Published Updated By
By
Published Updated

Key takeaways

  • Phase II is suspended; this does not cancel safeguarding duties.
  • Review self-assessment requirements and issued contract changes.
  • Use official guidance, not an assumed replacement deadline.

The Department of War announced the suspension of CMMC Phase II on July 13, 2026. The planned November 2026 transition is paused; Phase I self-assessment requirements remain in place. Contractors should clarify their current assessment route while continuing applicable safeguarding work.

The official CMMC page and implementation memo are the sources for this update. The memo addresses procurement designations and changes to solicitations and existing agreements. The following checklist turns that guidance into questions for your team.

1. Confirm the assessment route in your procurement

The memo directs requiring activities to use Level 1 (Self) or Level 2 (Self) designations during the suspension, rather than Level 2 (C3PAO) or Level 3 (DIBCAC). Compare those instructions with your current procurement documents.

If you previously planned an independent assessment, confirm the applicable requirement before assuming that plan remains mandatory.

2. Check amendments and contract modifications

The memo directs changes to active solicitations and existing agreements containing the affected requirements. Check whether the relevant amendment or modification has been issued for your work.

Ask your contracting officer or prime contractor about inconsistent language. Do not rewrite your obligations based only on a headline.

3. Maintain safeguarding and reporting responsibilities

The pause does not remove the applicable DFARS 252.204-7012 duties. Continue protecting covered information and operating your security controls.

Review who owns incident response and reporting, including responsibilities shared with service providers.

4. Keep self-assessment records accurate

Review your applicable assessment and affirmation requirements. Check that your system scope, implementation descriptions, and supporting evidence agree.

An incomplete control does not become implemented because an assessment deadline changes. Record gaps honestly and address them through an appropriate plan.

5. Prepare for further guidance without inventing a date

Use the review period to improve documentation, evidence, and control ownership. Monitor authoritative updates before setting a replacement milestone.

This article does not assume that the original schedule will resume on a particular date. Your near-term plan should reflect the requirements currently issued for your work.

Sources

Back to articles