For contractors who expected a new CMMC phase to begin on November 10, 2026, the latest official direction changes the immediate planning picture. On July 13, the Department of War suspended the move to Phase II and paused implementation in Phase I while it reviews the program. The pause changes which assessment types the Department may introduce during this period. It does not erase existing contract terms or turn off baseline cybersecurity responsibilities.
What changed before the planned transition
The original rollout schedule pointed to a Phase II transition in November 2026. The Department's suspension memorandum stopped that transition and told program managers and requiring activities not to designate CMMC Level 2 third-party assessments or Level 3 government assessments during the suspension. For new procurement requirements during this period, the permitted assessment types are Level 1 self-assessment and Level 2 self-assessment.
This distinction matters because headlines about a pause can sound broader than the actual instruction. The memo pauses the phased schedule and particular assessment designations. It does not say that CMMC has disappeared, that every existing solicitation has already been amended, or that contractors may ignore safeguards required elsewhere in their contracts.
- Level 1 Self addresses basic safeguarding of Federal Contract Information under FAR 52.204-21.
- Level 2 Self applies to the CMMC self-assessment path aligned with NIST SP 800-171 Revision 2 for systems handling Controlled Unclassified Information.
- Level 2 C3PAO and Level 3 DIBCAC assessment designations are suspended for procurement documents during the review period, subject to the Department's instructions.
What contractors still need to maintain
The Department says it will enforce the current CMMC baseline through Level 1 and Level 2 self-assessments and select government-led assessments. It also states that cybersecurity obligations under DFARS 252.204-7012 remain in effect, including safeguarding covered defense information and cyber incident reporting. The right response is to check what applies to your own award and information systems, rather than infer that all requirements have been paused.
For Level 1, the Department's current CMMC information describes an annual self-assessment and annual affirmation. For Level 2 Self, it describes a self-assessment every three years and annual affirmation of continued compliance. Contractors should confirm that the assessment result and affirmation are properly reflected in the Supplier Performance Risk System (SPRS) when required, and that the applicable system scope is represented accurately.
There is also a standards-version detail worth handling carefully. NIST's catalog marks SP 800-171 Revision 2 as withdrawn and superseded by Revision 3. Yet the Department's current suspension instructions specifically say it will enforce the CMMC baseline using Revision 2 during the pause. Do not assume that publication of Revision 3 by itself changes a contract requirement. Use the solicitation, current Department direction, and any written contract modification as the governing operational reference, and monitor for formal transition instructions.
Start with the solicitation and award
Before changing a project plan or assessment budget, read the solicitation, award, and amendments together. Identify the CMMC level stated for the work, the clauses included, the data involved, and the contractor information systems that will process, store, or transmit that information. The contract and procurement documents answer what has been required for that work; a general program announcement does not rewrite each award by itself.
Ask focused questions and record the answers:
- Will the organization handle Federal Contract Information, Controlled Unclassified Information, or both?
- Which company-owned or operated systems will handle the information during contract performance?
- What CMMC level and assessment type are written into the current solicitation or contract?
- Has the contracting officer issued an amendment or modification after the suspension memorandum?
- Do subcontractors handle the information, and what requirements flow down to their work?
If language appears inconsistent with the new direction, ask the contracting officer or prime for clarification in writing. Do not silently remove a contractual requirement, assume a pending amendment is effective, or submit an assessment type that the procurement documents do not call for.
Keep system scope and evidence aligned
A useful pause-period task is to verify that the system boundary in your assessment matches the way the contract will actually be performed. CMMC scope is not just a checklist attached to a company name. It depends on the systems that process, store, or transmit FCI or CUI, as well as components that protect those systems. A new collaboration tool, remote access path, managed service, or supplier connection can change the evidence and controls you need to account for.
Review the inventory and supporting records for each in-scope environment. That can include network and data-flow diagrams, system security plans, access approvals, endpoint and vulnerability records, backup and recovery evidence, incident procedures, and supplier responsibilities. Keep the date, owner, and source for each record so a reviewer can distinguish current evidence from a stale document or a planned improvement.
Where a plan of action and milestones is permitted, track the finding, accountable owner, interim protection, target date, and closure evidence. Do not treat a POA&M as permission to leave every gap open. Confirm which requirements are eligible, the applicable completion window, and whether any current solicitation imposes a different condition. If a system boundary or CMMC Unique Identifier is used in a proposal or status record, verify that it represents the systems actually intended for contract performance.
Coordinate any required contract changes
The suspension memorandum directs program managers and requiring activities to initiate amendments for active solicitations that previously specified Level 2 C3PAO or Level 3 DIBCAC requirements. It also directs contracting officers to remove those requirements from existing contracts by modification before the next option exercise or during the next scheduled administrative modification. Those instructions are reasons to check for an official change, not a reason for a contractor to edit its own contract copy and proceed as if a modification had been issued.
Prime contractors should review subcontract clauses and communicate relevant changes to affected suppliers. Subcontractors should confirm which information they will actually receive and which systems will handle it, then check the prime contract's flow-down instructions. A supplier that handles FCI or CUI should not rely on a general statement that the program is paused when determining the protections required for its work.
Use the pause to prepare, and keep watching
Use the time to close evidence gaps, test incident and recovery procedures, validate account and device controls, and rehearse how your team will respond to a procurement clarification. Keep a short change log with the date of each official update, the contract or system it affects, the owner, and the next action. This creates a practical record without forcing the organization to guess what a future rule will say.
Before bids, option periods, or major scope changes, recheck the current Department CMMC page, the solicitation, and any contracting-officer communication. If a new rule or transition date is published, compare it with the controls and assessment status you already maintain, then update the work plan deliberately. The goal is not to overreact to the pause or freeze compliance work. It is to keep the systems secure, preserve accurate evidence, and make changes only when the applicable written requirement supports them.
