What changed

On July 13, 2026, the Department of Defense issued a CMMC reform memorandum that suspended Phase 2 of the CMMC rollout. Phase 2 had been scheduled to begin on November 10, 2026, and would have made third-party Level 2 assessments by a C3PAO the default for contracts involving Controlled Unclassified Information (CUI).

Under the suspension, contracting officers may only require CMMC Level 1 (Self) or Level 2 (Self) assessments. Third-party Level 2 requirements are paused, and DoD directed that they be removed from active solicitations and existing contracts. On September 3, 2026, a revised DFARS class deviation carried the pause into contract language.

A CMMC Reform Task Force was given 60 days to review the program, and that review period closed in September. As of mid-October 2026, the Task Force has not published its findings and Phase 2 remains paused.

What did not change

The pause affects how compliance is verified, not whether you have to protect federal information. These obligations remain in place:

  • DFARS 252.204-7012 and FAR 52.204-21. If your contracts include these clauses, you must still safeguard CUI and Federal Contract Information and report cyber incidents.
  • NIST SP 800-171 Rev. 2. Contractors handling CUI are still expected to implement its 110 security requirements.
  • Self-assessments and SPRS. Level 1 and Level 2 self-assessments remain required where contracts call for them, and the scores you submit to SPRS must reflect reality.
  • Annual affirmations and flow-downs. Where DFARS 252.204-7021 applies, an affirming official must keep confirming compliance, and primes must still flow requirements down to subcontractors.
  • Audits and enforcement. Government assessments remain possible, and the Department of Justice continues to pursue False Claims Act cases involving inaccurate cybersecurity representations.

Why waiting is risky

A self-assessment is still a formal representation to the government. If your SPRS score says requirements are implemented and they are not, the pause does not protect you. Prime contractors are also continuing to ask suppliers about their cybersecurity programs, and the pause could end with little notice once the Task Force reports.

There is also a practical issue. Most of the 110 requirements take months to implement properly, and the documentation an assessor expects takes time to build. Organizations that stop now will be starting over when third-party assessments return in whatever form DoD decides.

What to do now

  1. Confirm your scope. Know which systems, people and facilities store, process or transmit CUI.
  2. Re-check your SPRS score. Make sure it matches what is actually implemented today.
  3. Keep your SSP and POA&M current. Your System Security Plan and Plan of Action and Milestones are the backbone of any assessment.
  4. Keep remediating. Prioritize MFA, encryption, logging and access control, which are among the most common gaps.
  5. Watch for the Task Force report. We will update this page when DoD publishes its next decision.

How Strong Connexions helps

Every Strong Connexions client already runs on a security standard mapped to NIST SP 800-171, so much of the technical work is done before compliance starts. We help contractors scope their environment, run gap assessments, maintain their SSP and POA&M, and keep SPRS scores accurate. See our compliance services.

This article is general information, not legal advice. Requirements change; contact us for guidance on your situation.