CMMC has not been cancelled. On July 13, 2026, the Department suspended the Phase II rollout of mandatory third-party CMMC requirements and launched a reform review. Current Department guidance says the program is paused in Phase 1.
What remains active
- Level 1 Self may be required in applicable procurements.
- Level 2 Self may be required in applicable procurements.
- Applicable DFARS 252.204-7012 safeguarding and incident-reporting obligations remain in force.
- NIST SP 800-171 Revision 2 remains the CMMC Level 2 security baseline.
- Applicable DFARS 252.204-7019/7020 NIST SP 800-171 DoD Assessment and SPRS obligations remain relevant.
What is suspended
The Department's implementation memorandum directs program managers and requiring activities not to designate Level 2 C3PAO or Level 3 DIBCAC CMMC requirements during the suspension. Active solicitations containing those requirements are to be amended, and existing contracts are to be modified under the memorandum's instructions.
Current Level 2 Self requirements
Level 2 Self is not annual. The self-assessment is conducted every three years against the 110 NIST SP 800-171 Revision 2 security requirements. An affirmation is submitted after the assessment and annually thereafter. Limited POA&M use remains subject to the CMMC rule.
What contractors should do now
- Review the applicable solicitation, contract, order and prime flow-down.
- Confirm whether the requirement is Level 1 Self or Level 2 Self.
- Continue implementing NIST SP 800-171 Rev. 2 when CUI is in scope.
- Ensure the SSP, asset inventory and supporting evidence match the operating environment.
- Maintain the DFARS Basic Assessment/SPRS numeric score separately from the CMMC Level 2 Self result and status.
- Maintain evidence suitable for future government or independent verification without representing a C3PAO assessment as currently mandatory when it is not required.
Review CUI scope during the suspension
If CUI is distributed across ordinary corporate email, file shares and endpoints, the CMMC environment may be broader than necessary. Where the workflow permits, a secure enclave can concentrate CUI into a smaller protected environment and may reduce implementation and operating cost. PreVeil is one enclave option, but an enclave does not automatically remove all surrounding systems from scope and does not satisfy all 110 requirements.
Current status
Phase II mandatory C3PAO requirements are suspended; Phase I self-assessment requirements remain active. Contractors should continue implementing the applicable security requirements, maintain accurate SPRS and CMMC records, and prepare for the assessment type stated in their procurement documents.
Level 2 Self readiness · CMMC cost · Secure enclave planning