirements and complete a Level 2 self-assessment when required by contract or solicitation.
• FCI obligations: Applicable FAR 52.204-21 controls remain relevant, and a Level 1 self-assessment may be required where CMMC is specified.
• Contract clauses: Review DFARS 252.204-7012, flow-down terms, and any incident-reporting provisions, including the cited 72-hour reporting requirement where applicable.
• Records and evidence: Keep SPRS entries and required affirmations accurate; retain compliance documentation for award, option, and extension checks.
• Subcontractor action: Confirm specific obligations with primes; solicitations may require Level 1 or Level 2 self-assessments during the pause.
• Potential policy paths: Third-party assessments could resume after delay, be limited or phased by CUI category, or be removed through a future rulemaking decision.
• Watch items: Track DoW CIO guidance, the NIST SP 800-171 controls RFI, and potential requirements affecting Operational Technology.