CMMC Phase 2 Suspended: What Small Defense Shops Still Have to Do

Update, Oct 28, 2026: An Oct 27 task force review reportedly proposes restarting Phase 2 within 90 days for a narrower group of contractors (Federal News Network). No restart date is official yet.

CMMC Phase 2 is suspended. On July 13, 2026 the Department of War stopped the Phase 2 rollout that was set to start November 10, 2026, so new solicitations may only ask for CMMC Level 1 (Self) or Level 2 (Self). Third-party Level 2 (C3PAO) and Level 3 (DIBCAC) assessments cannot be required during the suspension. Your DFARS 252.204-7012 and NIST SP 800-171 obligations did not go away. FedOpp, an AI Chief Contracting Officer for small manufacturers, reads each RFQ and flags the cyber clauses so you know what a bid really requires.

FedOpp is not affiliated with the Department of War, the Defense Logistics Agency or any government agency. This post is general information, not legal advice.

By FedOpp. Published October 28, 2026. Facts current as of October 28, 2026.

What happened to CMMC Phase 2?

On July 13, 2026 the Department of War announced the "immediate suspension" of CMMC Phase II requirements, which "were originally scheduled to come into effect on November 10, 2026." The same release says "All Phase I self-assessment requirements remain firmly in place" and starts a review of the program aimed at lowering barriers for small and non-traditional businesses (Department of War release, July 13, 2026).

An implementing memo from the Under Secretary for Acquisition and Sustainment, dated July 13, 2026, says program offices may "only include CMMC Level 1 (Self) or Level 2 (Self) assessments" and may not designate Level 2 (C3PAO) or Level 3 (DIBCAC). It also started a 60-day review of the program (implementing memo, July 13, 2026).

Is CMMC Level 2 suspended?

Only the third-party version. CMMC Level 2 (C3PAO) certification cannot be required in new procurements during the suspension. CMMC Level 2 (Self) can still be required. If an RFQ asks for Level 2 (Self), you still need to complete the self-assessment and post it in SPRS before award.

Is November 10, 2026 still the CMMC Phase 2 deadline?

No. November 10, 2026 was the planned Phase 2 start date, and that transition is suspended. As of October 28, 2026 no replacement date has been announced. A law firm update dated October 21, 2026 notes that the official CMMC page "still describes the program as paused in Phase 1" (Dentons, October 21, 2026).

The underlying rules were not repealed. The CMMC DFARS rule (DFARS Case 2019-D041) was published September 10, 2025 and took effect November 10, 2025 (Federal Register, 90 FR 43560). The suspension came by memo, not by a new Federal Register rule.

What changed in September and October 2026?

• September 3, 2026: the Department released Class Deviation 2026-O0025, Revision 3. It tells contracting officers to "remove or revise" CMMC requirements in new and existing solicitations and contracts, and to remove suspended requirements from existing contracts before the next option exercise or scheduled administrative modification.
• Still required under that deviation: "adequate security" for covered defense information, reporting cyber incidents within 72 hours, and a contracting officer check of SPRS before award when a CMMC level is required.
• October 16, 2026: the open FAR cases list showed FAR Case 2026-001 in the draft final rule stage, with a report due November 18, 2026. A June 23, 2026 proposed rule points to NIST SP 800-171 Rev. 3, while current CMMC materials still reference Rev. 2.

Source for all three points: Dentons, October 21, 2026.

What small defense shops still have to do

1. Keep NIST SP 800-171 Rev. 2 in place. The implementing memo says the Department "will enforce baseline compliance with NIST SP 800-171 Rev 2" and that DFARS 252.204-7012 "remain[s] in effect."
2. Report cyber incidents within 72 hours if you handle covered defense information.
3. Keep your SPRS score current. Contracting officers still check SPRS before award.
4. Do your self-assessments on schedule. Level 1 needs an annual self-assessment and affirmation. Level 2 (Self) needs a self-assessment every three years and an annual affirmation (Dentons, citing current CMMC program materials).
5. Read every RFQ for stale language. A new solicitation should not demand a Level 2 C3PAO or Level 3 certificate during the suspension. If one does, ask the buyer before you pass on it.
6. Start a Rev. 2 to Rev. 3 gap list, but do not assume the baseline has changed yet.

Not sure which clause an RFQ carries? See how to bid on DIBBS and the DIBBS bid checklist.

What this means for machine shops bidding on DLA and Navy work

For most small shops quoting spare parts, the suspension removes the near-term cost of a third-party audit before bidding. It does not lower the bar on protecting drawings and technical data. Many machined-part RFQs come with controlled drawings, so 7012, SPRS and incident reporting still decide whether you can quote. If you are new to this work, read government contracts for machine shops and DIBBS for new suppliers.

How FedOpp helps

FedOpp's AI Chief Contracting Officer reads a solicitation and points out the CMMC level, DFARS 7012 and SPRS language before you spend time quoting. FedOpp searches DIBBS and SAM.gov and matches RFQs using 17.0M NSN and 4.2M CAGE records, so you can find the parts you can make. Learn more about DIBBS software and federal contracting opportunities.

See FedOpp plans

FAQ

Is CMMC Phase 2 suspended?

Yes. The Department of War suspended CMMC Phase 2 on July 13, 2026. The Phase 2 transition planned for November 10, 2026 will not happen on that date. During the suspension, solicitations may only require CMMC Level 1 (Self) or Level 2 (Self). Phase 1 self-assessment requirements remain in place.

Is CMMC Level 2 suspended?

The third-party Level 2 (C3PAO) assessment is suspended for new procurements. Level 2 (Self) is not. A solicitation can still ask you for a Level 2 self-assessment and annual affirmation, and the contracting officer will check SPRS before award.

What is the new CMMC Phase 2 deadline?

There is none yet. As of October 28, 2026 the Department has not announced a replacement date, and the official CMMC page describes the program as paused in Phase 1. Watch for the results of the Department's review and any new implementation schedule.

Do I still need to follow DFARS 252.204-7012?

Yes. The July 13, 2026 implementing memo says the 7012 cybersecurity requirements remain in effect. That includes NIST SP 800-171 Rev. 2 baseline security and reporting cyber incidents within 72 hours.

What if an RFQ still requires a CMMC Level 2 C3PAO certificate?

A September 3, 2026 class deviation tells contracting officers to remove or revise suspended CMMC requirements in new and existing solicitations. If you see stale C3PAO language, ask the contracting officer about it before deciding not to quote.

Was the CMMC rule repealed?

No. The suspension came by memo. The CMMC DFARS rule published September 10, 2025 (effective November 10, 2025) is still on the books. The Department paused its use of the higher assessment levels while it reviews the program.