CMMC · living page

Suspended is not repealed.

The assessment date moved. The requirements did not. This page tracks where the CMMC rules actually stand, because they have moved three times in two months and anything written as permanent copy is wrong within weeks.

Last updated 12 September 2026. This is a living page, not an article. If you are reading it much later than that date, check the primary sources linked at the bottom before relying on it. It is also not legal advice.

Where it stands.

As of the date above.

What has changed

  • 13 July 2026 — the DoW CIO suspended advancement to CMMC Phase 2, freezing Phases 3 and 4 with it, and stood up a reform task force
  • 3 September 2026 — Revision 3 of DARS Class Deviation 2026-O0025 wrote that suspension into the DFARS Part 240 text, so contracting officers are now directed to act on it in live solicitations
  • CMMC Level 1 and Level 2 can currently be satisfied by self-assessment rather than a C3PAO or government review
  • The automatic trigger date now sits at 10 November 2028
  • The task force reported to the CIO around mid-September; a public report is expected late September into October

What has not changed

  • DFARS 252.204-7012 remains in force, unamended
  • All 110 NIST SP 800-171 controls still apply, in contracts being performed today
  • DIBCAC still conducts government assessments
  • SPRS score verification before award still happens
  • Annual affirmation obligations are untouched
  • 32 CFR Part 170, the CMMC program rule, has not been repealed

The mistake that costs money.

It is an accounting mistake before it is a security one.

Inside most small contractors, CMMC preparation and 800-171 remediation were never two projects. They were one budget line with CMMC written on it. So when the assessment requirement was deferred, the line got cut — and the remediation stopped with it.

That is the expensive error, and the reason is simple: a deferral changed when a third party checks. It did not change what is required. The requirements live in DFARS clauses and in 800-171, and those clauses are in contracts being performed right now.

! Self-attestation is not a lower bar. It is the same bar with your signature on it. With third-party assessment deferred, your SPRS score is a representation you made to the government. If it is not true, the exposure is not a failed assessment — it is a False Claims Act problem, and the Department has been settling those. The contractors who come out of this period well are the ones who spent it making their score true.

Which makes the next two years an unusually good window rather than a reprieve. The assessor bottleneck that triggered all of this — north of a hundred thousand companies against roughly a hundred authorized C3PAOs — has not gone away. Everyone who treats the deferral as permission will re-enter that queue at the same moment, unprepared, when the trigger date arrives.

What to watch.

Announcements are not obligations.

A task force report is advice. Only three mechanisms actually change what you owe: a class deviation, a DFARS rule change through notice-and-comment rulemaking, or an amendment to 32 CFR Part 170. The first can happen in days — it already has, three times. The other two run on rulemaking timelines measured in months or years.

So watch what the Department publishes, not what it announces. And given the pace of revisions here, treat any single reading of this as perishable, including this one.

Primary sources

  • DoW CIO memorandum suspending advancement to CMMC Phase 2, 13 July 2026
  • DARS Class Deviation 2026-O0025, Revision 3, 3 September 2026
  • 32 CFR Part 170 — the CMMC program rule
  • DFARS 252.204-7012 and NIST SP 800-171

Is your SPRS score actually true?

That is the only question that matters for the next two years, and it is answerable. Tell me what you scored and how you got there.

Book a Call Federal & DoD work