CMMC Phase II is still paused. Your signature still counts.

What the CMMC Phase II suspension changed, what has happened since July - and what still hasn’t moved.

On 13 July 2026 the Department of War suspended CMMC Phase II. The third-party certification requirement that was due to start appearing in contracts on 10 November is on hold, later implementation milestones are frozen with it, and a reform task force was given 60 days to recommend what comes next.

Three months later, the useful summary is short. The pause is now written into the instructions contracting officers work from. Industry reporting says the task force has finished its work, but nobody outside the Department has seen it. And nothing you owe under your safeguarding clause has changed.

The pause is on the audit, not on the obligation. That was true in July. It is still true in October.

What happened, in order

13 July 2026 - the suspension. The Department’s CIO suspended Phase II, and an implementing memorandum from the Under Secretary for Acquisition and Sustainment told program offices how to apply it. During the suspension, requiring activities may designate only CMMC Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) may not be designated, and no waivers are granted while the program is under review. The Department’s announcement framed the decision around compliance cost and the burden on small and non-traditional businesses.

The same memorandum states that the requirements of DFARS 252.204-7012 remain in effect, and that during the suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through self-assessment and select government-led assessments.

16 July 2026 - into contracting instructions. DFARS class deviation 2026-O0025, Revision 2, carried the suspension into the instructions contracting officers follow. This is when the pause reached the people who write your contracts.

3 September 2026 - Revision 3. Revision 3 superseded Revision 2 and restated the same CMMC direction: remove or revise the suspended requirements in new and existing solicitations and contracts, amend active solicitations as soon as practicable, and for existing contracts, remove them by modification before the next option period is exercised or at the next scheduled administrative modification. What Revision 3 actually changed was unrelated - statutory supply-chain provisions and corrected definitions. It is worth knowing about because it is the version in force today. It is not a second CMMC change, whatever you may have read.

Around 11 September - the task force reportedly delivers, privately. The Department said the task force would deliver its final report to the CIO within 60 days. Industry reporting puts delivery around 11 September. As of October 23, 2026 the Department has not published it, and its CMMC page announces no release date. Anyone telling you what it recommends is guessing.

A task force report is advice. What changes your contract is a class deviation, a DFARS rule, an amendment to 32 CFR Part 170 - or the paper your prime sends you.

What did not change

Most of the coverage stops at “Phase II is paused”. That is where the useful part starts.

1. Your safeguarding clause is untouched. If you handle CUI, DFARS 252.204-7012 still requires you to protect covered defense information to NIST SP 800-171, still requires you to report a cyber incident to DoD within 72 hours of discovery, and still requires you to flow the clause down to subcontractors whose work involves covered defense information. If you handle FCI, FAR 52.204-21 still sets the basic safeguarding floor.

2. Where a CMMC level is in your contract, a self-assessed status is checked. The certification step is what paused. The self-assessed step did not. Where a solicitation or contract carries a CMMC requirement - and during the suspension that can only be Level 1 (Self) or Level 2 (Self) - you enter a current self-assessment in SPRS and keep an annual affirmation of continuous compliance current, signed by a named affirming official. Contracting officers check SPRS for that status before award, and before exercising an option or extending the period of performance.

3. Your prime’s flowdowns are contractual. The Department’s memoranda direct Department staff. They do not rewrite a subcontract you have already signed. If your prime still asks for something, the answer is in your paper, not in the press release.

The part that got heavier

With third-party certification suspended, the artifact carrying the weight is your affirmation - entered in SPRS, signed by a named person, asserting continuous compliance.

The Justice Department’s Civil Cyber-Fraud Initiative, announced in 2021, uses the False Claims Act against contractors who knowingly misrepresent their cybersecurity practices. An affirmation in SPRS is exactly that kind of representation.

So the verification burden went down and the exposure on the signature did not. A business that reads “CMMC is paused” as license to let its posture drift, while affirming continuous compliance every year, has not reduced its risk. It has concentrated it onto one person.

Watch for the modification - and read it

If you hold a contract that carried a Phase II requirement, expect paper before your next option. When it arrives, read it rather than file it. It tells you exactly what the Department considers removed from that contract - and a modification that removes a certification requirement does not remove your safeguarding requirements. The two will arrive looking similar and mean very different things.

The option date matters for a second reason. Where your contract keeps a self-assessed CMMC level, the contracting officer checks SPRS before exercising the option. An expired affirmation is a problem on that day, not a paperwork backlog.

What to keep doing

1. Keep your NIST SP 800-171 implementation moving. Slow down if the business case demands it, and write down why. Do not stop and do not dismantle.
2. Check what SPRS actually shows. Not your plan to update it - the record a contracting officer will pull before your next award or option.
3. Confirm who your affirming official is, when the affirmation was last made, and that they understand what they are signing.
4. Re-read your prime flowdowns for obligations that survive independently of the Department’s schedule.
5. Map your option dates. For each contract, note when the next option is due, whether a modification is likely before it, and whether a self-assessed CMMC level stays in the contract after it.
6. Keep your incident-reporting path ready under 252.204-7012 - including who reports, and how, within 72 hours.

What to watch for next

Three things will tell you the position has moved: publication of the task force’s recommendations, a new revision of class deviation 2026-O0025, or a rule change to DFARS or 32 CFR Part 170. Until one of those arrives, the position above holds.

Every likely outcome still requires the security controls. Only the way they are verified is genuinely in question. That is why maintaining what you have built remains cheaper than unwinding it and building it again.

---

Cloud Kings runs managed IT, cyber security and cloud, and builds the environments defense contractors are assessed in. We are not a C3PAO and we do not certify anyone.

If the last three months have left you unsure what you actually owe this quarter, start with a free 15-minute scoping call. We work out whether you hold CUI or only FCI, where it lives and who touches it, and walk the fourteen questions of our CMMC gap check with you - one per requirement family, no score. You get a written summary the same day, whether or not you go any further.

If the full picture is worth having, our paid scoped gap analysis walks all 110 requirements against evidence and produces the System Security Plan and POA&M an assessor reads, for a fixed fee, quoted before you sign. Book a scoping call, or answer the fourteen questions yourself first.

This reflects the regulatory position as of October 23, 2026 and will change when the Department publishes the task force’s recommendations or revises the class deviation. Last reviewed October 23, 2026. This is not legal advice.