CMMC Phase II is paused: what remains in effect

The current federal position

On July 13, 2026, the Department announced the immediate suspension of CMMC Phase II requirements that had been scheduled for November 10, 2026. The Department also began a comprehensive program review. Its current CMMC page states that Phase I self-assessment requirements remain in place.

The suspension affects the rollout of Phase II and future implementation milestones. It does not mean that every cybersecurity requirement for defense contractors has disappeared.

Contractual safeguards still matter

The official announcement states that defense contractors and subcontractors remain responsible for safeguarding covered defense information under applicable contract clauses. It also says that NIST SP 800-171 Rev. 2 self-assessments and selected government-led assessments will be used during the interim period.

Whether a specific rule or clause applies depends on the organization, information, contract, and role in the supply chain. A website cannot make that determination for a visitor.

Use the pause to organize evidence

A readiness effort can still produce operational value when it focuses on the actual environment. Confirm system boundaries, information flows, users, external providers, existing controls, gaps, remediation ownership, and the records used to support self-assessment statements.

• Review current contract clauses and customer instructions with qualified advisors.
• Keep system-security documentation aligned with the system that actually exists.
• Track remediation decisions and evidence instead of relying on informal assurances.
• Monitor the official CMMC page for changes before making deadline or certification claims.

What readiness support can and cannot do

An advisory provider can help organize a gap review, document priorities, coordinate technical remediation, and prepare the environment for the applicable assessment path. Advisory work is not itself a certification and cannot guarantee an assessor, customer, or government decision.