CMMC Phase 2 Is Paused. Here Is What Still Applies to Defense Contractors.
The CMMC Phase 2 pause moved the certification date. Phase 1, DFARS 7012, and your SPRS score still apply. Here is what to do while the task force report is pending.
A month after CMMC Phase 2 was paused, ISC2 surveyed 219 U.S. cybersecurity professionals working on CMMC. 68% said they had kept working through the pause.
They have good reason. The pause changed one step of the program. It did not change the security rules already written into your contracts.
On July 13, 2026 the Department of Defense suspended CMMC Phase 2, the step that would have required third-party certification. Phase 1 still applies, and so do the rules underneath CMMC.
Is CMMC still required after the Phase 2 pause?
Yes. Phase 1 self-assessment is still in effect. You still have to protect the data, keep an accurate score in the Supplier Performance Risk System (SPRS), and sign the yearly affirmation.
The pause changed when a third party checks your work. It did not change whether you have to do the work.
What actually changed on July 13
The Department paused CMMC Phase 2. That is the stage where certification by a C3PAO, a CMMC Third-Party Assessment Organization, would have become a condition of contract award. It was set to start November 10, 2026.
A 60-day task force review followed. According to trade-press reporting, its report was due to the Department's Chief Information Officer on September 11, 2026. As of early October 2026, its recommendations had not been made public.
On September 3, 2026, Revision 3 of Class Deviation 2026-O0025 carried the suspension into the binding rules that contracting officers follow. It allows Level 1 or Level 2 self-assessment in all procurement requests.
It also tells contracting officers to update active solicitations. In existing contracts, they remove the paused requirements at the next option exercise or scheduled administrative modification.
The Department said the pause would lower the compliance barrier for smaller businesses. For scale, it estimated in November 2025 that about 70,000 contracts would eventually need Level 2.
What the pause did not touch
The pause stopped the move to third-party certification. It did not repeal the rules underneath CMMC. Those rules come from contract clauses that existed before CMMC, and every one of them still applies.
- DFARS 252.204-7012, often called DFARS 7012. Protect covered defense information to NIST SP 800-171 Revision 2. Report a cyber incident within 72 hours of finding it, and keep incident evidence for at least 90 days.
- Your SPRS score. Under DFARS 252.204-7019, you need a current score in SPRS before award. Current means no more than three years old.
- The annual affirmation. A named senior official still confirms your compliance every year.
- Your primes. Their flow-down deadlines were never tied to the DoD timeline, and they have not moved.
None of these depend on Phase 2. Third-party certification was a way to check the work. Pausing the check does not pause the work.
Why enforcement makes this a window, not a break
The rules still apply, and they are still enforced. The risk sits in the False Claims Act, and it attaches to the affirmation your senior official already signed.
A recent case shows how this plays out. In June 2026 the Department of Justice settled a False Claims Act case with LOGZONE, Inc. for $507,144. LOGZONE did not admit guilt.
The company had reported a perfect NIST SP 800-171 Revision 2 score of 110. A later assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) scored the same systems at -170.
A gap that big is possible because the scoring takes points off for every requirement you have not met. Some requirements cost more points than others, so a weak setup can land far below zero.
During the pause, self-assessment is the only option on the table. Nothing stands between your posted score and your award except your own word. So you need to be able to back that score with evidence.
What contractors are saying during the pause
Two industry surveys show how the defense industrial base is responding to the pause. The first is NDIA's 2026 CMMC survey, which drew 263 responses.
NDIA asked contractors to rate the risks to staying compliant and competitive. The readiness of lower-tier suppliers to meet fragmented requirements got more "severe risk" ratings than any other item. Of the 256 who rated it, 138 gave it a 4 or 5 out of 5.
Asked what help they want most, contractors put financial assistance first. Guidance on CMMC flow-down came second.
The second is an ISC2 survey of 219 U.S. cybersecurity professionals involved in CMMC work. 76% agree a CMMC program is needed. 68% have kept working on CMMC tasks during the pause, while 26% delayed or canceled assessment preparation.
Both surveys point the same way. Most of the market has not stopped, and the biggest worry sits lower in the supply chain.
If you are a prime, your subcontractors' readiness is part of your own. If you are a subcontractor, expect your primes to ask about yours.
What should you do during the review window?
Use the time before the task force report goes public to get ahead. Here are five steps, in order.
-
Freeze the phase dates, not the security work
Take the old certification deadline out of your plan. Keep funded fixes and evidence work going.
-
Map your data and contract scope
Find where your CUI and covered defense information actually live, across systems, users, and suppliers. Scope drives cost, so this step shapes every other one.
-
Check your SPRS score against your evidence
Compare the score you posted with your System Security Plan, your scoring math, and your real records. Fix anything you cannot back up before someone else finds it.
-
Build the evidence package now
Asset list, network diagram, System Security Plan, policies, procedures, and named control owners. The government's right to assess never paused.
-
Close the CUI handling gap
DFARS 252.204-7012 covers how you mark, store, and destroy CUI, how you train people, and how you report cyber incidents to DoD within 72 hours. Most CMMC checklists leave these out.
Do these five and you will be in a strong position, whatever the report says. We see the same pattern in our CMMC readiness work.
Teams that check their score against evidence early are the ones that walk into an assessment without surprises.
Where this goes next
Nothing is settled yet. As of early October 2026, the task force's recommendations had not been made public.
At a September 29 Cyber AB town hall, CEO Matt Travis said an announcement of changes by the end of October was more likely. Those changes may reshape CMMC for smaller contractors.
Until then, take the safe reading. CMMC is under review, not cancelled. Phase 1 is in effect, and the rules underneath it have not changed.
For the bigger picture of the rollout, see our federal contractors guide to CMMC.
Frequently Asked Questions
Is CMMC cancelled?
No. CMMC is under review, not cancelled. On July 13, 2026 the Department paused Phase 2, the third-party certification step. Phase 1 self-assessment and the rules under DFARS 252.204-7012 and NIST SP 800-171 Revision 2 still apply.
Do I still need a SPRS score during the pause?
Yes. DFARS 252.204-7019 still requires a current SPRS score before award. Current means no more than three years old, unless the solicitation says less. The pause removed the third-party check, not the score.
Can I stop my CMMC work until the review ends?
Stopping is the costly choice. DFARS 252.204-7012 and the yearly affirmation still apply, and primes are still passing requirements down. In an ISC2 survey, which ISC2 calls directional, 68% of CMMC professionals were still working on CMMC tasks.
When will the CMMC reform task force report?
According to trade-press reporting, the report was due to the Department's CIO on September 11, 2026. As of early October 2026, its recommendations were not public. Cyber AB CEO Matt Travis said at a September 29 town hall that an announcement of changes by the end of October was more likely.
Does CMMC Level 2 still mean 110 requirements?
Yes. Level 2 is assessed against the 110 security requirements of NIST SP 800-171 Revision 2. DoD pins that baseline through DFARS 252.204-7012 under Class Deviation 2026-O0025, carrying forward the 2024-O0013 pin. Revision 3 is coming through a separate proposed FAR rule, not through CMMC.
The bottom line
The pause rewards contractors who use it. Back your SPRS score with real evidence and close your CUI gaps, and you will be ready for whatever the report says.
Stop now, and you still carry the same signed affirmation and the same risk behind it.
If you are not sure the score you posted would survive a government assessment, that is the gap to close now.
This article provides general information about CMMC requirements and timelines. It is not legal advice. Consult your compliance or legal team for final interpretation of how these requirements apply to your specific contracts and obligations.
Not sure your SPRS score would survive a government assessment?
InterSec runs a CMMC gap review that reconciles your posted score against your SSP and evidence, the way an assessor would. As an RPO, we prepare you for the assessment. We do not issue the certificate.