CMMC Phase II is suspended, but Phase I self-assessments and affirmations still apply to defense contractors

The DoD CIO’s CMMC page says Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 pending review, while Phase I self-assessments stay in place: annual Level 1 checks of FAR 52.204-21’s 15 requirements and Level 2 self-assessments of NIST SP 800-171 Rev 2’s 110.

Source facts

The DoD CIO’s CMMC page says that on July 13, 2026 the department announced the immediate suspension of CMMC Phase II requirements, originally scheduled for November 10, 2026, and established a CMMC reform task force. All Phase I self-assessment requirements remain in place, and during this period the department will enforce compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments.

Level 1 requires an annual self-assessment and annual affirmation of the 15 security requirements in FAR clause 52.204-21, with results entered in SPRS and no plans of action and milestones permitted. Level 2 self-assessment covers the 110 requirements of NIST SP 800-171 Revision 2 every three years with annual affirmation; POA&Ms are permitted but must be closed out within 180 days, and an assessment lapses if the annual affirmation is missed.

Implementation began on November 10, 2025 and is paused in Phase 1. The page says this does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and that contractors and subcontractors entrusted with FCI or CUI must achieve a specific CMMC level as a condition of contract award.

Applicability

Use this for organizations in the defense supply chain. The CMMC review may change requirements, so check the DoD CIO page and each solicitation’s clauses before relying on the current status.

DSE recommendation

DSE recommends that defense contractors keep their Phase I self-assessments and annual affirmations current in SPRS despite the Phase II suspension. Identify which systems process FCI or CUI, keep evidence for each FAR 52.204-21 and NIST SP 800-171 control, track any open POA&M items against the 180-day limit, and set calendar reminders for each annual affirmation so a missed date does not lapse the status.

Verification

Before each affirmation, have someone outside the IT team review the evidence for a sample of controls, confirm SPRS entries match the current assessment, and record the affirming official and date.

Official reference

DoD Chief Information Officer — About CMMC. Reviewed October 18, 2026.