Get A QuoteContact Us
CMMC Program Update · Department of War · 07.13.2026

CMMC Phase II is paused.
Your contracts are not.

The Department of War suspended third-party (C3PAO) assessment requirements while a Reform Task Force conducts a 60-day review. But DFARS 252.204-7012, NIST SP 800-171, SPRS scores, and your self-assessments are all still in force — and your primes haven't paused anything. Find out exactly where you stand.

Schedule a Discovery Meeting See What's Still Required
58
Days remaining in the DoW's 60-day CMMC review
Requirements Status Register

One thing was suspended.
Everything else stands.

The pause has a narrow, defined scope: the mandatory third-party assessment mechanism. The underlying obligations in your contracts didn't move.

Reference
Requirement
Status
L2 (C3PAO)
Third-party Level 2 assessments as a condition of awardWas scheduled for Nov 10, 2026 — being removed from active solicitations
Suspended
252.204-7012
DFARS safeguarding & incident reportingStill a binding clause in your existing contracts
In Force
SP 800-171 R2
NIST security controls for CUIThe interim enforcement standard during the review
In Force
L1 / L2 (Self)
Phase I self-assessmentsCan still be required in new awards
In Force
SPRS / Affirm
SPRS score submissions & annual affirmationsSigned by your Affirming Official — now carrying more enforcement weight
In Force
Flow-downs
Prime contractor certification requirementsNothing stops a prime from requiring Level 2 certification before sharing CUI
In Force
Why this isn't a reprieve

The pause moved your risk. It didn't remove it.

With third-party verification on hold, the government's enforcement weight shifts to your self-attestation. An inaccurate SPRS score or annual affirmation now carries more exposure — including under the False Claims Act — not less.

Contractors who keep maturing their programs through these 60 days will be ready whether the Task Force resumes, modifies, or restructures CMMC. Contractors who stop and guess wrong will be scrambling — possibly on short notice.

"We are not reducing cybersecurity through this measure."
— DoW Chief Information Officer, July 13, 2026 announcement
The 60-Day Window

What smart contractors are doing right now

Verify

Pressure-test your SPRS score

Self-attestation is now the primary verification mechanism. Make sure your score reflects reality and would survive scrutiny.

Close

Finish gaps without a deadline

Remediate POA&M items, complete your System Security Plan, and mature documentation while the clock is stopped.

Confirm

Talk to your primes

Certification flow-downs are contractual, not regulatory. Find out whether yours still apply — many will.

Speak

Respond to the RFI by Aug 14

The Task Force is taking industry feedback directly. If compliance costs have burdened your business, say so.

CMMCReady Discovery Meeting

Find out where you stand.

30 minutes with our team. No pressure, no doom-selling — just a clear read on your obligations under the pause.

  • Your contractual obligations today
  • Your SPRS posture & attestation risk
  • What to prioritize during the review