For two years, every small defense contractor heard the same deadline: November 10, 2026, the day third-party CMMC Level 2 certifications would start showing up as a condition of award. Then on July 13, 2026, the Department of War suspended Phase 2. A lot of small businesses heard "suspended" and stopped working on cybersecurity.
That is a mistake that can cost you contracts now and a False Claims Act case later. The certification step paused. The underlying cybersecurity requirements did not. This guide explains exactly what is in force for DoD contractors in late 2026, what changed, what is still pending, and a practical plan for FY2027.
How We Got Here: The CMMC Timeline
| Date | Event |
|---|---|
| Dec 16, 2024 | CMMC program rule (32 CFR Part 170) takes effect. |
| Sept 10, 2025 | DFARS acquisition rule (DFARS Case 2019-D041) published, adding DFARS 252.204-7021 to solicitations. |
| Nov 10, 2025 | Phase 1 begins. Level 1 and Level 2 self-assessments can be required as a condition of award. |
| June 23, 2026 | FAR Council re-proposes the government-wide FAR CUI rule (FAR Case 2026-001), pointing to NIST SP 800-171 Revision 3. |
| July 13, 2026 | Phase 2 suspended. The Department of War pauses C3PAO-based Level 2 requirements and launches a CMMC Reform Task Force with a 60-day review. |
| Sept 3, 2026 | DFARS Class Deviation 2026-O0025, Revision 3 carries the pause into contract clauses. |
| Nov 10, 2026 | Original Phase 2 date. No longer in effect. |
| Pending | Task Force recommendations; a possible interim rule moving CMMC to NIST SP 800-171 Rev. 3; the final FAR CUI rule. |
What Was Suspended
The July 13 memos from the Under Secretary of War for Acquisition and Sustainment and the DoW Chief Information Officer did three things:
- Paused Phase 2, which would have required third-party (C3PAO) Level 2 certification on many contracts starting November 10, 2026.
- Paused Phase 3 requirements for existing contracts, which would have added government-led Level 3 assessments.
- Directed contracting officers to remove Phase 2 and 3 requirements from existing contracts by modification, before the next option period or at the next scheduled administrative modification.
The CIO's memo pointed to C3PAO capacity shortages and implementation barriers. A Reform Task Force was given 60 days to deliver recommendations, and an industry RFI closed August 14, 2026. As of late September 2026, the report had not been released and no restart date for Phase 2 had been set.
What Still Applies Right Now
This is the part most small businesses get wrong. The department said Phase 1 requirements "remain firmly in place." Here is what that means:
1. DFARS 252.204-7012 is unchanged
If your contract includes DFARS 252.204-7012 and you handle Covered Defense Information, which includes CUI, you must:
- Provide "adequate security" by implementing the 110 requirements of NIST SP 800-171 Revision 2.
- Report cyber incidents to DoD within 72 hours of discovery.
- Preserve images of affected systems and give DoD access when requested.
- Flow the clause down to subcontractors who handle CUI.
2. SPRS scores and self-assessments
- Your NIST SP 800-171 self-assessment score must be posted in the Supplier Performance Risk System (SPRS). Scores range from -203 to 110.
- Where a contract requires CMMC Level 1 (Self) or Level 2 (Self), you must complete the self-assessment, post it in SPRS, and have an affirming official make an annual affirmation of continuing compliance.
- DoD said it will enforce NIST SP 800-171 during the suspension through self-assessments and selected government-led assessments.
3. Level 1 basic safeguarding
If you handle only Federal Contract Information (FCI), the 15 basic safeguarding requirements still apply, with an annual self-assessment and affirmation where CMMC Level 1 is required. Note: under the class deviation, the FAR basic safeguarding clause has been renumbered in the new FAR Part 40 structure. Check the clause numbers in your actual contract.
4. Prime contractor flow-downs
Primes still have to verify that subcontractors meet the required CMMC level before awarding subcontracts. Several large primes told suppliers in July 2026 to keep maturing their programs. Expect primes to keep asking for SPRS scores and evidence, even without Phase 2.
CMMC Levels at a Glance
| Level | Protects | Requirements | Assessment | Status in late 2026 |
|---|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 basic safeguarding requirements | Annual self-assessment and affirmation | In effect |
| Level 2 | Controlled Unclassified Information (CUI) | 110 requirements of NIST SP 800-171 Rev. 2 | Self-assessment, or C3PAO certification every 3 years | Self-assessment in effect; C3PAO requirement paused |
| Level 3 | CUI on high-priority programs | Level 2 plus selected NIST SP 800-172 requirements | Government-led (DIBCAC) assessment | Paused for existing contracts |
A conditional Level 2 status allows open items on a Plan of Action and Milestones (POA&M) only if the assessment score is at least 80% of the maximum (88 of 110), and the POA&M must be closed within 180 days. Final Level 2 and Level 3 statuses are valid for three years with annual affirmations.
Why Pausing Your Program Is a Bad Bet
The False Claims Act did not pause
Your SPRS score and annual affirmations are statements to the government. If they are inflated, that can be a false claim. The Department of Justice continues to bring cybersecurity cases. Public settlements in 2026 included a defense manufacturer paying about $507,000 in June after DoD assessors scored its NIST 800-171 implementation at -170, and an aerospace company paying about $2 million in September. A lower, honest score with a credible POA&M is far safer than a high number you cannot defend.
Primes are still screening suppliers
Primes carry flow-down responsibility and reputational risk. Many are still using cybersecurity questionnaires and SPRS checks to choose subcontractors. A small business with a documented system security plan and a real SPRS score wins teaming spots that an unprepared competitor loses.
Phase 2 is paused, not cancelled
The Task Force is evaluating alternatives aimed at "realistic, scalable security measures" and lower barriers for small businesses. Whatever comes back, it will still be built on protecting CUI. Firms that keep implementing NIST SP 800-171 will be ready for any restart. Firms that stop will face a six-to-twelve-month scramble.
NIST SP 800-171 Revision 3 is coming
The re-proposed FAR CUI rule would move civilian-agency CUI requirements to NIST SP 800-171 Revision 3, with 72-hour incident reporting, and the Unified Agenda lists an interim rule to move CMMC to Revision 3. DFARS 252.204-7012 and CMMC still reference Revision 2 today. Build on Revision 2 now and map to Revision 3 as you go.
Your FY2027 CMMC Action Plan
- Inventory your contracts. List every contract and subcontract with DFARS 252.204-7012, 252.204-7019/-7020 or their successors, and any CMMC clause. Read the actual clauses in your latest modification.
- Decide where CUI lives. Draw the boundary of the systems that store, process, or transmit CUI. A smaller boundary, such as a dedicated enclave, makes everything cheaper.
- Update your System Security Plan (SSP). Every one of the 110 requirements should say how you meet it, or why it is on your POA&M.
- Re-score yourself honestly using the DoD Assessment Methodology and post the result in SPRS. Record the date. Scores expire after three years.
- Work the POA&M, starting with the high-weight requirements: multifactor authentication, FIPS-validated encryption for CUI, and incident response.
- Practice incident reporting. Make sure someone can report to DoD within 72 hours, and that you have the required medium assurance certificate to do it.
- Get your affirming official ready. Annual affirmations should be signed by a senior person who has actually reviewed the evidence.
- Talk to your primes. Ask what they will require from subcontractors in 2027, in writing.
- Watch three things: the Task Force report, any new class deviation revision, and the FAR CUI final rule, which was targeted for late 2026.
- Keep C3PAO readiness as a 2027 option. Assessments remain available voluntarily, and a certificate is a strong differentiator in teaming even while it is not required.
What This Means for Small Businesses Chasing DoD Contracts
The pause lowers the immediate barrier to entry. A small business can still bid on DoD work that involves CUI with a self-assessment, where the contract allows it. That is a real opening for firms that were waiting for certification capacity.
But the bar for winning did not drop. Contracting officers and primes still evaluate risk, and the cost of a bad cybersecurity claim went up, not down. Use 2026-2027 to get your self-assessment honest, your SSP real, and your POA&M moving. That is the cheapest competitive advantage available in defense contracting right now.
The NIST SP 800-171 Gaps That Sink Small-Business SPRS Scores
The DoD Assessment Methodology starts every company at 110 and subtracts points for each requirement not met. Some requirements cost 5 points, some 3, some 1. Small businesses tend to lose points in the same places. Fixing these first gives you the biggest score improvement for the money.
| Common gap | Why it matters | Practical small-business fix |
|---|---|---|
| No multifactor authentication (MFA) | High-weight requirement covering privileged and network access | Turn on MFA for every account that can reach CUI, including email and remote access |
| CUI encrypted with non-FIPS-validated tools | Encryption must use FIPS-validated cryptography | Use services and devices with FIPS 140-validated modules for CUI storage and transmission |
| No written System Security Plan | Without an SSP, an assessment cannot be completed | Write the SSP first, even if many items are on the POA&M |
| No incident response capability | DFARS 7012 requires 72-hour reporting | Name a responsible person, write a one-page playbook, and test it once a year |
| No audit logging or log review | You cannot detect or investigate incidents | Turn on logging in your cloud and endpoint tools and review alerts on a schedule |
| CUI spread everywhere | Every system that touches CUI is in scope | Shrink the boundary: one enclave or one tenant for CUI, nothing else |
How Small Firms Keep CMMC Costs Under Control
The biggest cost driver is scope. A company that lets CUI land on every laptop, inbox, and file share has to secure all of them. A company that keeps CUI in one controlled place secures one thing.
- Use an enclave. Many small contractors put CUI work in a separate, locked-down cloud environment used only by the people on DoD programs. Everyone else stays out of scope.
- Buy managed services that document their controls. A provider that hands you a customer responsibility matrix saves weeks of SSP writing. Make sure you understand which requirements remain yours.
- Do not over-buy. If you only handle Federal Contract Information and never CUI, you need the 15 Level 1 safeguards, not a Level 2 program. Confirm what your contracts actually require.
- Ask the contracting officer. If a solicitation is unclear about whether CUI will be shared, submit a question during the Q&A period. The answer sets your scope.
Questions to Ask Your Prime Contractor Now
Prime contractors are where small businesses feel CMMC first. Before you sign or renew a subcontract in FY2027, get answers in writing:
- Will we receive CUI on this subcontract? What categories?
- What CMMC level and assessment type will you require from us, and by when?
- Will you accept a self-assessment and SPRS score during the Phase 2 suspension?
- Do you require a specific minimum SPRS score or a closed POA&M?
- How do you want cyber incidents reported to you, and in what timeframe?
- Will you share CUI through a system you control, which could keep our own systems out of scope?
That last question is often the cheapest win. If the prime hosts the CUI and gives you controlled access, your own environment may have far less to secure.
Scenarios: What to Do in Your Situation
You have no DoD contracts yet
Do not spend on certification yet. Learn the 15 Level 1 safeguards and implement them, because they are basic good practice and cheap. When you target a DoD opportunity, read the solicitation for DFARS 252.204-7012 and any CMMC clause before you decide to bid.
You subcontract on DoD work that involves CUI
Post an honest SPRS score now, finish your SSP, and work the POA&M. Ask your prime the six questions above. Budget for a C3PAO assessment in 2027 in case Phase 2 restarts, but do not schedule it until the Task Force direction is clear, unless a prime requires it.
You are a prime on DoD contracts with CUI
Keep your program running at full speed. Primes carry flow-down obligations, False Claims Act exposure, and supplier verification duties. A voluntary C3PAO certification is a strong discriminator in competitions and in teaming, and assessments remain available.
Frequently Asked Questions
Is CMMC Phase 2 still starting November 10, 2026?
No. The Department of War suspended Phase 2 on July 13, 2026, pending a CMMC Reform Task Force review. As of late September 2026 no restart date had been announced.
Do I still need to post a SPRS score?
Yes. Phase 1 requirements remain in place, including self-assessments posted in SPRS and annual affirmations where CMMC Level 1 or Level 2 (Self) is required. DFARS 252.204-7012 contracts also require NIST SP 800-171 implementation.
Do I still need to comply with NIST SP 800-171?
Yes, if you handle CUI under a contract with DFARS 252.204-7012. The suspension did not change the 110 requirements of NIST SP 800-171 Revision 2.
Can I still get a C3PAO Level 2 certification?
Yes. Assessments remain available. The Cyber AB reported 1,074 Level 2 certifications and 103 authorized C3PAOs as of March 2026. Certification is voluntary during the pause unless a specific contract requires it.
Will CMMC switch to NIST SP 800-171 Revision 3?
It may. The re-proposed FAR CUI rule points to Revision 3, and an interim rule to move CMMC to Revision 3 is on the regulatory agenda, but it was not published as of October 2026. CMMC and DFARS 252.204-7012 still reference Revision 2.
Related reading: the DoD contracts guide, the cybersecurity contracts guide, SDVOSB teaming and joint ventures, and 2026-2027 contracting thresholds.