What does the CMMC Phase II pause mean, and what should I do now?

Written by

Mark Jackolski

Managing Partner & Lead CMMC Certified Assessor (LCCA)

Updated

October 19, 2026

Short answer: The CMMC Phase II pause means the Department of War is no longer requiring independent C3PAO certification on November 10, 2026. It does not mean CMMC is over. Phase I self-assessments, DFARS 252.204-7012 and your SPRS affirmations are still in force. Keep implementing NIST SP 800-171, make sure your SPRS score is accurate, and find out what your primes expect.

Shellproof Security is an Authorized C3PAO based on Long Island, NY. This page explains what the pause changed, what it left in place, and what to do next depending on your situation. We update it as official guidance changes.

Where things stand (October 2026)

CMMC status as of October 2026
Question	Answer
Is CMMC still required?	Yes. Phase I has applied since November 10, 2025.
Is C3PAO certification required?	Not by DoD for now. Phase II was suspended on July 13, 2026.
Is there a new Phase II date?	No. None has been announced.
Has the Reform Task Force reported?	Its 60-day review closed September 11, 2026. The report has not been published.
Do DFARS 7012 and NIST SP 800-171 still apply?	Yes, in every contract that includes the clause.
Can I still get a C3PAO assessment?	Yes, voluntarily.

What did the Phase II pause actually change?

On July 13, 2026, the Department of War suspended the move to Phase II, which would have required a C3PAO certification assessment for contracts involving Controlled Unclassified Information (CUI) starting November 10, 2026. It also put Phases III and IV on hold and created a CMMC Reform Task Force to review the program over 60 days.

On September 3, 2026, Class Deviation 2026-O0025, Revision 3 told contracting officers how to apply the pause:

Accept CMMC Level 1 and Level 2 self-assessments in new solicitations.
Remove third-party assessment requirements from existing contracts at the next option period or scheduled modification.
Amend active solicitations that still call for C3PAO certification.

The program rule, 32 CFR Part 170, and the contract clause, DFARS 252.204-7021, are still on the books. This is a suspension, not a cancellation.

What did the pause not change?

CMMC obligations still in force during the Phase II pause
Obligation	Status	Why it matters
DFARS 252.204-7012	In force	Requires NIST SP 800-171 Rev 2 controls for CUI and cyber incident reports within 72 hours
CMMC Phase I	In force since November 10, 2025	Contracts can require a Level 1 or Level 2 self-assessment today
SPRS score and annual affirmation	In force	A senior official affirms your status every year
False Claims Act exposure	Unchanged	An SPRS score or affirmation that overstates your controls can be a false claim
CMMC clause already in your contract	In force until modified	The deviation does not change your contract by itself; a signed modification does
Prime contractor requirements	Set by each prime	Primes can keep their own certification deadlines for suppliers

What does the pause mean for my company?

What the CMMC Phase II pause means by contractor situation
Your situation	What the pause means	Do this next
You handle CUI and haven't started	Your obligations under DFARS 7012 already apply; the pause only removes the outside check for now	Start a gap assessment against NIST SP 800-171 and write your System Security Plan
You're mid-implementation	You have time to finish properly instead of rushing an assessment	Keep your remediation plan on schedule and update your SPRS score as controls close
You were booked for a C3PAO assessment	No DoD deadline forces it, but the assessment is still available	Decide whether verified status helps you with primes or bids, then keep or reschedule
You're a subcontractor to a large prime	Your prime's requirements may matter more than DoD's timeline	Ask your prime in writing what it will require and by when
You only handle FCI (no CUI)	Level 1 self-assessment and annual affirmation still apply	Confirm your 15 Level 1 practices and keep your affirmation current
You hold conditional Level 2 status	Your 180-day POA&M window keeps running	Close open items and post your closeout self-assessment in SPRS on time

What should I do now?

Five steps protect your contracts whatever the Task Force decides.

Confirm your scope. Know whether you handle Federal Contract Information (FCI), CUI or both, and which CMMC level each contract names.
Check your SPRS score against reality. Your score should match the controls that are actually in place today, not the ones you plan to implement.
Keep implementing NIST SP 800-171 Rev 2. Update your System Security Plan and Plan of Action and Milestones as you close gaps.
Read your contracts and ask your primes. Note which contracts still carry DFARS 252.204-7021, and get your primes' supplier requirements in writing.
Decide on timing for an assessment. If verified status would help you win or keep work, a voluntary Level 2 assessment is available now, before any restart creates a queue.

Why not just wait for the Task Force report?

Because the obligations that create real risk did not pause. DFARS 7012 applies today, and your annual SPRS affirmation is a statement to the government. When a new Phase II date is announced, contractors who kept implementing will need weeks to be ready. Contractors who stopped may need months, and they will be competing for the same limited number of assessors.

An assessment pause is not a compliance pause.

Frequently asked questions

Is CMMC canceled? No. Phase II and later phases are suspended. Phase I, the program rule (32 CFR Part 170) and the DFARS clauses remain in place.

When will Phase II start? No date has been announced. The Department of War CIO has said the Task Force report will be published but has not given a date. We will update this page when a date is set.

Do I still need to post a score in SPRS? Yes. SPRS scores and annual affirmations continue under Phase I and DFARS 252.204-7012.

Can a C3PAO still assess my company? Yes. Level 2 certification assessments are available voluntarily. Shellproof Security is an Authorized C3PAO.

Does the pause change NIST SP 800-171 requirements? No. Contracts with DFARS 252.204-7012 still require NIST SP 800-171 Rev 2 controls for CUI.

My prime still wants certification. Can they require it? Yes. Primes can set their own requirements for suppliers, separate from DoD's phase-in schedule.

Not sure where you stand? Shellproof Security is an Authorized C3PAO on Long Island, NY. Talk to our team about a readiness review or a Level 2 assessment.

‍

Share this post