CMMC Phase 2 Is Paused, Not Gone: What Defense Contractors Should Do Now
November 10, 2026 was supposed to be the day Phase 2 of CMMC began, though a pause announced in July put those plans on hold. If you make parts or products for the defense supply chain, you may be wondering whether your own compliance work can wait as well. The answer is no, and the pause changes far less than it may seem.
What Happened to CMMC Phase 2?
On July 13, the Department of War (DoW) suspended Phase 2 and all future CMMC milestones. Phase 2 would’ve made third-party Level 2 certification the default for most contracts involving controlled unclassified information (CUI). DoW also created a CMMC Reform Task Force to run a 60-day review. It cited cost and burden that were pushing small businesses out of the defense industrial base. DoW cited cost and burden on small businesses as the reason for the pause. Many industry experts question that reasoning though, because the cost estimates behind it folded the work of implementing NIST 800-171 into the price of CMMC, even though contractors have been required to implement it since 2017. Reporting from Federal News Network on the public request for information found that respondents named meeting the NIST 800-171 security requirements as a top cost driver. The request drew about 1,100 responses and more than 11,000 pages. The review window closed around September 11, and the report hasn’t been released, so there’s still no new date for Phase 2.
What’s Paused and What’s Still Required Under CMMC?
Paused:
The Phase 2 start date
Third-party assessment language in new solicitations (self-assessment only for now)
CMMC waiver procedures
Still in force:
DFARS 252.204-7012 and NIST SP 800-171 Rev 2
Your SPRS score and annual executive affirmation
The CMMC rule itself (32 CFR Part 170)
Level 1 and Level 2 self-assessments
72-hour cyber incident reporting
Prime contractor flow-downs
The pause changed who verifies your work. It didn’t change what’s required. NIST 800-171 has been in defense contracts since 2017, and your SPRS score and affirmation are legal representations.
Can the Government Still Enforce NIST 800-171 Without CMMC?
Yes, the government can enforce NIST 800-171 through DFARS 252.204-7012 and the False Claims Act without CMMC. On September 1, Honeywell Aerospace agreed to pay about $2 million to settle False Claims Act allegations about NIST 800-171 compliance from 2020 through 2023. That was before any CMMC assessment requirement existed. The settlement resolves allegations and doesn’t include a finding of liability.
Where Could CMMC Reform Go Next?
Reporting on a task force summary from October 27 points to several possibilities. Phase 2 could restart with a narrower population, possibly within about 90 days. Clearer CUI marking and a standard form for CUI shared on contracts are seen as the biggest lever for shrinking who must comply. Other items include a move to NIST 800-171 Rev 3, credit for ISO 27001 and similar frameworks, a longer POA&M window of up to 270 days (which would need rulemaking), and more consistent assessors. Nothing is approved and this is reporting on a summary, not official policy. Think “narrower and clearer,” not “gone.”
Should Defense Contractors Wait on CMMC Compliance?
No, and these are three reasons why:
Prime deadlines stand. They’re business and liability decisions made independent of the DoW schedule, and several primes haven’t withdrawn supplier deadlines.
Certification is a calling card. Level 2 certification remains a strong signal when you pursue subcontracts, and it helps back up your compliance claims. More than 2,500 firms are already certified, and many are your competitors.
Capacity could be thin. Many assessors have lost pipeline, so a restart could create a bottleneck.
What Should Defense Contractors Do in the Next 90 Days?
Scope your CUI. What do you receive, where does it live, and who touches it? Consider an enclave.
Run a real gap assessment against NIST 800-171A, not a checklist, and make sure your SPRS score is defensible.
Fix the high-impact basics: phishing-resistant MFA, encryption, logging, incident response, and segmentation. These hold up under any reform.
Develop your system security plan and POA&M. Documentation is the most common failure.
Ask your primes what they require and by when.
Prepare your executive to sign the annual affirmation with evidence.
How Clark Schaefer Consulting Can Help You Prepare
Our IT Risk & Cyber team is a Registered Practitioner Organization (RPO) under the CMMC Accreditation Body and helps defense contractors get ready for CMMC and defend their NIST 800-171 compliance. We can:
Determine your required CMMC level and the scope of your CUI environment.
Run a readiness and gap assessment against NIST SP 800-171 and review your SPRS score.
Develop your POA&M and help close gaps with hands-on remediation.
Run a mock assessment to prepare you for an official C3PAO assessment.
Support ongoing compliance with monitoring and periodic reviews.
Frequently Asked Questions
Is CMMC Canceled?
No. Phase 2 is suspended, not canceled. The CMMC rule itself (32 CFR Part 170) and Level 1 and Level 2 self-assessments remain in force.
Do Defense Contractors Still Need to Follow NIST 800-171?
Yes. NIST SP 800-171 is required through DFARS 252.204-7012, and your SPRS score and annual executive affirmation still apply.
When Will CMMC Phase 2 Start?
No date has been announced. As of November 10, 2026, the task force report hasn’t been released. Reporting suggests Phase 2 could restart with a narrower population, but nothing is approved.
Do I Still Need a Third-Party CMMC Assessment?
Not under DoW’s current rules, since new solicitations are self-assessment only for now. Some primes may still require one, so ask yours.
This article reflects information as of November 10, 2026. Confirm requirements with your prime or contracting officer.
Expert Contributors
