Is CMMC Going Away? The Phase 2 Pause Explained

By Shaheer Malik · Updated Oct 28, 2026

No. The CMMC rule, 32 CFR part 170, is still in force, and Phase 1 self-assessments still apply. What changed in 2026 is that the move to mandatory third-party certification (Phase 2) was suspended on July 13 and written into the DFARS by a class deviation on September 3, 2026. The safeguarding requirements under DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 did not pause.^[1]^[2]

What the September 3, 2026 class deviation says

Class Deviation 2026-O0025, Revision 3 tells contracting officers to work with requiring activities to remove or revise CMMC requirements under the CIO’s July 13 memorandum, which:^[2]

“Permits requiring activities to include CMMC Level 1 (Self) or Level 2 (Self) assessments in all procurement requests and requirement documents;”
“Requires baseline compliance with NIST SP 800-171 Rev 2 in accordance with the clause at DFARS 252.204-7012”;
“Suspends the November 2026 CMMC Phase 2 transition”;
has active solicitations amended, and existing contracts modified “prior to the exercise of the next option period or through the next scheduled administrative modification.”

The revised DFARS text still carries the CMMC clause, 252.204-7021, and its solicitation notice, 252.204-7025.^[3]

What still applies

DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 for anyone handling CUI.^[2]
Self-assessment scores in SPRS and annual affirmations where a contract requires a CMMC status.^[1]^[3]
Contracting officers checking SPRS before award, and before exercising an option, when a contract carries a CMMC level.^[3]

What the reform task force reportedly recommended

The department has not published the task force’s report. Federal News Network, which obtained a summary of the findings, reports recommendations including implementing NIST SP 800-171 Revision 3, extending POA&M time (possibly to 270 days, which would need rulemaking), credit for comparable ISO 27001 requirements, and published configurations and templates.^[4] It also reports: “Over a 90-day period, the task force says DoD could restart Phase 2 of CMMC with a narrower population.”^[4] None of this is policy until DoD acts on it.

What to do now

Keep your NIST SP 800-171 implementation, SPRS score and affirmations current; a narrower Phase 2 restart would land on companies that kept going. Track dates on the CMMC timeline and the deadlines page, or get changes by email.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Is CMMC cancelled?

No. 32 CFR part 170 is still in force. The Phase 2 requirement for third-party certification is suspended; Phase 1 self-assessments and DFARS 252.204-7012 still apply.

Is CMMC paused?

Only Phase 2. Since September 3, 2026, contracts may require Level 1 (Self) or Level 2 (Self) assessments instead of C3PAO certification, under Class Deviation 2026-O0025, Revision 3.

Will CMMC Phase 2 come back?

DoD has not set a date. Federal News Network reports the reform task force suggested Phase 2 could restart with a narrower population within 90 days, while longer-term changes go through rulemaking.

Sources

32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
Federal News Network: RFI offers path forward for DoD with CMMC (Jason Miller, Oct 27, 2026) (checked Oct 28, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.