The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.
\nThe DoD CIO’s CMMC page says that on July 13, 2026 the department announced the immediate suspension of CMMC Phase II requirements, originally scheduled for November 10, 2026, and established a CMMC reform task force. All Phase I self-assessment requirements remain in place, and during this period the department will enforce compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments.
\nLevel 1 requires an annual self-assessment and annual affirmation of the 15 security requirements in FAR clause 52.204-21, with results entered in SPRS and no plans of action and milestones permitted. Level 2 self-assessment covers the 110 requirements of NIST SP 800-171 Revision 2 every three years with annual affirmation; POA&Ms are permitted but must be closed out within 180 days, and an assessment lapses if the annual affirmation is missed.
\nImplementation began on November 10, 2025 and is paused in Phase 1. The page says this does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and that contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award.
\nUse this for organizations in the defense supply chain. The CMMC review may change requirements, so check the DoD CIO page and each solicitation’s clauses before relying on the current status.
\nDSE recommends that defense contractors keep their Phase I self-assessments and annual affirmations current in SPRS despite the Phase II suspension. Identify which systems process FCI or CUI, keep evidence for each FAR 52.204-21 and NIST SP 800-171 control, track any open POA&M items against the 180-day limit, and set calendar reminders for each annual affirmation so a missed date does not lapse the status.
\nBefore each affirmation, have someone outside the IT team review the evidence for a sample of controls, confirm SPRS entries match the current assessment, and record the affirming official and date.
\nDoD Chief Information Officer — About CMMC. Reviewed October 18, 2026.
", "content_text": "The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.\nSource facts\nThe DoD CIO’s CMMC page says that on July 13, 2026 the department announced the immediate suspension of CMMC Phase II requirements, originally scheduled for November 10, 2026, and established a CMMC reform task force. All Phase I self-assessment requirements remain in place, and during this period the department will enforce compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments.\nLevel 1 requires an annual self-assessment and annual affirmation of the 15 security requirements in FAR clause 52.204-21, with results entered in SPRS and no plans of action and milestones permitted. Level 2 self-assessment covers the 110 requirements of NIST SP 800-171 Revision 2 every three years with annual affirmation; POA&Ms are permitted but must be closed out within 180 days, and an assessment lapses if the annual affirmation is missed.\nImplementation began on November 10, 2025 and is paused in Phase 1. The page says this does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and that contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award.\nApplicability\nUse this for organizations in the defense supply chain. The CMMC review may change requirements, so check the DoD CIO page and each solicitation’s clauses before relying on the current status.\nDSE recommendation\nDSE recommends that defense contractors keep their Phase I self-assessments and annual affirmations current in SPRS despite the Phase II suspension. Identify which systems process FCI or CUI, keep evidence for each FAR 52.204-21 and NIST SP 800-171 control, track any open POA&M items against the 180-day limit, and set calendar reminders for each annual affirmation so a missed date does not lapse the status.\nVerification\nBefore each affirmation, have someone outside the IT team review the evidence for a sample of controls, confirm SPRS entries match the current assessment, and record the affirming official and date.\nOfficial reference\nDoD Chief Information Officer — About CMMC. Reviewed October 18, 2026.", "content_markdown": "The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.\n\n## Source facts\n\nThe [DoD CIO’s CMMC page](https://dodcio.defense.gov/CMMC/About/) says that on July 13, 2026 the department announced the immediate suspension of CMMC Phase II requirements, originally scheduled for November 10, 2026, and established a CMMC reform task force. All Phase I self-assessment requirements remain in place, and during this period the department will enforce compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments.\n\nLevel 1 requires an annual self-assessment and annual affirmation of the 15 security requirements in FAR clause 52.204-21, with results entered in SPRS and no plans of action and milestones permitted. Level 2 self-assessment covers the 110 requirements of NIST SP 800-171 Revision 2 every three years with annual affirmation; POA&Ms are permitted but must be closed out within 180 days, and an assessment lapses if the annual affirmation is missed.\n\nImplementation began on November 10, 2025 and is paused in Phase 1. The page says this does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and that contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award.\n\n## Applicability\n\nUse this for organizations in the defense supply chain. The CMMC review may change requirements, so check the DoD CIO page and each solicitation’s clauses before relying on the current status.\n\n## DSE recommendation\n\nDSE recommends that defense contractors keep their Phase I self-assessments and annual affirmations current in SPRS despite the Phase II suspension. Identify which systems process FCI or CUI, keep evidence for each FAR 52.204-21 and NIST SP 800-171 control, track any open POA&M items against the 180-day limit, and set calendar reminders for each annual affirmation so a missed date does not lapse the status.\n\n## Verification\n\nBefore each affirmation, have someone outside the IT team review the evidence for a sample of controls, confirm SPRS entries match the current assessment, and record the affirming official and date.\n\n## Official reference\n\n[DoD Chief Information Officer — About CMMC](https://dodcio.defense.gov/CMMC/About/). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/", "url": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "CMMC Phase II is suspended, but Phase I self-assessments and affirmations still apply to defense contractors", "item": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/#article", "identifier": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/", "url": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/", "headline": "CMMC Phase II is suspended, but Phase I self-assessments and affirmations still apply to defense contractors", "description": "The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments…", "abstract": "The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.", "articleBody": "The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.\nSource facts\nThe DoD CIO’s CMMC page says that on July 13, 2026 the department announced the immediate suspension of CMMC Phase II requirements, originally scheduled for November 10, 2026, and established a CMMC reform task force. All Phase I self-assessment requirements remain in place, and during this period the department will enforce compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments.\nLevel 1 requires an annual self-assessment and annual affirmation of the 15 security requirements in FAR clause 52.204-21, with results entered in SPRS and no plans of action and milestones permitted. Level 2 self-assessment covers the 110 requirements of NIST SP 800-171 Revision 2 every three years with annual affirmation; POA&Ms are permitted but must be closed out within 180 days, and an assessment lapses if the annual affirmation is missed.\nImplementation began on November 10, 2025 and is paused in Phase 1. The page says this does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and that contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award.\nApplicability\nUse this for organizations in the defense supply chain. The CMMC review may change requirements, so check the DoD CIO page and each solicitation’s clauses before relying on the current status.\nDSE recommendation\nDSE recommends that defense contractors keep their Phase I self-assessments and annual affirmations current in SPRS despite the Phase II suspension. Identify which systems process FCI or CUI, keep evidence for each FAR 52.204-21 and NIST SP 800-171 control, track any open POA&M items against the 180-day limit, and set calendar reminders for each annual affirmation so a missed date does not lapse the status.\nVerification\nBefore each affirmation, have someone outside the IT team review the evidence for a sample of controls, confirm SPRS entries match the current assessment, and record the affirming official and date.\nOfficial reference\nDoD Chief Information Officer — About CMMC. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:05+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cmmc-phase-ii-suspended-july-2026-phase-i-self-assessments-remain/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "CMMC Phase II is suspended, but Phase I self-assessments and affirmations still apply to defense contractors" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 361, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "DoD Chief Information Officer — About CMMC", "url": "https://dodcio.defense.gov/CMMC/About/" } } ] } }