Guides CMMC and SPRS

CMMC Phase II is suspended: what still applies

CMMC Phase II suspended on July 13, 2026: Level 1 and 2 self-assessments, SPRS scores, annual affirmations, the 180-day POA&M rule and DFARS 7012 still apply.

By Chris Edwards, Edwards Consulting Group · Updated October 21, 2026

On July 13, 2026 the Department of War suspended CMMC Phase II, which had been scheduled to begin on November 10, 2026, and opened a 60-day review of the program. Phase I did not change: a Level 1 (Self) annual self-assessment and affirmation, a Level 2 (Self) self-assessment every three years with an annual affirmation, results and affirmations in SPRS, the 180-day POA&M closeout, and DFARS 252.204-7012 with NIST SP 800-171 Revision 2 all still apply. Third-party Level 2 (C3PAO) and Level 3 (DIBCAC) requirements may not be put in new requirements while the suspension lasts.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What did the Department of War suspend?

The Department of War's July 13, 2026 release, summarized on the DoW CIO's CMMC page, announced "the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally scheduled to come into effect on November 10, 2026", and said "All Phase I self-assessment requirements remain firmly in place." The release added that the Department "will suspend the transition to Phase II requirements of CMMC, as well as pending and future CMMC implementation milestones across the Department of War solicitations and contracts."

The phases come from 32 CFR 170.3(e). Phase 1 began on the effective date of the DFARS CMMC rule, November 10, 2025. Phase 2 was to begin one year later and add Level 2 (C3PAO) certification as a condition of award; Phase 3 was to add Level 3 (DIBCAC); Phase 4 was full implementation. The suspension stops the clock at Phase 1.

Attachment 1 to the Under Secretary of War (Acquisition and Sustainment) memo of July 13, 2026, Implementing Department of War Chief Information Officer's Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, gives the mechanics:

"During the period of suspension, Program Managers and requiring activities must only include the need for CMMC Level 1 (Self) or Level 2 (Self) assessments in procurement request and requirement documents."
They "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period."
Active solicitations that carried a C3PAO or DIBCAC requirement must be amended to remove it. For existing contracts, contracting officers "are directed to remove them via modification prior to the exercise of the next option period or during the next scheduled administrative modification."
"no waivers shall be granted during the review of the program."
"Further guidance will be promulgated at the conclusion of the CIO's 60-day review."

Class Deviation 2026-O0025, Revision 2 (July 16, 2026), carried into Revision 3 (September 3, 2026), on the DPCAP class deviation page, tells contracting officers to work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts in line with the CIO's July 13, 2026 memo.

What still applies after the CMMC pause?

The Department's own statement is the shortest answer. Attachment 1 to the implementing memo says: "during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments. The cybersecurity requirements outlined in the clause at DFARS 252.204-7012 ... remain in effect." The release says the same: "All defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012."

Requirement	Rule	Status
Level 1 (Self): annual self-assessment and affirmation, results in SPRS	32 CFR 170.15	Applies
Level 2 (Self): self-assessment every three years, annual affirmation, results in SPRS	32 CFR 170.16	Applies
POA&M allowed only at a score of 80 percent or more, closed out within 180 days	32 CFR 170.21	Applies
Affirmation by an Affirming Official after each assessment and annually	32 CFR 170.22	Applies
CMMC flowdown to subcontractors at the level the information requires	32 CFR 170.23	Applies for Level 1 (Self) and Level 2 (Self)
DFARS 252.204-7012 and NIST SP 800-171 Rev 2	DFARS clause	Applies, unchanged
Level 2 (C3PAO) certification	32 CFR 170.17	Not to be designated during the suspension
Level 3 (DIBCAC)	32 CFR 170.18	Not to be designated during the suspension

Is a CMMC Level 2 self-assessment still required?

Yes, where a contract or subcontract names Level 2 (Self), which it may do for any requirement that involves controlled unclassified information. Under 32 CFR 170.16(a)(1), the organization "must conduct a Level 2 self-assessment every three years and submit the results in SPRS". Before award of any contract or subcontract with a Level 2 (Self) requirement, 170.16(b) says the organization must have achieved Conditional or Final Level 2 (Self) and submitted an affirmation in SPRS. The inputs to SPRS include the overall score (for example 105 out of 110), the CMMC status date, the assessment scope, the CAGE codes covered and POA&M usage.

The assessment is against the 110 requirements of NIST SP 800-171 Revision 2, using the objectives of NIST SP 800-171A (June 2018), scored by the method in 32 CFR 170.24. Achieving Level 2 (Self) also satisfies Level 1 (Self) for the same scope (170.16(a)).

The suspension changed what a requiring activity may ask for, not what a self-assessment is.

What is the CMMC annual affirmation?

32 CFR 170.22 requires an Affirming Official, "the senior level representative from within each Organization Seeking Assessment", to affirm continuing compliance "after every assessment, including POA&M closeout, and annually thereafter". The affirmation is entered in SPRS and names the official, their title and contact information, and states that the organization "has implemented and will maintain implementation of all applicable CMMC security requirements". The rule applies "whether a prime or subcontractor". For Level 2 (Self), the DoW CIO's About page notes that the assessment "will lapse upon failure to annually affirm".

DFARS 252.204-7021 (d)(3) carries the same duty into the contract: an annual affirmation in SPRS for each CMMC UID used in performance. See DFARS and FAR cybersecurity clauses, as of 2026.

What are the POA&M rules during the suspension?

Unchanged. Under 32 CFR 170.21(a), no POA&M is permitted at Level 1. At Level 2 (Self), a Conditional status is allowed only if the score divided by 110 is at least 0.8 (a score of 88), no item on the POA&M is worth more than 1 point (except 3.13.11 when encryption is in place but not FIPS-validated), and none of six named requirements (3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5) is on it. Under 170.21(b) and 170.16(a)(1)(ii)(B), the POA&M must be closed out by a closeout self-assessment "within 180 days of the CMMC Status Date associated with the Conditional Level 2 (Self)" or the Conditional status expires; if it expires during a contract, "standard contractual remedies will apply". The detail is in POA&M rules.

What happens next: the CMMC Reform Task Force

The release said the Department CIO "is establishing a CMMC Reform Task Force to conduct a comprehensive top-to-bottom review of the certification program", which would synthesize responses to a public Request for Information and deliver "their final report to the DoW CIO within 60 days". CIO Kirsten A. Davies described it as "a 60-day study of the future of this program". Sixty days from July 13, 2026 was September 11, 2026.

As of October 21, 2026 we have not found the task force's report published on dodcio.defense.gov or war.gov, and no further guidance ending or extending the suspension. The DoW CIO's CMMC page, as of mid-October 2026, says "The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels" and that "CMMC implementation is paused in Phase 1. This action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012."

What a supplier should do now

Keep your Level 2 (Self) assessment current and its score in SPRS, and record the status date: the three-year clock and the 180-day POA&M clock both run from it.
Put the annual affirmation on a calendar. It is the one thing that lapses quietly.
If you hold a Conditional status, close the POA&M inside 180 days and affirm again after the closeout self-assessment.
If a solicitation or contract still names Level 2 (C3PAO) or Level 3, expect an amendment or modification removing it; the attachment to the July 13, 2026 implementing memo directs contracting officers to do so.
Do not stand down on NIST SP 800-171 Revision 2. It is the baseline the Department says it is enforcing during the suspension.

Where Tiermark fits

Supplier Pro's Compliance dates page works out the next self-assessment (three years), the next affirmation (one year) and the POA&M closeout (180 days from the Conditional status date) from the dates you enter, and emails your admins before each. The SPRS calculator scores the 110 requirements by the 32 CFR 170.24 method and lists any gap that cannot go on a POA&M. Tiermark does not post or affirm anything in SPRS; your Affirming Official does.

Sources

Still have a question?

Write to help@tiermark.io and a person will answer.