What Was Suspended and What Was Not
CMMC's phased rollout began November 10, 2025, when the acquisition rule under 48 CFR took effect, revising DFARS 252.204-7021 and adding provision 252.204-7025 to applicable solicitations. That Phase 1 required contractors to post CMMC Level 1 or Level 2 self-assessments in the Supplier Performance Risk System (SPRS) as a condition of contract award, where a solicitation specified a CMMC level. It also made the annual affirmation — signed by an affirming official — a condition of maintaining compliance status. That structure has not changed and is not on hold.
What changed on July 13, 2026 was the upcoming transition to Phase 2. The original schedule would have required contractors handling Controlled Unclassified Information (CUI) to obtain a certified assessment by a CMMC Third-Party Assessment Organization (C3PAO) beginning November 10, 2026. The DoW issued two memoranda the same day. The CIO's memorandum, "Removing Barriers to Defense Industrial Base Expansion," directed the suspension and established the Reform Task Force. A companion implementing memorandum (publication case 26-P-1023), issued by the Under Secretary of War for Acquisition and Sustainment according to Holland & Knight, directed program managers to designate only CMMC Level 1 (Self) or Level 2 (Self) in procurement requests during the review period, and barred program offices from designating Level 2 (C3PAO) or Level 3 (DIBCAC) assessments. Waiver procedures were suspended as well.
The implementing memorandum also directed contracting officers to issue solicitation amendments removing C3PAO requirements from active procurements, and to modify existing contracts before the next option period exercise or scheduled administrative modification.
The Class Deviation Matters
A policy memorandum can be reversed as quickly as it is issued. The suspension received binding acquisition-regulation footing when Class Deviation 2026-O0025 Revision 2, issued July 16, 2026, first carried the suspension language. Revision 3, signed September 3, 2026 by John Tenaglia, the principal director of Defense Pricing, Contracting, and Acquisition Policy, carried that direction forward and superseded Revision 2. The deviation text directs contracting officers to collaborate with requiring activities to remove or revise CMMC requirements in solicitations and contracts in accordance with the July 13 CIO memo, which permits Level 1 (Self) or Level 2 (Self) assessments and requires baseline compliance with NIST SP 800-171 Rev 2.
The practical significance: including C3PAO requirements in a new solicitation, or enforcing them in an existing contract modification, would conflict with the deviation and invite protest risk — an assessment of the program management exposure, not a formal legal ruling. This constrains program offices from using the Phase 2 framework as a selection factor in competitive acquisitions until the deviation is rescinded or superseded.
The Reform Task Force and What We Know About Its Direction
The July 13 press release announced a 60-day CMMC Reform Task Force. After the RFI closed in mid-August, the task force convened in early September to consider the more than 1,100 comments the RFI generated, according to Covington. The task force's report was due to the DoW CIO on approximately September 11, 2026. As of this writing, it has not been released publicly. No new Phase 2 start date has been announced.
The RFI solicited industry input on seven areas, paraphrased from the SBA Office of Advocacy's reproduction of the questions: the top cost drivers, administrative burdens, and operational challenges of compliance; the controls delivering the most tangible cybersecurity uplift and risk reduction; requirements or controls with the highest overhead and least measurable improvement in security posture; how organizations use commercial capabilities, platforms, and managed services, and how DoW might recognize or accept them; challenges with Phase 1 self-assessments and opportunities to streamline, including whether self-assessments improved posture or are compliance-only; policy and regulatory reforms to reduce costs and barriers for small, medium, and non-traditional businesses; and policy and regulatory reforms to improve operational resilience.
The task force report remains unpublished, but Federal News Network's October 2026 reporting obtained the non-public task force summary of RFI responses and described its options. Among the directions reported: DoD could restart Phase 2 with a narrower population over a 90-day period; expanding POA&M eligibility from 180 days to 270 days, which would require rulemaking; finalizing the move to NIST SP 800-171 Rev 3; and CUI-marking clarity, which the summary said had "the greatest potential to narrow the DIB population subject to NIST 800-171." FNN also noted 58% of respondents said self-assessments improved their cybersecurity posture, while 43% called them check-the-box — though DoD noted fewer than 20% of respondents answered that question. DoD declined to comment on the contents of the report.
For program managers, a narrower-population Phase 2 restart is a materially different planning scenario than waiting for the full program to return. CUI scope definition and population eligibility are now the central variables in predicting when and how Phase 2 applies to a given program.
What is known directionally about the CIO's priorities: DoW CIO Kirsten Davies, in remarks at DIBX 2026 reported by CMMC.com and at the September Billington Cybersecurity Summit summarized by Covington, signaled that operational technology security and manufacturing-environment cyber resilience were explicit gaps in the existing framework. These align with the RFI questions on specialized environments and commercial service recognition.
DLA has published planning dates in its CMMC small-business FAQ (a living document, accessed November 4, 2026, with uncertain post-suspension currency in some sections). That page states: DLA may start implementing CMMC Level 2 (C3PAO) in contracts on about November 10, 2027; DLA will not include Level 2 (C3PAO) in manual solicitations and contracts before that date; and DLA may include Level 2 (C3PAO) in automated solicitations and contracts on November 10, 2028. These are DLA's own planning dates, not a DoW-wide announcement, and the FAQ does not state whether they reflect post-suspension replanning.
False Claims Act Exposure Persists
One reason the suspension does not create a compliance reprieve is the continuing force of the False Claims Act. SPRS self-assessments are signed by an affirming official who attests to the accuracy of the posted score. Inaccurate attestations — meaning the contractor's submitted score exceeds what its implemented controls would actually support — carry FCA exposure whether Phase 2 is active or not.
The Honeywell Aerospace settlement announced September 1, 2026, in which the company agreed to pay $2,042,518 to resolve FCA allegations, illustrates the point. The case did not involve a CMMC C3PAO assessment. Per the DOJ, it concerned one of Honeywell's networks failing to comply with NIST SP 800-171 requirements from April 2020 through December 2023 — these are allegations only, with no determination of liability. It turned on DFARS 252.204-7012 obligations whose NIST SP 800-171 implementation deadline passed on December 31, 2017, and that remain unchanged by the Phase 2 suspension. As CMMC.com noted, the government does not need CMMC Phase 2 to enforce NIST 800-171.
For DIB companies that treated the Phase 2 suspension as a signal to slow down compliance work, this is the correction: the suspension pauses external validation, not internal obligation. In a hypothetical case, a contractor who posts an SPRS score of 80 when its implemented controls would actually support a much lower score is exposed whether or not a C3PAO would have found the same gap. Primes enforcing their own flowdown requirements — many of which are contractual obligations independent of the government's phased rollout schedule — are not on pause either.
What Program Managers Should Do Now
The compliance picture for program managers writing FY2027 solicitations has four working elements.
Current clause prescription. Class Deviation 2026-O0025 is the operative instruction. Any new solicitation for work involving FCI or CUI should designate CMMC Level 1 (Self) or Level 2 (Self) per the deviation. Including C3PAO requirements would conflict with the deviation and invite protest risk. The standard to reference is NIST SP 800-171 Rev 2, which the deviation carries forward unchanged as the contractual cybersecurity baseline.
Contract modification sequence. For existing contracts that already carried C3PAO or DIBCAC requirements, contracting officers must remove those requirements before the next option period exercise or scheduled administrative modification. Program managers who have pending option exercises should confirm this modification is in progress and not waiting for broader guidance that may not arrive on a predictable timeline.
FY2027 and beyond: planning under uncertainty. Phases 3 and 4 are on hold pending notice, alongside Phase 2. The original Phase 4 date — November 10, 2028 — was never confirmed as a post-suspension milestone by the deviation or any DoW document. The FNN-reported task force options point to three plausible scenarios: a narrower-population Phase 2 restart within months, with updated POA&M rules and an eventual Rev 3 baseline; a fuller program return on a revised timeline; or a significantly restructured framework following rulemaking. The practical step for programs whose contracts run through FY2027 and FY2028 award periods is to build C3PAO certification as a probable condition into price analysis, SSP documentation, and procurement planning — without treating any single date as confirmed. DLA's FAQ gives November 2027 for its own manual contracts as a reference point, not an authoritative DoW-wide date.
Supply chain considerations. DFARS 252.204-7021 and its flowdown requirement remain in effect during the pause, limited to self-assessment levels. Primes must continue to flow down CMMC requirements to CUI-handling subcontractors at the self-assessment level — the obligation was not suspended, only the C3PAO tier was. Separately, the DFARS 252.204-7012 flowdown for subcontractors handling covered defense information remains in place unchanged. Program managers should confirm that primes understand both the continuation of the CMMC self-assessment flowdown and the unchanged 7012 obligation, and are not interpreting the class deviation as a release from either.
The Assessment Capacity Problem Has Not Resolved Itself
One of the pressures that drove the reform review was structural. When Phase 2 was imminent, demand for C3PAO assessments had grown faster than the authorized and operating assessor pool. As an unnamed former official told Federal News Network, most C3PAOs had their schedules filled through the rest of 2026 and into 2027 before the suspension.
The suspension paused demand pressure, but it did not build assessment capacity. If Phase 2 returns — in original form, in narrower-population form, or under a revised framework — the capacity constraint will re-emerge. Companies that maintain their NIST SP 800-171 Rev 2 implementations in good standing, keep their SSPs and POA&Ms current, and use the extended runway to close gaps will be ahead of the scheduling queue when the requirement returns. Companies that treat the suspension as a full stop face the same bottleneck, compressed.
Practical Checklist for Program Offices
For program managers and acquisition professionals reviewing their current posture, the operational questions now are:
- Is your current solicitation language consistent with Class Deviation 2026-O0025, designating only Level 1 (Self) or Level 2 (Self)?
- Do any active contracts requiring C3PAO or DIBCAC assessments have an option period or administrative modification approaching that requires the CO to issue a modification removing those requirements?
- Has your price analysis for forthcoming awards incorporated the anticipated cost of C3PAO certification, so that contractors can compete fairly when the requirement returns?
- Is your program office tracking the DoW CIO's forthcoming guidance and any new deviation revision as trigger points for updating contract templates?
- For CUI-handling subcontractors: is the prime flowing down CMMC requirements at the self-assessment level (required, via 252.204-7021), and separately ensuring DFARS 252.204-7012 flowdown obligations remain active (also required)?
Sources and Further Reading
- Department of War Press Release: "Forging the Arsenal of Freedom," July 13, 2026
- DoW CIO Memorandum: "Removing Barriers to Defense Industrial Base Expansion," July 13, 2026
- Implementing Memorandum (Pub Case 26-P-1023), July 13, 2026
- Class Deviation 2026-O0025, Revision 3, September 3, 2026
- SBA Office of Advocacy: DoW Requests Information for CMMC Reform Task Force, July 20, 2026
- Holland & Knight: DOW Suspends CMMC Phase II Requirements, July 31, 2026
- Latham & Watkins: What Defense Contractors Should Know About DOD's Suspension of CMMC Phase 2, July 2026
- Smith Currie: Class Deviation Memorandum Codifies CMMC Phase 2 Suspension, September 2026
- Covington Inside Government Contracts: CMMC Reform Task Force Updates September 2026
- Federal News Network: RFI Offers Path Forward for DoD with CMMC, October 2026
- KSG: CMMC Reform Task Force Report — Contractor Actions, September 2026
- DOJ: Honeywell Aerospace Settlement, September 2026
- CMMC.com: Honeywell FCA Settlement Analysis, September 2026
- DLA: CMMC Frequently Asked Questions and Answers
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
Spartan X's compliance and Zero Trust architecture practice — including CMMC compliance support and assessment-and-authorization work for organizations navigating DoD's evolving cybersecurity requirements — positions the team to support acquisition personnel designing solicitation frameworks and DIB organizations working to maintain and document the technical foundation that any forthcoming Phase 2 regime will assess.
