Regulatory update · DoD CIO memo · July 13, 2026
CMMC Phase 2 is suspended. Your SPRS self-assessment still applies.
On July 13, 2026, DoD suspended CMMC Phase 2 — the November 10, 2026 third-party C3PAO-assessment requirement — and Phases 3 and 4, pending a 60-day review. What did not change is the part that reaches every contractor now.
- Phase 2 — third-party C3PAO Level 2 assessment as a condition of award
- Phases 3 and 4 (the 2027–2028 phase-in)
- NIST 800-171 self-assessment + SPRS score (DFARS 7012/7021)
- DIBCAC government-led assessments
- Prime-contractor flow-down deadlines
DoD framed the pause as “reducing red tape, not reducing cybersecurity.” A wrong self-assessed SPRS score remains a False Claims Act risk. Facts verified against DoD CIO / Federal News Network / DefenseScoop, July 13, 2026.
What changed on July 13, 2026 — and what didn't
DoD CIO Kirsten Davies signed a memo suspending CMMC Phase 2, which was set to make a third-party C3PAO assessment the default requirement for contracts involving CUI starting November 10, 2026. Phases 3 and 4 were suspended with it, pending a 60-day “top-to-bottom” review by a new CMMC Reform Task Force. What was not suspended: the Phase 1 self-assessment. DoD will keep enforcing NIST SP 800-171 Rev 2 through self-assessments and DIBCAC reviews, and your obligations under DFARS 252.204-7012 and 252.204-7021 — implement 800-171, self-assess, and post a current SPRS score — are unchanged. Primes are also still imposing their own deadlines, independent of the federal timeline.
With third-party checks paused, your self-assessment is the record
A suspended third-party assessment does not lower the bar — it shifts the weight onto your self-attested SPRS score. That number is what contracting officers, DIBCAC, and your primes look at, and it is signed under penalty of the False Claims Act. DIBCAC is actively auditing self-reported scores: in the LOGZONE matter a contractor settled for $507,144 after reporting a perfect 110 that a review found was actually −170.
The 60-day review reports around mid-September 2026, and its outcome is not yet known — it could streamline the program or change it materially. What is knowable today is your real score. Getting it right, and having a defensible SSP behind it, is the move that holds up no matter what the review decides.
The CMMC phase-in, after July 13, 2026
| Phase | Status | What it is |
|---|---|---|
| Phase 1 | Nov 10, 2025 · in force | CMMC self-assessment requirement in new DoD solicitations (DFARS 252.204-7021). Unaffected by the July 2026 suspension — still required. |
| Phase 2 | Suspended Jul 13, 2026 | Was to begin Nov 10, 2026: C3PAO-assessed Level 2 as the default for contracts involving CUI. Suspended "until further notice" pending a 60-day DoD review. |
| Phase 3 | Suspended Jul 13, 2026 | Was 2027. Paused with Phase 2 pending the review. |
| Phase 4 | Suspended Jul 13, 2026 | Was full implementation in 2028. Paused with Phase 2 pending the review. |
Source: DoD CIO memo (July 13, 2026); 32 CFR 170.3(e); DFARS 252.204-7021 (final rule effective Nov 10, 2025). Phase-2/3/4 dates suspended pending the 60-day review.
What to do now
Know your real SPRS score today
The self-assessment requirement did not pause. Run the free assessment — a 5-minute estimate or the full 110-requirement self-assessment, computed with the exact DoD Assessment Methodology: weighted deductions, partial credit, the works.
Get the score right — it's now the whole record
With third-party assessments paused, your self-attested SPRS score is what DoD, DIBCAC, and your primes rely on. A wrong score is a False Claims Act risk — the LOGZONE case settled for $507,144 over a self-reported score that was far too high. The SSP (requirement 3.12.4) gates everything: without one, no assessment can be completed.
Meet your prime's deadline, not just DoD's
Primes still flow requirements down on their own timelines — some ahead of any federal date. A current, accurate SPRS score and a defensible SSP keep you eligible whatever the 60-day review decides. Draft yours from your own answers now.
Straight answers
Was CMMC Phase 2 suspended?
Yes. On July 13, 2026, DoD suspended CMMC Phase 2 — the requirement for a third-party C3PAO assessment that was to become the default for contracts involving CUI on November 10, 2026 — along with Phases 3 and 4, pending a 60-day "top-to-bottom" review. The Phase 1 self-assessment requirement was not suspended.
Do I still need to do a NIST 800-171 self-assessment and post an SPRS score?
Yes. The self-assessment requirement remains in force, and DoD has said it will continue to enforce NIST SP 800-171 Rev 2 through self-assessments and DIBCAC reviews. Your obligations under DFARS 252.204-7012 and 252.204-7021 are unchanged: implement 800-171, self-assess, and keep a current SPRS score. A wrong score is a False Claims Act risk.
Does the suspension mean I can stop working on CMMC?
No, and treating it that way is risky. The self-assessment requirement stands, primes are still imposing their own deadlines (some ahead of any federal date), and DoD framed the pause as "reducing red tape, not reducing cybersecurity." The 60-day review reports around mid-September 2026. The safe move is to know and hold an accurate SPRS score now.
What is the 60-day review?
A cross-functional DoD "CMMC Reform Task Force" is reviewing the program against industry feedback (gathered through a Request for Information) and will report findings within about 60 days of the July 13, 2026 memo — roughly mid-September 2026. The outcome is not yet known, so treat any specific future third-party requirement as subject to change.
What happens to companies already certified or mid-assessment?
The July 13 memo did not detail the status of in-progress C3PAO assessments or already-issued certifications. If you are mid-assessment, confirm the path with your C3PAO and contracting officer. Either way, your underlying NIST 800-171 self-assessment and SPRS obligations continue unchanged. We will update this page as DoD clarifies.
The rules just moved. Your real SPRS score is still the answer.
Five minutes from now you can know your estimated SPRS score and exactly which gaps stand between you and a defensible self-assessment.
Start the free assessmentThe free score is live now. Join the waitlist for early access to the done-for-you Level 2 Readiness Sprint and founding pricing.