DoD suspends CMMC Phase 2 third-party assessments, but core requirements stay

On July 13, 2026, the Department of Defense suspended Phase II of the Cybersecurity Maturity Model Certification program, which was set to begin November 10, 2026 and would have required Level 2 assessments by certified third-party assessors (C3PAOs) in applicable contracts, Wiley reported. The department launched a 60-day review by a CMMC Reform Task Force and collected industry input through a request for information that closed August 14. A September 3 class deviation directs contracting officers to accept Level 1 and Level 2 self-assessments and remove third-party assessment requirements at the next option or modification, according to Secureframe's CMMC news tracker. As of October 2, the task force report had not been released.

This lowers near-term cost for many small defense suppliers, who no longer face a hard November deadline for a paid third-party certification. It does not remove the security obligations. DFARS 252.204-7012 remains in effect, the 110 controls of NIST SP 800-171 Rev 2 still apply, and contractors must still post self-assessment scores to SPRS and submit annual affirmations. The Justice Department's Civil Cyber-Fraud Initiative continues to pursue false compliance claims.

If you hold DoD contracts involving controlled unclassified information, keep your system security plan and remediation work moving. Make sure your SPRS score reflects reality, because inaccurate self-attestation carries False Claims Act risk. If you had a C3PAO assessment scheduled, check with your prime contractor before canceling it.

Watch for the task force report and any revised CMMC rule. Wiley also points to a separate FAR proposal that would extend similar safeguarding requirements to civilian agency contracts.