CIO Support
Talk to LAN Service Group
CIO Support › CMMC & NIST 800-171

What is the current status of CMMC?

By Hugh Donatello, LAN Service Group · Reviewed

Short answer

As of October 2026, CMMC Phase 1 is in effect: since November 10, 2025, DoD solicitations can require CMMC Level 1 or Level 2 self-assessments posted in SPRS. Phase 2, which would have required third-party C3PAO certification from November 10, 2026, was suspended on July 13, 2026 pending a Department of War review. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain in force.

How we got here

  • December 16, 2024: the CMMC Program rule, 32 CFR Part 170, took effect, defining Levels 1 to 3, scoring, POA&M limits and affirmations.
  • November 10, 2025: the DFARS rule took effect, starting Phase 1. Contracts could require CMMC Level 1 (Self) or Level 2 (Self).
  • July 13, 2026: the Under Secretary of War's memo suspended the November 2026 Phase 2 transition and started a 60-day CIO review.
  • DFARS Class Deviation 2026-O0025, Revision 3: directs contracting officers to remove or revise CMMC requirements in new and existing contracts in line with the memo.

What the suspension changed

During the suspension, program managers may only include CMMC Level 1 (Self) or Level 2 (Self) in requirement documents, and may not designate Level 2 (C3PAO) or Level 3 (DIBCAC). Active solicitations that asked for C3PAO or DIBCAC assessments must be amended, and existing contracts that contain them are to be modified before the next option or administrative modification. Waivers are not being granted during the review.

What did not change

  • DFARS 252.204-7012 remains in effect, including NIST SP 800-171 Rev 2, cloud requirements and 72-hour incident reporting.
  • Level 2 (Self) still means scoring all 110 requirements, posting results in SPRS and an annual affirmation by a senior official.
  • POA&M rules still apply: a minimum score of 88 for Conditional status and closeout within 180 days.
  • DoD can still run government-led Medium or High assessments, and their results take precedence over your self-assessment.
  • The DoW CIO's CMMC page states that all Phase 1 self-assessment requirements remain in place.

What to watch next

The memo says further guidance will follow the conclusion of the CIO's 60-day review, which began in July. As of early October 2026 we have not found published guidance announcing the review's outcome on the DoW CIO site, so treat any reported changes as unconfirmed until they appear there or in the Federal Register. Check the DoW CIO CMMC page and your contracts' clauses rather than relying on secondhand summaries.

What a contractor should do now

Keep implementing. The obligations to protect CUI did not pause, and a self-assessment that your senior official affirms is now the main evidence DoD relies on. Make sure your System Security Plan is current, your SPRS score is honest and recent, and your POA&M items are closing. If Phase 2 resumes in some form, companies with a clean, evidenced self-assessment will be ready for a third-party assessment with the least rework.

Primes should also keep their supply chain in order. The CMMC clause still requires primes to flow the right CMMC level down and to make sure subcontractors that handle FCI or CUI have a current affirmation in SPRS before subcontract award and annually after that.

Common follow-up questions

Is CMMC cancelled?

No. Only the Phase 2 transition to third-party C3PAO certification is suspended. CMMC Level 1 and Level 2 self-assessments can still be required in solicitations, and the rule at 32 CFR Part 170 remains in place.

Should I still book a C3PAO assessment?

New DoD solicitations cannot currently require one. Some companies still choose a voluntary assessment to validate readiness or satisfy a prime contractor. Weigh the cost against your contracts and watch for guidance from the CIO review before committing.

Does the suspension affect GCC High or cloud requirements?

No. Cloud requirements come from DFARS 252.204-7012, which remains in effect. If you store or process CUI in a cloud service, that service must still meet the clause's cloud security and incident-reporting terms, as before the suspension.

Need help with this?

LAN Service Group's ISSO-led CMMC practice keeps defense suppliers ready through the suspension, maintaining the SSP, POA&M and SPRS self-assessment so they can move to a third-party assessment if Phase 2 resumes.

Talk to LAN Service Group (888) 281-7243

Sources