What happens to CMMC Phase 2 on November 10, 2026?

By Hugh Donatello, LAN Service Group · Reviewed October 17, 2026

Short answer

As of October 17, 2026, nothing new is scheduled to start. Under 32 CFR 170, Phase 2 was set to begin November 10, 2026, adding CMMC Level 2 (C3PAO) certification as a condition of award. On July 13, 2026, the Department of War CIO suspended that transition and put all pending CMMC milestones on hold. Until further guidance, new solicitations may require only Level 1 (Self) or Level 2 (Self), and DFARS 252.204-7012 still applies.

What Phase 2 was supposed to be

The CMMC Program rule, 32 CFR Part 170, took effect on December 16, 2024. It rolls CMMC into DoD contracts in four phases. Phase 1 began on the effective date of the DFARS rule that puts CMMC into contracts, which was November 10, 2025. In Phase 1, DoD intended to include CMMC Level 1 (Self) or Level 2 (Self) in applicable solicitations, and could at its discretion require Level 2 (C3PAO) in place of Level 2 (Self).

The rule says Phase 2 begins one calendar year after the start of Phase 1, which made the date November 10, 2026. In Phase 2, DoD intended to add a CMMC Status of Level 2 (C3PAO) as a condition of award for applicable solicitations and contracts. That means an independent assessment by an authorized CMMC Third-Party Assessment Organization (C3PAO), not just a self-assessment. The rule also let DoD defer the C3PAO requirement to an option period, and include Level 3 (DIBCAC) requirements for some contracts.

Phase 3 and Phase 4 were to follow at one-year intervals, ending in full implementation in which CMMC requirements appear in all applicable solicitations and contracts, including option periods on older contracts.

What the July 13, 2026 memos changed

On July 13, 2026, the Department of War Chief Information Officer issued a memo titled Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of CMMC Requirements. It suspends the November 2026 transition to Phase 2 and states that all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice. The same day, the Under Secretary of War for Acquisition and Sustainment issued a memo implementing that suspension for program managers and contracting officers.

DFARS Class Deviation 2026-O0025, Revision 3, tells contracting officers to work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts in line with the CIO's memo. The table compares the rule as written with the rules in force during the suspension.

CMMC Phase 2: as written vs. during the suspension (as of October 17, 2026)
Item	Phase 2 as written in 32 CFR 170	During the suspension	Source
Start date	November 10, 2026, one year after Phase 1 began on November 10, 2025	Suspended. All pending and future CMMC milestones are held in abeyance; no new date has been published.	[3] [5] [1]
Level 2 (C3PAO) certification	DoD intended to require it as a condition of award for applicable contracts	May not be designated in procurement requests or requirement documents	[3] [1] [2]
Level 3 (DIBCAC)	DoD could include it at its discretion	May not be designated	[3] [2]
Level 1 (Self) and Level 2 (Self)	Continue from Phase 1	The only CMMC levels new requirement documents may include	[3] [1] [2]
Active solicitations already asking for C3PAO or DIBCAC	Not applicable	Must be amended to remove those requirements	[2]
Existing contracts with C3PAO or DIBCAC requirements	Not applicable	Removed by modification before the next option or at the next administrative modification	[2] [4]
Waivers	Available under the rule's waiver process	No waivers granted during the review	[3] [2]
DFARS 252.204-7012 and NIST SP 800-171 Rev 2	Apply	Remain in effect	[1] [2] [7]

Read the CMMC clause and the level in each solicitation. Your contract language governs, not this summary.

Where the review stands

The CIO's memo set up a CMMC Reform Task Force to run a 60-day, top-to-bottom review of the program. Its stated mandate is to recommend a reformed cybersecurity framework that prioritizes speed to capability, lowers barriers for small, medium and non-traditional businesses, and replaces prohibitive third-party compliance models with scalable, realistic security measures. The memo says further guidance will be issued in the coming months.

That 60-day window would have closed in September 2026. As of October 17, 2026, we have not found published results or new guidance from the DoW CIO, and a search of the Federal Register shows no new CMMC rule since the suspension. Treat reports about new dates, a revised model or changed assessment rules as unconfirmed until they appear from the DoW CIO or in the Federal Register.

Phase 2 will not necessarily return in its original form. The Task Force's mandate points away from third-party compliance models, so plan for several outcomes: a return of C3PAO certification, a different assessment model, or continued reliance on self-assessments and government-led checks. The work that holds up under every one of those outcomes is the same: an accurate scope, an implemented and evidenced NIST SP 800-171 program, and an honest score.

What still applies on November 10, 2026 and after

The suspension paused CMMC milestones. It did not remove the security requirements. The CIO's memo says that during the suspension the Department will keep enforcing baseline compliance with NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments, and that DFARS 252.204-7012 remains in effect.

DFARS 252.204-7012: implement NIST SP 800-171 Rev 2 on systems that handle covered defense information, report cyber incidents to DoD within 72 hours of discovery, and use cloud services that meet security equivalent to the FedRAMP Moderate baseline.
Level 2 (Self): score all 110 requirements with the CMMC Scoring Methodology and post results in SPRS.
Affirmations: under 32 CFR 170.22, a senior Affirming Official affirms continuing compliance after every assessment, including POA&M closeout, and annually after that.
POA&M limits: Conditional Level 2 status needs an assessment score of at least 88 (0.8 of 110), keeps certain requirements off the POA&M, and expires if open items are not closed out within 180 days.
Flow-down: the CMMC clause, DFARS 252.204-7021, requires primes to flow the right CMMC level to subcontractors that will handle FCI or CUI and to check their current status before subcontract award.

A planned change to watch: NIST SP 800-171 Rev 3

CMMC Level 2 is built on NIST SP 800-171 Rev 2, and both July 13 memos keep Rev 2 as the baseline. Separately, the Department of War's entry in the 2026 Unified Agenda, published in the Federal Register on August 14, 2026, lists a planned amendment to 32 CFR 170 at the final rule stage. It would define a deadline and transition period for moving from Rev 2 to Rev 3.

As of October 17, 2026, that amendment has not been published, so Rev 2 still governs. Keep assessing against Rev 2, but expect Rev 3 to arrive with a transition period, and avoid tools or documents that cannot map to both.

What a defense contractor should do before November 10

Treat November 10, 2026 as a checkpoint for your own program, not a deadline DoD will enforce. The obligations that apply today do not depend on the review's outcome.

Confirm your scope: where FCI and CUI enter, live and leave your business, including cloud services and outside IT providers.
Bring the System Security Plan up to date. A missing SSP cannot be placed on a POA&M.
Re-score honestly against all 110 requirements and update SPRS if your score has changed.
Close POA&M items on schedule and keep the evidence: screenshots, configurations, logs and signed policies.
Make sure the person who will sign the annual affirmation understands what they are attesting to.
Read every new solicitation's CMMC clause. A requirement document issued during the suspension should not ask for Level 2 (C3PAO); if one does, ask the contracting officer.

Should you still get a C3PAO assessment?

Some companies may choose a voluntary C3PAO assessment to validate readiness or to answer questions from a prime contractor. New requirement documents cannot currently call for one, and the Task Force's mandate means the assessment model may change. If you are weighing it, decide based on your contracts and your primes' expectations, and confirm the assessor in The Cyber AB's CMMC Marketplace. The Code of Professional Conduct required by 32 CFR 170.8 bars CMMC ecosystem members who consulted to prepare you from taking part in your Level 2 certification assessment within 3 years, so keep the roles separate.

Common follow-up questions

Is CMMC cancelled?

No. 32 CFR Part 170 is still in force, but the Department of War has suspended the Phase 2 transition and put all pending and future CMMC implementation milestones on hold until further notice. CMMC Level 1 (Self) and Level 2 (Self) can still be required, and DFARS 252.204-7012 still applies.

Will CMMC Level 2 certification be required on November 10, 2026?

Not under the guidance in force on October 17, 2026. The July 13, 2026 memos suspended the November 2026 Phase 2 transition and bar program managers from designating Level 2 (C3PAO) in requirement documents during the suspension.

When will Phase 2 start?

No new date has been published, and Phase 2 may not return in its original form. The CIO's memo says further guidance will come in the coming months. Watch the DoW CIO's CMMC pages and the Federal Register, and check each solicitation's clause.

Do I still need to post a score in SPRS?

Yes, if your contract or solicitation calls for it. Level 2 (Self) means scoring all 110 NIST SP 800-171 Rev 2 requirements, posting the results in SPRS and keeping a current affirmation from a senior official.

What if a contract I already hold requires a C3PAO assessment?

Phase 1 allowed DoD to require Level 2 (C3PAO) at its discretion, so some contracts include it. The implementing memo directs contracting officers to remove C3PAO and DIBCAC requirements by modification before the next option period or at the next scheduled administrative modification. Ask your contracting officer how they will handle your contract.

Is CMMC moving to NIST SP 800-171 Rev 3?

Not yet. Both July 13, 2026 memos keep Rev 2 as the baseline. DoD's 2026 Unified Agenda lists a planned amendment to 32 CFR 170 that would set a transition period to Rev 3, but none had been published as of October 17, 2026.

Need help with this?

LAN Service Group's ISSO-led CMMC practice keeps defense suppliers ready through the Phase 2 suspension: scoping CUI, maintaining the SSP and POA&M, and keeping the SPRS self-assessment honest and current, so you are prepared for whatever assessment model DoD adopts next. We prepare clients; we never certify them.

Talk to LAN Service Group LAN Service Group CMMC services → (888) 281-7243