On 13 July 2026 the Department of Defense announced an immediate suspension of CMMC Phase II, which was due to start on 10 November 2026 and would have required third-party Level 2 assessments by C3PAOs for most contractors handling CUI. A 60-day review by a CMMC Reform Task Force began the same day. On 3 September a DFARS class deviation turned the pause into a contract instruction.
What's affected
Per BakerHostetler's summary of the announcement and Washington Technology's reporting on the deviation:
- Suspended: the Phase II start, and the planned broader rollout of C3PAO requirements. DoD directed that C3PAO requirements be removed from pending solicitations and current contracts.
- DoD's stated reasons were compliance costs, assessment capacity and barriers to participation in the defense industrial base.
- Still in force: Phase I, effective November 2025, with self-assessments, SPRS score submissions and annual affirmations. Contracting officers may still require ad hoc Level 2 C3PAO assessments under Phase I.
- Still in force: DFARS 252.204-7012, FAR 52.204-21 and the NIST SP 800-171 controls for contractors handling CUI, plus system security plans, plans of action and flowed-down subcontractor requirements.
- The 3 September class deviation, issued by a memo from John Tenaglia of defense pricing, contracting and acquisition policy, instructs contracting officers to follow the Revolutionary FAR Overhaul instead of the final CMMC rule for clauses and to remove all third-party assessment requirements from contracts.
As quoted in the summary: "this is not a suspension of the requirements for protecting Controlled Unclassified Information."
Policy versus binding
| Instrument | Status |
|---|---|
| 13 July announcement and 60-day review | Departmental policy, no change to the underlying clauses |
| 3 September class deviation | Binding on contracting officers. Washington Technology describes it as moving the pause from policy to enforceable instruction. It is a class deviation, not a final regulation |
| NIST SP 800-171 compliance and self-attestation | Still required where the clauses apply |
| Review results | The report goes to the CIO, who decides whether to release recommendations. The outcome is not public |
What to do now
- Do not stop. The July 13 summary warns that inaccurate SPRS scores, affirmations or system security plans may create False Claims Act exposure. Washington Technology notes a June settlement in which a contractor paid roughly $500,000 over a near-perfect self-score that a DoD audit found inaccurate.
- Re-score yourself honestly against NIST SP 800-171 and update your SSP and plan of action.
- Check every prime contract for flowdowns. Higher-tier contractors may still impose cybersecurity obligations on their supply chains.
- Read the amendments to any pending solicitation for removed C3PAO text, and do not read silence as a change to the CUI duty.
- Keep your assessment readiness work. The review is open, and reversing a class deviation is a more involved process, so the next move is unclear.
How suppliers can prepare
- Treat evidence as the asset. Keep dated, retrievable proof of each control, because self-attestation is only as good as what backs it.
- Make your score defensible: a named owner, a review date and a link to evidence per control.
- Separate what you assert from what you have tested. A control you claim but never checked is the exposure.
- Prepare for either outcome. A tightened or a relaxed regime both reward a clean SSP.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Did the suspension remove the duty to protect CUI?
No. DFARS 252.204-7012, FAR 52.204-21 and NIST SP 800-171 still apply, and self-attestation is still required.
What made the pause enforceable?
The 3 September DFARS class deviation, which tells contracting officers to remove third-party assessment requirements from contracts. It is not a final regulation.
