Cybersecurity Maturity Model Certification
CMMC compliance: what is required now, what is suspended, and how DoD contractors comply
Phase 2 third-party certification is suspended. Every underlying security obligation is still in force — and still enforceable. Here is what that actually means for your contracts this quarter.
Current status: Phase 2 is suspended, CMMC compliance is not
On July 13, 2026, the Department of Defense — now also referred to as the Department of War — suspended the transition to CMMC Phase 2, which would have made third-party C3PAO certification a condition of award starting November 10, 2026. On September 3, 2026, a class deviation directed contracting officers to strip third-party assessment requirements out of contracts, moving the pause from policy into binding acquisition guidance.
What has not changed: Phase 1 Level 1 and Level 2 self-assessments remain in force. DFARS 252.204-7012 is unchanged. NIST SP 800-171 Revision 2 is still the enforced standard for CUI. SPRS scores and annual affirmations are still required, with False Claims Act exposure attached to inaccurate ones. DoD retains its own assessment authority.
The CMMC Reform Task Force report was due to the DoD CIO on September 11, 2026. Recommendations have not been published. We track every development on our CMMC News page.
What is required right now
CMMC compliance means implementing — and being able to prove you implemented — the cybersecurity requirements your contract specifies, at the level it specifies. The program is codified in 32 CFR Part 170, effective December 2024, and entered contracts through the acquisition rule that took effect November 10, 2025.
The distinction that matters in 2026 is between the requirement and the verification method. The requirement has not moved since DFARS 252.204-7012 was published in 2015. What DoD keeps adjusting is how it checks your work.
Which level applies to you?
Start here: what data do your contracts actually flow — and where does it live today?
-
Federal Contract Information only, no CUI
Level 1 (Self)
Unaffected by the suspension
- 15 basic safeguarding requirements from FAR 52.204-21
- Annual self-assessment, score posted in SPRS
- Annual affirmation by a senior official
-
You store, process, or transmit CUI
Level 2 (Self) today
C3PAO designation suspended
- All 110 NIST SP 800-171 Rev. 2 requirements, owed today
- Current SSP and POA&M, SPRS score, annual affirmation
- DFARS 7012 incident reporting and FedRAMP Moderate equivalency for cloud
- Build to a certifiable standard — verification returns in some form
-
You support a highest-priority DoD program
Level 3 track
DIBCAC designation suspended
- 24 enhanced requirements selected from NIST SP 800-172
- Layered on a complete Level 2 foundation
- Government-assessed by DCMA DIBCAC when the pathway reopens
Your contract specifies the level. You do not self-select it, and a prime can flow a requirement down before it appears in your own solicitation.
The verification mechanism was paused. The security requirement was not.
If CUI sits in a non-compliant environment today, that is a DFARS 7012 problem this week — independent of when third-party assessments resume.
What the suspension changed — and what it didn’t
| Changed | Unchanged |
|---|---|
| The November 10, 2026 Phase 2 transition is suspended, effective immediately | 32 CFR Part 170 was not amended, rescinded, or repealed |
| Contracting officers now strip third-party assessment requirements from solicitations | Phase 1 Level 1 and Level 2 self-assessments remain conditions of award |
| Program managers may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments | DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 remain in force for CUI |
| Pending and future implementation milestones are on hold pending the review | SPRS posting and annual affirmation obligations continue |
| The pause is now a class deviation, which makes reversal a more involved process | DoD retains authority to run its own Medium and High assessments |
Why the Department paused
The suspension followed sustained pressure over cost and administrative burden on small businesses. The Small Business Administration publicly commended the decision, citing firms leaving defense work rather than absorb compliance costs. There was also a capacity problem: well over 100,000 companies needing assessments against roughly 111 authorized C3PAOs. DoD issued a request for information on reducing compliance burden and received more than 1,100 comments before the August 14 deadline, asking specifically which NIST SP 800-171 controls deliver meaningful risk reduction and how commercial tooling and managed services could be credited.
Should you stop your CMMC work?
A pause on third-party audits does not make an inaccurate affirmation safe. It removes the assessor who would have caught the problem before DOJ did.
Three reasons to keep going. The obligation is already live, so non-compliance is present-tense contract and False Claims Act exposure rather than a future risk. Primes are enforcing flow-down independently of DoD’s phase schedule. And Level 2 readiness typically takes 12 to 18 months, so organizations that stand down and restart will be competing for scarce assessor capacity from a standing start. The CyberAB, which oversees the CMMC ecosystem, has characterized the suspension as a narrow contractual pause rather than a program shutdown, and reports roughly 1,900 Level 2 certified organizations with no shortage of capacity for engagements already in motion.
The three CMMC levels
| Level | Data it covers | Requirements | Verification today |
|---|---|---|---|
| Level 1 — Foundational | Federal Contract Information (FCI) | 15 requirements from FAR 52.204-21 | Annual self-assessment, SPRS score, annual affirmation |
| Level 2 — Advanced | Controlled Unclassified Information (CUI) | 110 requirements from NIST SP 800-171 Rev. 2, assessed against 320 objectives in 800-171A | Self-assessment only while C3PAO designations are suspended |
| Level 3 — Expert | CUI on DoD’s highest-priority programs | 24 requirements selected from NIST SP 800-172, on a complete Level 2 foundation | DIBCAC-assessed; designations suspended |
Two details that most guidance still gets wrong. Level 1 is 15 requirements, not 17 — the 17 figure predates the final rule and persists across competitor pages. And CMMC Level 2 is locked to Revision 2 of NIST SP 800-171, not Revision 3. A NIST publication only becomes a CMMC obligation when DoD writes it into the rule, and as of this review that is still Rev. 2. Note that NIST withdrew Rev. 2 from its own catalog in May 2024 when Rev. 3 was published — that does not change your obligation, because withdrawing a publication does not amend a federal acquisition regulation. Our NIST SP 800-171 guide explains why both facts are true at once.
Conditional vs. Final status
Passing an assessment with open POA&M items earns a Conditional status, and every item must close within 180 days to convert to Final. Not every requirement is POA&M-eligible, and the highest-weighted controls are not. Planning to certify on a POA&M is planning to fail 180 days later.
A note on the 2026 clause renumbering
Separately from the suspension, a February 2026 class deviation under the Revolutionary FAR Overhaul reorganized the cybersecurity clauses into FAR Part 40 and DFARS Part 240. DFARS 252.204-7019 is no longer prescribed and 252.204-7020 now appears as 252.240-7997, while 252.204-7012 and the CMMC clause 252.204-7021 are unchanged. Because it is a class deviation ahead of formal rulemaking, both old and new clause numbers can appear depending on award date — read the clause list in your actual contract rather than assuming. Current deviations are published by the Defense Acquisition Regulations System.
Who needs to comply
Every organization in the DoD supply chain that handles FCI or CUI needs to meet a level: primes, subcontractors at every tier, and suppliers. Manufacturers, machine shops, engineering firms, logistics providers, professional services firms, and software vendors are all in scope when they touch this data. Being a small business does not exempt you — it affects which assessment method your contract specifies, not whether the controls apply.
If you are a subcontractor, your obligation arrives on your prime’s schedule rather than DoD’s. Throughout 2026 we have seen primes require documented NIST SP 800-171 implementation and SPRS scores as a condition of staying on an approved vendor list, regardless of what phase the government is in. Nothing about the Phase 2 suspension prevents a prime from setting a higher bar than DoD does.
How CMMC got here
CMMC rollout and the 2026 pause
Four rules, one suspension, in 21 months
-
1
Dec 2024
32 CFR Part 170, the CMMC Program rule, becomes effective and codifies the three levels.
-
2
Nov 2025
The acquisition rule takes effect. Phase 1 begins and self-assessment requirements start appearing in solicitations.
-
3
Feb 2026
Class deviation reorganizes the cybersecurity clauses into FAR Part 40 and DFARS Part 240.
-
4
Jul 2026
DoD suspends the Phase 2 transition and stands up the CMMC Reform Task Force for a 60-day review.
-
5
Sep 2026
A class deviation codifies the pause, directing contracting officers to remove third-party assessment requirements.
-
6
Next
The task force report goes to the DoD CIO. Phases 2 through 4 now depend on its outcome.
Phase 3 and Phase 4 milestones, originally November 2027 and November 2028, should be treated as suspended rather than cancelled.
How to become CMMC compliant
Six steps to a defensible position
-
1
Scope
Map where FCI and CUI actually enter, move, and rest — not where policy says they should. Scoping decisions drive the entire cost of the program.
-
2
Gap assess
Assess against the 320 objectives in NIST SP 800-171A, not the 110 control statements. That is how an assessor evaluates you, and partial implementation scores zero.
-
3
Document
Build the SSP and POA&M. A well-written SSP describing a system that does not exist is a common and expensive failure.
-
4
Remediate
Close the gaps. MFA, FIPS-validated encryption, audit logging and review, and CUI marking and handling consume the most time.
-
5
Affirm
Complete the assessment, post the score in SPRS, and have a senior official affirm it. This is the document DOJ uses in False Claims Act cases.
-
6
Maintain
Controls drift, staff change, and affirmations come due annually. Evidence collection built into operations beats an annual scramble.
Level 1 implementation is typically a matter of months. Level 2 commonly runs 12 to 18 months depending on scope and starting posture.
The enclave decision
Scoping is where the enclave question gets answered. If CUI is confined to a small, identifiable group, building a segmented enclave — often on Microsoft 365 GCC High — and keeping the rest of the network out of scope is usually the cheapest defensible path, because the assessment boundary shrinks with it. If CUI is genuinely everywhere, an enterprise-wide approach is the honest answer. An enclave is also only as good as your data-flow discipline: users will move files across the boundary if it is inconvenient not to, which is why DLP, sensitivity labels, and training matter as much as architecture.
What drives the cost
Rather than a number that will not fit your situation, here is what moves the total, roughly in order of impact.
- How much of your environment is in scope. The single largest lever, and the one most often left unpulled.
- The distance between your current controls and the requirement. Remediation is usually the biggest line item and the most variable.
- Environment and licensing. An enclave build or GCC High migration, plus the licenses to support it.
- Documentation. SSP, POA&M, policies and procedures, incident response and recovery plans, inventories, network diagrams.
- Ongoing operations. Monitoring, log review, vulnerability management, annual reassessment and affirmation.
- Third-party assessment. C3PAO fees, not currently required while Phase 2 is suspended.
Cost burden is exactly what triggered the 2026 review, and DoD asked industry how commercial tooling and managed services could be credited rather than requiring every contractor to build a security program from scratch. Whatever the task force recommends, that is the direction of travel.
What non-compliance costs
| Consequence | Live today? | What it looks like |
|---|---|---|
| Contract ineligibility | Yes | Where a solicitation specifies a level, meeting it is a condition of award. No status in SPRS, no award. On existing contracts, non-compliance with DFARS 7012 is a breach. |
| False Claims Act liability | Yes | Under DOJ’s Civil Cyber-Fraud Initiative, submitting a score you cannot substantiate is a false claim. In June 2026 an Alabama defense contractor agreed to pay $507,144 after a DoD audit found its near-perfect self-assessment substantially inaccurate. |
| Loss of supply-chain position | Yes | Primes remove non-compliant subcontractors from vendor lists rather than inherit the risk — on commercial timelines, without a regulatory trigger and often without notice. |
Note what the Logzone case does not involve: a C3PAO. It was a self-assessment. Suspending third-party assessments does not reduce this exposure — it concentrates it, because self-attestation is now the primary mechanism and DoD is auditing it directly.
In-house or with an RPO
Contractors with a capable internal security team can do this themselves. NIST’s Self-Assessment Handbook 162 is a reasonable starting point, though it covers Rev. 1 and has never been updated for the Rev. 2 baseline CMMC actually enforces. NIST also publishes an SSP template and a POA&M template. The real constraint is rarely knowledge — it is bandwidth and objectivity.
A Registered Provider Organization is authorized by the Cyber AB to provide readiness and advisory services. RPOs employ trained Registered Practitioners, undergo background screening, and agree to a code of professional conduct. They are the implementers; C3PAOs conduct certification assessments, and the separation is deliberate. Verify RPO status on the Cyber AB Marketplace before you sign anything — and remember that outsourcing the work does not outsource the liability. Your senior official still signs the affirmation.
Frequently asked questions
Is CMMC cancelled?
No. DoD suspended the transition to Phase 2 — the third-party certification milestone scheduled for November 10, 2026 — pending a Reform Task Force review, and a September 2026 class deviation codified that suspension. The program rule at 32 CFR Part 170 was not repealed. Phase 1 self-assessments, DFARS 252.204-7012, and NIST SP 800-171 Rev. 2 all remain in force.
Do I still need to be CMMC compliant during the suspension?
Yes. If your contract includes DFARS 252.204-7012 and you handle CUI, you owe all 110 controls today. If a solicitation specifies Level 1 (Self) or Level 2 (Self), meeting it remains a condition of award. What is paused is third-party verification, not the obligation, the SPRS posting, or the annual affirmation.
How do I become CMMC compliant?
Scope your environment, run a gap assessment against your level’s framework, document your SSP and POA&M, remediate the gaps, complete your assessment and post the score in SPRS, then affirm it through a senior official and maintain it. Level 2 readiness commonly takes 12 to 18 months.
How much does CMMC compliance cost?
It depends on how much of your environment is in scope and how far your current controls sit from the requirement. Remediation is typically the largest and most variable component. Segmenting CUI into an enclave rather than bringing an entire network into a Level 2 boundary changes the total by a multiple, not a percentage.
What level of CMMC do I need?
Your contract specifies it. Handling only FCI puts you at Level 1. Storing, processing, or transmitting CUI puts you at Level 2. Level 3 applies to a small number of DoD’s highest-priority programs. Most contractors handling CUI land at Level 2, and organizations already fully compliant with DFARS 7012 are substantially aligned to it.
What happens if I don’t get CMMC certified?
You are ineligible for award on solicitations that specify a level, you carry False Claims Act exposure if you affirmed compliance you cannot substantiate, and primes routinely drop non-compliant subcontractors from approved vendor lists. All three apply during the suspension.
Is NIST 800-53 the same as CMMC?
No. NIST SP 800-53 is the control catalog for federal systems the government itself operates. CMMC applies to contractor-owned systems and is built on NIST SP 800-171 Rev. 2, a tailored set of 110 requirements for protecting CUI in non-federal systems. Level 3 adds 24 enhanced requirements from NIST SP 800-172. If you are a contractor, 800-171 is your standard.
What is the difference between DFARS and CMMC?
DFARS 252.204-7012 is the clause that legally requires you to safeguard covered defense information and report incidents. CMMC is the verification mechanism DoD built on top of it after self-attestation produced poor adoption. DFARS creates the obligation; CMMC checks the work. That distinction is why the Phase 2 suspension does not reduce your requirements.
Who issues CMMC certification?
C3PAOs authorized by the Cyber AB conduct Level 2 certification assessments, and DIBCAC conducts Level 3. Both designations are currently suspended. RPOs provide readiness and remediation services and cannot issue certifications. As of April 2026, ISACA serves as the credentialing body for the CCP and CCA credentials, while the Cyber AB continues to own the RP, RPA, and RPO programs and the CMMC Marketplace.
What happened to CMMC 2.0?
Neither “1.0” nor “2.0” is current terminology. Since the final rule took effect the program is simply CMMC, codified at 32 CFR Part 170. Guidance still using 2.0 framing generally predates the final rule and often carries other errors with it — the most common being that Level 1 requires 17 practices. The rule specifies 15.
Do subcontractors need CMMC compliance?
Yes, at every tier where FCI or CUI is handled. Your level depends on the data you receive, not your size or distance from the prime. In practice the requirement often arrives through prime flow-down before it appears in your own solicitations.
Does using a managed service provider make me compliant?
Not by itself. If an external provider stores, processes, or transmits your CUI, or provides security protection for your in-scope environment, that provider enters your assessment scope and you need a shared responsibility matrix showing who implements which controls. Cloud services handling CUI must meet FedRAMP Moderate equivalency under DFARS 7012. A capable provider reduces your workload and improves your evidence; it does not transfer your obligation.
Sources and references
Every regulatory claim on this page traces to a primary source rather than to secondary commentary.
- 32 CFR Part 170 — the CMMC Program rule, including level definitions, statuses, and affirmation requirements.
- Federal Register, October 15, 2024 — the CMMC final rule as published.
- NIST SP 800-171 Rev. 2 and NIST SP 800-172 — the control baselines for Levels 2 and 3.
- DFARS 252.204-7012 — safeguarding covered defense information and cyber incident reporting.
- DoD class deviations — the current FAR and DFARS deviation memos, including the Phase 2 suspension.
- DoD CIO CMMC resources — official program documentation and status notices.
Not sure what your contracts actually require right now?
SysArc is a Cyber AB Registered Provider Organization and has guided more than 1,000 DoD contractors through DFARS, NIST SP 800-171, and CMMC. We handle scoping, readiness assessments, remediation, documentation, GCC High migrations, and ongoing managed security operations.
If the Phase 2 suspension has left you unsure where you stand, that is a short conversation. Call (240) 453-4146 or book time below. No obligation.