CMMC Assessments Paused, Readiness Continues

Outside CMMC assessments are paused. Self-assessments still count.

Checked on 4 October 2026.

What happened

  • 13 July 2026. The Department of War (the new name of the Department of Defense) paused the move to CMMC Phase 2. Phase 2 was due to start on 10 November 2026. It would have required many contractors to be assessed by a C3PAO, an approved outside company that assesses you for certification.
  • The same day. The Department opened a 60-day review of the whole program, led by a CMMC Reform Task Force. It asked the public for comments. Reports say it received about 1,100 by 14 August.
  • 3 September 2026. The pause went into an official contracting memo, called a class deviation. It tells contracting officers to remove or change the CMMC requirements in new and existing requests for bids and contracts, to match the pause.

What has not changed

The pause covers outside assessments. It does not cover the work itself.

  • A contract can still ask for a Level 1 or Level 2 self-assessment.
  • You still report your results in SPRS, the government website where you report your results. A senior person at your company still confirms them every year.
  • If you handle CUI, you must still meet NIST SP 800-171 Revision 2, under the contract clause DFARS 252.204-7012. That clause also still requires you to report a cyber incident within 72 hours.

What comes next

The Task Force finished its review around 11 September and gave its recommendations to the Department’s Chief Information Officer. As of 4 October 2026 they have not been made public. It is not yet known what will change, or when.

The memo of 3 September has no end date. It stays in force until the Department withdraws it or writes it into the permanent rules.

What to do now

  1. Keep going with your self-assessment. The security requirements themselves have not changed.
  2. Keep your SPRS entry and your yearly confirmation up to date.
  3. Read the CMMC wording in each new contract or request for bids. If it still asks for an outside assessment, ask the contracting officer named in the contract, or your contact at the company you supply, whether that will be changed.

Sources