You can still get a CMMC Level 2 certificate from an outside assessor
Checked on 8 October 2026.
What happened
- 13 July 2026. The Department of War (the new name of the Department of Defense) paused Phase 2 of CMMC, the Cybersecurity Maturity Model Certification program. Phase 2 would have made many contracts ask for an outside assessment. Our article on the pause of outside assessments has the details.
- 15 July 2026. The Cyber AB, the official accreditation body for CMMC, said only the Phase 2 requirements were suspended. It said the rest of the program stays open. That includes Level 2 certification assessments by C3PAOs (approved outside companies that assess you for certification).
The Cyber AB gave its own counts that day:
| What it counted | On 15 July 2026 |
|---|---|
| Certified CMMC assessors | Over 1,000 |
| Authorized C3PAOs | 110 |
| Defense contractors certified at Level 2 (Final) | Nearly 2,000 |
The Cyber AB is a private nonprofit, not a government agency. It works with the Department under a no-cost contract and authorizes the C3PAOs, so it has an interest in assessments going on. Its chief executive called a certificate a strong selling point with prime contractors. That is the Cyber AB’s view, not a rule.
What it means for you
A certification assessment is still a choice you can make. The Cyber AB says the pause did not stop these assessments.
- It also covers the self-assessments. Under the CMMC rule, a Level 2 (C3PAO) status also meets a requirement for Level 1 (Self) or Level 2 (Self), for the same systems. The 13 July memo, as the official contracting memo describes it, lets the Department’s contracts ask for those two self-assessments.
- A prime may ask for it. A prime contractor you supply may want a certificate from its suppliers. Only they can tell you.
- It shows your work was checked. A self-assessment is your own score. A certificate shows that an approved outside company checked it. The results go into SPRS (the government website where you report your results).
- The work does not stop. Under the rule, a new certification assessment is due within three years. A senior person at your company still confirms the results every year. And if the government later runs its own assessment and finds gaps, its results take precedence over your CMMC status.
What comes next
Whether the Department’s review of the CMMC program will change certification assessments, and when, is not known as of 8 October 2026.
What to do now
- Ask the primes you supply, in writing, whether they want a certificate from you, and by when.
- If you decide on an assessment, ask more than one C3PAO for a quote. Check that each one is on the Cyber AB’s public list of authorized or accredited C3PAOs.
- Keep the help and the check apart. Under the CMMC rule, the Cyber AB’s code of conduct must bar any CMMC professional or firm that was your consultant to prepare you for any CMMC assessment in the last 3 years from taking part in your certification assessment.
- Keep your self-assessment and your SPRS entry up to date while you decide.
Sources
- The Cyber AB’s statement of 15 July 2026, from the official accreditation body. It is a private nonprofit, not a government source.
- 32 CFR Part 170, the CMMC program rule. Sections 170.8 and 170.17 cover the points above.
- Class Deviation 2026-O0025, Revision 3, the official memo (PDF). It describes the 13 July memo.