CMMC today: what the Phase II suspension changes
Checked October 16, 2026: Phase II is suspended; Phase I self-assessment requirements remain. Start with your contract, SPRS record, and actual system controls.
General educational guidance. Your contract and current official instructions control. No restricted information is accepted here.
- Recheck the official announcement before relying on a rollout date.
- A truthful assessment describes implemented controls, not a desired future state.
- The applicable NIST revision comes from the contract and authorized implementation guidance; a newer NIST publication alone does not rewrite a contract.
As of our October 16, 2026 check, the official DoD CIO and DLA announcements state that Phase II requirements were suspended on July 13, 2026. The previously scheduled November 10, 2026 Phase II date should not be presented as an active deadline. Phase I self-assessment requirements remain in place. This does not mean the underlying safeguarding obligations in an applicable contract disappeared.
Read your solicitation and contract clauses before deciding what evidence you need. DFARS 252.204-7012 addresses safeguarding and incident reporting; 252.204-7019 addresses assessment information in SPRS; 252.204-7021 addresses the required CMMC status and affirmations when included. These are related obligations, not interchangeable labels.
Step-by-Step Process
Confirm your applicable requirements
Record the clauses, required level, information types, and assessment scope in the actual solicitation. Ask the contracting officer to resolve conflicting requirements.
Read the current CMMC announcementEstablish the system boundary
Map where relevant data is processed, stored, transmitted, and protected. Include external providers and responsibilities. Keep restricted system details in your own authorized environment.
Maintain an honest SSP and assessment
NIST provides an SSP resource. Document your actual environment, implementation evidence, gaps, and remediation work. Calculate and maintain the required SPRS assessment using the applicable official methodology.
Read the SPRS assessment provisionTrack affirmations and changes
Where 252.204-7021 applies, its current-status provisions include an affirmation of continuous compliance. Revisit the evidence when your environment changes.
Frequently Asked Questions
Is CMMC canceled?
The official announcement describes a Phase II suspension, while Phase I self-assessments remain. It does not announce cancellation of all cybersecurity requirements.
Is NIST Revision 3 automatically the CMMC baseline?
Do not assume so. NIST superseded its Revision 2 publication, but contractual requirements and CMMC assessment rules must be checked separately. Confirm the applicable revision with your contracting officer.
Can I submit a score based on controls I plan to buy?
Do not represent planned work as implemented. Keep the assessment, SSP, and implementation evidence consistent and use the official scoring methodology.
Official Sources
Sources and official documentation supporting this guide:
- DoD CIO: current CMMC announcements (checked October 16, 2026)
- DLA: Joint Certification Program and current U.S. portal instructions
- DFARS 252.204-7012: safeguarding, cloud services and incident reporting
- DFARS 252.204-7019: DoD assessment and SPRS
- DFARS 252.204-7021: contractor CMMC status and assessment requirements
- NIST SP 800-171 Rev. 2 and SSP resources; publication superseded by Rev. 3
Need Expert Guidance?
Discuss your contracting and advisory needs with Haze Gray.