CMMC Phase 2 Is Suspended. Here's What Still Applies to Your Contracts.

On July 13, 2026, the Department of War suspended CMMC Phase 2 — the part of the rollout that required third-party assessments from certified assessment organizations (C3PAOs) — and ordered a top-to-bottom review of the program, with recommendations due within 60 days.

If you're a small defense contractor, you've probably seen three kinds of reactions since: consultants insisting nothing has changed, headlines suggesting CMMC is dead, and primes sending emails that don't clearly say either. None of those are quite right. Here's the plain-English version.

What was actually suspended

One thing: the requirement to get a third-party assessment (C3PAO or DIBCAC) before winning contracts that called for CMMC Level 2 or Level 3 certification. The Pentagon's own stated reason was that the certification process put “substantial costs and administrative burdens” on small and mid-sized contractors, and that there weren't enough assessors to go around.

If you were budgeting $30,000–$100,000+ for a certification assessment, that clock has stopped — at least until the review concludes.

What still applies — in every contract, right now

The suspension did not touch the underlying cybersecurity requirements. These remain in force:

• FAR 52.204-21 — the 15 basic safeguarding requirements for any contractor handling Federal Contract Information (FCI). This is the foundation of CMMC Level 1, and it's in virtually every federal contract.
• DFARS 252.204-7012 — if you handle Controlled Unclassified Information (CUI), you must implement all 110 security controls in NIST SP 800-171 and report cyber incidents within 72 hours.
• DFARS 252.204-7019/7020 — you must have a current self-assessment score posted in SPRS (the government's Supplier Performance Risk System). Contracting officers check it. Primes check it. An expired or missing score can cost you awards while you never hear why.
• Level 1 and Level 2 self-assessments — the self-attestation path was explicitly left standing. Annual affirmation is still expected.

Put simply: the expensive audit is paused. The homework is still due.

What your prime will do

Nothing in the suspension changed your prime's flowdown obligations under DFARS 7012. Primes are still on the hook for their supply chain, which means they will keep asking you for your SPRS score, your self-attestation, and your System Security Plan — some more aggressively now, precisely because the third-party checkpoint is gone. The contractors who can produce clean documentation on request will keep winning work. The ones who treat the suspension as a holiday will get quietly filtered out of bid lists.

What happens next

A reform task force is reviewing the program, and the Department issued a public Request for Information (responses due August 14, 2026) asking industry about cost drivers and commercial tools. Nobody knows exactly what comes back. But read the Pentagon's own rationale — the third-party model was too expensive for small business — and the likely direction is more reliance on self-assessment, not less. Contractors with strong self-assessment documentation are positioned for every plausible outcome. Contractors with nothing are betting the review makes requirements disappear. It won't: DFARS 7012 has survived three administrations.

What we'd do this month if we were you

We are you — GreyLee is a Service-Disabled Veteran-Owned Small Business working in the same DoD ecosystem. Here's the honest checklist:

1. Confirm what you handle. FCI only → Level 1 self-attestation territory. CUI → NIST 800-171 and a SPRS score.
2. Check your SPRS score date. If it's more than a year old or missing, that's your most urgent gap — it's visible to every contracting officer today.
3. Get your documentation in order — SSP, self-assessment worksheet, affirmation record. This is hours of structured work, not months of consulting.
4. Don't sign a five-figure certification-prep contract this month. Whatever the reform review produces, you'll know by fall. Spend hundreds getting your self-assessment documented, not tens of thousands preparing for an audit that's suspended.

Our product generates Level 1 self-attestation documentation in an afternoon for $499/year. If you're not sure where you stand, the free 60-second readiness check will tell you — no signup required. And if you're a prime trying to get attestations from 40 subcontractors, talk to us.