CMMC Timeline: Phases, Dates and the Phase 2 Suspension
By Shaheer Malik · Updated Oct 16, 2026
Phase 1 of CMMC has applied since November 10, 2025. Phase 2, which was due on November 10, 2026, was suspended by the Department of War on July 13, 2026, and no new date has been set.[1][2][3]
What applies today
Phase 1 self-assessment requirements stay in effect: Level 1 (Self) or Level 2 (Self) for applicable contracts, with annual affirmations and SPRS scores. DFARS 252.204-7012 and NIST SP 800-171 Revision 2 still apply.[3][4] The Department may still require a Level 2 (C3PAO) assessment as a condition of award at its discretion under Phase 1.[3]
The Phase 2 suspension
Two memoranda dated July 13, 2026 suspended Phase 2: the planned requirement for Level 2 (C3PAO) certification, and Level 3, as a condition of award. Active solicitations are to be amended to remove those requirements, and existing contracts modified.[3] A CMMC Reform Task Force is reviewing the program and reporting to the Department’s Chief Information Officer; the review may change the assessment structure, the schedule, or both.[4]
The phases as written in the 2024 rule
| Phase | Date in the rule | Status |
|---|---|---|
| Phase 1: Level 1 (Self) or Level 2 (Self) as a condition of award | Nov 10, 2025 | In effect |
| Phase 2: adds Level 2 (C3PAO) for applicable contracts | Nov 10, 2026 | Suspended July 13, 2026 |
| Phase 3: Level 2 (C3PAO) for all applicable contracts; Level 3 (DIBCAC) | Nov 10, 2027 | On hold pending review |
| Phase 4: full implementation, including option periods on older contracts | Nov 10, 2028 | On hold pending review |
The phase definitions come from 32 CFR 170.3(e): Phase 1 starts on the DFARS rule's effective date and each later phase one calendar year after the last.[1][2]
The two rules behind CMMC
- 32 CFR part 170, the CMMC Program rule, effective December 16, 2024. It defines the levels, assessments and ecosystem.[1]
- 48 CFR (DFARS), effective November 10, 2025. It puts CMMC requirements into DoD solicitations and contracts.[2]
What to do now
Keep your NIST SP 800-171 implementation, SPRS score and annual affirmations current: those obligations did not pause. If your customers or a specific solicitation ask for a C3PAO certification, that can still happen under Phase 1. Watch for the task force’s recommendations before planning around the old Phase 2 date.
FAQ
Is CMMC Phase 2 still starting on November 10, 2026?
No. The Department of War suspended Phase 2 on July 13, 2026 and has not set a new date. Phase 1 self-assessment requirements remain in effect.
Do I still need to meet NIST SP 800-171?
Yes. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 still apply, along with Phase 1 self-assessments, SPRS scores and annual affirmations.
Can a contract still require a C3PAO assessment?
Yes. During the suspension the Department may still require a Level 2 (C3PAO) assessment as a condition of award at its discretion under Phase 1.
Sources
- Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
- DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), 90 FR 43560 (Sep 10, 2025) (checked Oct 16, 2026)
- Holland & Knight: DOW Suspends CMMC Phase II Requirements (July 2026) (checked Oct 16, 2026)
- WilmerHale: Pentagon Suspends CMMC Phase 2 Requirements and Launches Review (July 20, 2026) (checked Oct 16, 2026)
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.