CMMC Phase 2 Is Suspended: What Still Applies to DoD Contractors

Updated November 1, 2026. This post originally explained the Phase 2 start date of November 10, 2026. DoD suspended Phase 2 on July 13, 2026, so we rewrote it to reflect where things stand now.

What happened

On July 13, 2026, the Department of War suspended the CMMC Phase 2 requirements and opened a 60-day, top-to-bottom review of the program by a CMMC Reform Task Force. Phase 2 would have made a Level 2 certification by a C3PAO a condition of award for contracts involving CUI, starting November 10, 2026. The later phases were frozen with it.

As of this update, DoD has not announced a restart date or adopted any of the reform options under discussion.

The rollout, then and now

What still applies

The pause changed the certification timeline. It did not change the security obligations already in your contracts.

• CMMC Phase 1 (32 CFR Part 170). When a solicitation calls for a Level 1 or Level 2 self-assessment, you still enter it in SPRS and an executive still affirms it.
• DFARS 252.204-7012. If you handle CUI, you must protect it with NIST SP 800-171 Rev. 2 and report cyber incidents to DoD within 72 hours.
• DFARS 252.204-7019 and -7020. You need a current SPRS score, no more than three years old, to be considered for award.
• Accuracy still matters. A score or affirmation that does not match reality is a False Claims Act exposure, and that did not change with the pause.

What to do now

1. Keep your SPRS score honest and current. Re-score when you close a gap or find a new one, and know when your annual affirmation is due.
2. Finish your SSP and POA&M. DFARS 7012 expects them today, and whatever replaces Phase 2 will start from them.
3. Know where CUI lives. Inventory the systems, people and data flows that touch CUI. A well-fenced enclave keeps any future assessment small and affordable.
4. Keep the work going, rethink the calendar. If you had a C3PAO assessment booked, talk to your assessor about options. Readiness work you do now counts under every reform option being discussed, including stronger self-assessment with executive sign-off.

Where Readyline fits

Readyline is built for exactly the obligations that still apply:

• An SPRS score that updates as you mark controls, with reminders for the annual affirmation.
• SSP and POA&M generated from your actual control implementations, not generic templates.
• Asset, network and software inventory to document where CUI lives.
• NISPOM, ITAR/EAR and FAR/DFARS clause tracking in the same tenant. None of those were part of the pause.

If you want to see where you stand, we are happy to walk through your SSP or POA&M on a 30-minute call. Book a demo.