The current CMMC status date is July 13, 2026, the day the Department of War suspended the transition to Phase 2 of the Cybersecurity Maturity Model Certification program. Phase 2 would have made third-party certification a condition of award on November 10, 2026. The program is operating in Phase 1, and Phases 2, 3, and 4 are held pending a review by the CMMC Reform Task Force.

The suspension paused the certification requirement. It did not pause the security requirement. Level 1 and Level 2 self-assessments, your score in the Supplier Performance Risk System, your annual affirmation, and every obligation under DFARS 252.204-7012 are all still in force today.

There is also a second status date that belongs to your company rather than to the program, and it is the one that decides whether you can accept an award next month. Below we cover both, where the program stands as of early October 2026, who the rules still reach, what has to be true this year, and what suppliers should be doing while the review runs.

What Is the CMMC Status Date?

The CMMC status date means one of two things: the date the program's current posture took effect, which is July 13, 2026, or the date your own CMMC status was recorded in SPRS. Both matter, and confusing them is how suppliers end up ineligible for an award they expected to win.

Contracting officers care about your date. The program date tells them which requirements they can place in a solicitation. Your status date tells them whether you can meet the requirement they placed. One is national news and the other is a line in a federal database with your company's name on it.

The Program Status Date: July 13, 2026

The program status date is July 13, 2026, when two memoranda issued under publication case 26-P-1023 suspended the advancement to CMMC Phase 2. The Department of War Chief Information Officer signed the policy memorandum and the Under Secretary of War for Acquisition and Sustainment signed the implementing memorandum the same day.

The implementing memorandum did specific work. It directed that active solicitations carrying Level 2 (C3PAO) or Level 3 (DIBCAC) requirements be amended to remove them, and that existing contracts be modified to remove them before the next option period or at the next scheduled administrative modification. During the suspension, requiring activities may designate only Level 1 (Self) or Level 2 (Self), and the Department stated it would grant no CMMC waivers while the review runs.

A policy memorandum alone does not bind a contracting officer, which is why the next step mattered. Class Deviation 2026-O0025 reached Revision 2 on July 16, 2026 and Revision 3 on September 3, 2026, carrying the suspension into the acquisition rules that contracting officers actually apply. That is the point where the pause stopped being an announcement and became instruction. Suppliers tracking how cybersecurity rules reach their contracts should watch the deviation rather than the press release.

Your Own CMMC Status Date in SPRS

Your CMMC status date in SPRS is the date your assessment results were entered, and it starts the clock that governs your eligibility. A Level 1 self-assessment is performed annually. A Level 2 self-assessment is performed every three years. Each is accompanied by an affirmation entered by a senior official of your company after the assessment, after any POA&M closeout, and every year in between.

The affirmation date is the one that catches people out. Under the DFARS clause, an assessment without a current affirmation is not current, which means a perfectly valid three-year Level 2 self-assessment stops counting the moment its annual affirmation lapses. A company can hold a good score and still fail an eligibility check because nobody signed in month thirteen.

How Long Is a CMMC Status Valid?

A CMMC status is valid for one year at Level 1 and three years at Level 2 and Level 3, with an annual affirmation required throughout. Conditional status is the exception and runs on a much shorter clock: 180 days from the Conditional status date to close the open POA&M items and pass a closeout assessment, after which the Conditional status expires.

Separately, DFARS 252.204-7019 requires a NIST SP 800-171 DoD Assessment not more than three years old unless a solicitation says otherwise. That requirement predates CMMC, runs independently of it, and did not pause in July. Any supplier treating the suspension as a reason to let an assessment age out has misread which clause was suspended.

What Is the Status of CMMC Right Now?

As of early October 2026, CMMC is operating in Phase 1, with Phase 2 suspended and Phases 3 and 4 held in abeyance until further notice. Phase 1 took effect November 10, 2025 when the DFARS clause rule became effective, and the program rule at 32 CFR Part 170 took effect December 16, 2024 before it.

The phase schedule and its current state look like this, drawing on 32 CFR 170.3(e) for the original dates and the July 13, 2026 memoranda for the status column.

PhaseOriginal StartWhat the Rule Set OutStatus in October 2026Phase 1November 10, 2025Level 1 (Self) or Level 2 (Self) as a condition of award; Level 2 (C3PAO) at the Department's discretionIn effectPhase 2November 10, 2026Adds Level 2 (C3PAO) as a condition of award for applicable contracts; Level 3 at the Department's discretionSuspended July 13, 2026Phase 3November 10, 2027Level 2 (C3PAO) for all applicable contracts and option periods; Level 3 for all applicable contractsHeld in abeyancePhase 4November 10, 2028Full implementation across applicable solicitations and contracts, including option periods on older contractsHeld in abeyance

One structural detail deserves attention because it hides in plain sight. DFARS 252.204-7020 was renumbered to DFARS 252.240-7997 and the information security rules moved into a new DFARS Part 240. A supplier searching its contract files for the old clause number will come up empty on clauses that are still fully in force.

Did DoD Suspend CMMC?

The Department suspended the Phase 2 transition, not the CMMC program. The program rule at 32 CFR Part 170 was not repealed or amended, the DFARS clause at 252.204-7021 remains in the regulation, and contracts that already carry a CMMC requirement still carry it.

What stopped was the expansion to third-party certification. Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, directs contracting officers to remove or revise CMMC third-party requirements in new and existing solicitations and contracts, applying revised FAR Part 40 and DFARS Part 240 text in place of the codified version. Revision 3 superseded Revision 2 without changing the CMMC language, which tells you the Department is holding its position rather than drifting.

Where the CMMC Reform Task Force Review Stands

The CMMC Reform Task Force completed its 60-day review around September 11, 2026 and delivered its recommendations to the Department of War Chief Information Officer. The review drew on a public request for information whose comment window closed August 14, 2026, and the Department has indicated an update on Level 2 requirements by October 2026.

Publication is a separate decision from delivery, and as of early October the report has not been released. Public remarks from the Department have pointed at direction without committing to specifics: moving from point-in-time assessments toward continuous monitoring, more attention to operational technology in manufacturing environments, and cleaning up inconsistent CUI marking. Four outcomes remain realistic, and planning should hold all of them: reinstatement with a new start date, restructuring around continuous monitoring or re-prioritized controls, further delay, or formal amendment through rulemaking.

Is CMMC Required Now?

Yes, CMMC is required now where your contract carries the clause. During the suspension, a contract can require Level 1 (Self) or Level 2 (Self), and you must hold and maintain that status for the duration of the contract. What a contract cannot currently require is a Level 2 (C3PAO) or Level 3 (DIBCAC) assessment.

Requirement arrives through your contract, not through the calendar. The DFARS clause at 252.204-7021 obligates you to have and maintain a current CMMC status at the level the contracting officer specifies, for every information system that processes, stores, or transmits FCI or CUI in performance of that contract. A solicitation without the clause imposes nothing; a solicitation with it imposes everything at the level named. Our own compliance program starts with that question for exactly this reason.

Is CMMC Required for DoD Contracts?

CMMC is required for DoD contracts that include the clause and involve Federal Contract Information or Controlled Unclassified Information on contractor systems. The program rule carves out two categories: contracts solely for commercially available off-the-shelf items, and contracts at or below the micro-purchase threshold. It also does not reach federal information systems that contractors operate on the government's behalf, which fall under separate rules.

Do You Still Need a C3PAO Assessment?

You do not need a C3PAO assessment under current Department guidance, because requiring activities may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) while the suspension holds. Solicitations that carried those designations are being amended to remove them, and existing contracts are being modified at the next option period or administrative modification.

Not needed today is different from not needed. The Department has not announced whether or when third-party assessment returns, and the work behind a certification assessment is the same work that produces a defensible self-assessment score. Companies treating the pause as a cancellation will restart from zero whenever the requirement comes back, on whatever notice the Department gives.

What the Suspension Did Not Change

The suspension left the substance of defense cybersecurity untouched. Every item below continues to apply exactly as it did on July 12, 2026:

• DFARS 252.204-7012, including implementation of NIST SP 800-171, cloud services meeting security requirements equivalent to the FedRAMP Moderate baseline, and reporting of cyber incidents within 72 hours of discovery
• The 110 security requirements in NIST SP 800-171 Revision 2, which the Department confirmed it will continue to enforce during the suspension
• Level 1 (Self) and Level 2 (Self) assessments as conditions of award where a contract carries them
• Current summary scores posted in SPRS, and the annual affirmation by your affirming official
• DFARS 252.204-7019, requiring an assessment not more than three years old
• Government-led assessments by the Defense Industrial Base Cybersecurity Assessment Center, which can supersede your own posted status
• Flow-down of requirements to subcontractors at all tiers
• False Claims Act exposure on everything you certify

That last item is not theoretical, and the clearest recent example sits in our own market. In June 2026 the Department of Justice announced that LOGZONE Inc., a Huntsville defense contractor, agreed to pay $507,144 to resolve False Claims Act allegations tied to two Navy contracts worth roughly $680,000. The company had posted a perfect self-assessed SPRS score of 110 in October 2021; a Defense Contract Management Agency assessment in February 2024 scored it at negative 170, near the bottom of the possible range of negative 203 to 110.

Two details make that case instructive. No breach occurred, and no whistleblower filed. The government's own assessment process surfaced the gap, which means a 280-point delta between a posted score and reality is discoverable without anything going wrong and without anyone reporting you. The settlement was announced five days before the Phase 2 suspension, and nothing in the suspension changed the exposure it illustrates.

Who Is Required to Be CMMC Certified?

CMMC reaches all DoD contract and subcontract awardees that process, store, or transmit Federal Contract Information or Controlled Unclassified Information on their own information systems in performance of a DoD contract. Company size, contract value, and length of relationship do not change the answer. The type of information you handle does.

The Department's program managers select the level for each contract based on the information involved, and primes must require compliance throughout the supply chain at all tiers. We see this most often with government contractors who discover the obligation through a prime's flow-down rather than through a solicitation of their own.

Do Subcontractors Need CMMC?

Yes, subcontractors need CMMC when they handle FCI or CUI, and the minimum level depends on what they handle rather than on their tier. A subcontractor handling only FCI needs Level 1 (Self). A subcontractor handling CUI needs at least Level 2 (Self). Where a prime contract requires Level 2 (C3PAO) or Level 3, a subcontractor handling CUI needs at least Level 2 (C3PAO).

The prime carries a verification duty on top of that, and it is a common starting point for CMMC readiness work. Under the clause, the contractor must flow the correct level down to subcontracts, including subcontracts for commercial products and services, and must confirm the subcontractor holds a current CMMC status before award. Subcontractors who assume their prime's compliance covers them have the relationship backwards.

What Is the Difference Between CMMC Level 1 and Level 2?

The difference between CMMC Level 1 and Level 2 is the information protected and the depth required. Level 1 covers FCI and consists of the 15 requirements in FAR 52.204-21(b)(1), self-assessed annually, with no POA&M permitted. Level 2 covers CUI and consists of the 110 requirements in NIST SP 800-171 Revision 2, assessed every three years, with a limited POA&M allowed.

One detail trips up technical teams. CMMC Level 2 is still tied to NIST SP 800-171 Revision 2, even though NIST published Revision 3 in May 2024. Building to Revision 3 does not satisfy Level 2 until the Department changes the rule. The full breakdown of CMMC levels covers the rest of the structure, including Level 3 and its 24 selected NIST SP 800-172 requirements.

What Are the CMMC Compliance Requirements for 2026?

For 2026, the CMMC compliance requirements are a current self-assessment at the level your contract names, a summary score posted in SPRS, a current annual affirmation, a system security plan covering the systems in scope, and a POA&M worked to closure within the permitted window. Third-party certification is not among them while the suspension holds.

Scope decisions come first and shape everything after. You determine which systems, people, and locations handle FCI or CUI, document that boundary, and assess against it. External service providers belong in that picture: a provider that processes, stores, or transmits CUI or Security Protection Data such as logs, configuration data, or administrator credentials on its own assets falls inside your assessment scope and is described in your system security plan with a customer responsibility matrix. A documented System Security Plan is where those relationships get recorded rather than assumed.

Current requirements are not static, and the Task Force review may reshape them. The sensible reading of the requirements in force today is that they represent a floor the Department has said it will continue to enforce, not a ceiling that reform will lower.

What Is a Good SPRS Score?

A good SPRS score at Level 2 is 110, which means every requirement in scope is met. The scoring method starts at 110 and subtracts the assigned value of each requirement not met, with values of 1, 3, or 5 points, and the result can run negative to a floor of negative 203.

Conditional status is allowed at 88 of 110 or better, which is a score ratio of 0.8, provided no POA&M item is worth more than 1 point and the POA&M excludes six named requirements including the system security plan requirement. Conditional status then expires if the POA&M is not closed within 180 days. A structured gap analysis against all 110 requirements is the only reliable way to know which figure you actually hold rather than the one you believe you hold.

Who Signs the CMMC Affirmation?

The CMMC affirmation is signed by your affirming official, a senior level representative from within your own company who is responsible for compliance and has the authority to affirm it. That person enters the affirmation in SPRS after each assessment, after any POA&M closeout, and annually.

The signature carries weight beyond the database. An affirmation is a representation to the government, and a federal system of record retains it. False Claims Act exposure attaches to the organization and can attach to the individual, which is why the affirming official should be reviewing documented evidence rather than accepting a verbal assurance that the controls are in place. Your risk assessment should produce the evidence that makes that signature defensible.

How Does the CMMC Status Date Affect DoD Suppliers?

The CMMC status date affects DoD suppliers through award eligibility, which attaches to contract actions rather than to the program's phase schedule. A new award, a recompete, a renewal, and an option period exercise each trigger the requirement in whatever form the contract carries at that moment.

Existing relationships provide no continuity at those moments. A supplier three years into a contract faces the same eligibility check at the next option exercise as a company bidding for the first time. Huntsville's concentration of primes and Tennessee Valley subcontractors means most companies here hold several contracts with staggered option dates, which turns one compliance question into a calendar problem.

Primes add a second layer of pressure that moves faster than the Department does. Many continue to require evidence from subcontractors regardless of the suspension, because their own flow-down duty did not pause either. Meeting those contract requirements is frequently what brings a supplier to the table well before any solicitation names a level.

Can You Bid Without a Current CMMC Status?

You can bid without a current CMMC status in many cases, but you must hold the required status by the time of award. The practical risk is timing rather than permission. A Level 1 self-assessment moves quickly; a Level 2 self-assessment across 110 requirements with real remediation behind it does not, and award schedules rarely wait.

What Should Suppliers Do During the Pause?

Suppliers should use the pause to close the gap between their posted position and their actual position. Work through it in this order:

1. Pull every active DoD contract and subcontract and identify which carry DFARS 252.204-7021, 252.204-7012, 252.204-7019, or the renumbered 252.240-7997, remembering that the old clause numbers may not match current text.
2. Map the option exercise and recompete date on each one, since those are the moments that trigger the requirement regardless of what the program does next.
3. Confirm your scope: which systems, people, and locations touch FCI or CUI, and which external providers hold your CUI or Security Protection Data.
4. Run an honest assessment against the applicable requirements and compare the result to the score currently posted in SPRS, treating any material gap as the priority it is.
5. Close POA&M items toward a full score rather than toward the Conditional threshold, because a maximum score influences award decisions now rather than whenever assessment requirements change.
6. Keep the affirmation current and the evidence organized, so the position you report is the position an assessor would find.

This is where a reactive technology model fails suppliers. Break-fix support arrives after something breaks, and a defensible score requires controls that have been running continuously and evidence that has been collected along the way. We built our managed cybersecurity model around that gap, with monitoring, documentation, and evidence maintained as part of the service rather than assembled when a prime asks.

How CMMC Compares to Other Frameworks

CMMC sits alongside several frameworks suppliers get asked about, and each one answers a different question. CMMC verifies your organization, NIST SP 800-171 supplies the requirements it verifies, NIST SP 800-53 governs federal systems, and FedRAMP certifies the cloud platforms inside your boundary. They stack rather than substitute.

Is NIST 800-53 the Same as CMMC?

No, NIST 800-53 is not the same as CMMC. NIST SP 800-53 is a control catalog for federal information systems, with no assessment or certification attached. CMMC is a Department of War program that verifies contractor implementation of NIST SP 800-171, which is itself derived from 800-53 and adapted for protecting CUI on nonfederal systems.

The practical distinction is who the standard governs. Your own systems answer to NIST SP 800-171 through your contract clauses. Federal systems and the cloud services holding federal data answer to 800-53 through other programs. Clear separation between the two is the first step in any NIST compliance scoping effort.

What Is the Difference Between CMMC and FedRAMP?

The difference between CMMC and FedRAMP is what each one certifies. CMMC certifies your organization and its handling of FCI and CUI. FedRAMP certifies cloud service offerings used to hold federal data, through an independent assessment and a government authorization.

DFARS 252.204-7012 ties the two together. A cloud service provider that stores, processes, or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, now designated Class C under FedRAMP's 2026 rules. That means a CMMC assessor examining your CUI boundary will look at the cloud platforms inside it and expect to see that standard met.

Frequently Asked Questions

Is CMMC Cancelled?

No, CMMC is not cancelled. The Department of War suspended the transition to Phase 2 on July 13, 2026 and held later implementation milestones pending review. The program rule at 32 CFR Part 170 stands unamended, Phase 1 requirements are in effect, and contracts that already carry a CMMC requirement continue to carry it.

When Does CMMC Phase 2 Start Now?

No new start date for CMMC Phase 2 has been announced. The original date of November 10, 2026 was suspended, and the Department has not stated when or whether third-party assessment requirements return. The Reform Task Force delivered its recommendations around September 11, 2026, and publication of the report is a separate decision that had not occurred as of early October 2026.

What Is the DoD Equivalent to FedRAMP?

The Department's closest equivalent to FedRAMP is the DoD Cloud Computing Security Requirements Guide, which layers additional impact level requirements on top of a FedRAMP baseline for cloud services holding defense data. It governs cloud services rather than contractor organizations, so it sits beside CMMC rather than overlapping it.

What Happens If Your SPRS Score Is Low?

A low SPRS score signals unimplemented NIST SP 800-171 requirements and can cost you award eligibility where a contract sets a threshold. The greater risk is a score that is high but inaccurate, since a government-led assessment can supersede your posted status and a materially false score can convert routine invoices into False Claims Act exposure.

What Is CMMC Conditional Status?

CMMC Conditional status is a temporary status granted when an organization scores at least 88 of 110 and has a POA&M meeting strict limits, including no item worth more than 1 point and no item among six named requirements. The organization then has 180 days to close those items and pass a closeout assessment, after which the Conditional status expires if the work is incomplete.

Does the Pause Change Your DFARS 252.204-7012 Obligations?

No, the pause changes nothing about DFARS 252.204-7012. Implementation of NIST SP 800-171, security requirements equivalent to the FedRAMP Moderate baseline for cloud services holding covered defense information, and reporting of cyber incidents within 72 hours of discovery all continue wherever that clause appears in a contract.

The Bottom Line

The CMMC status date that made headlines is July 13, 2026, and it marks a pause in third-party certification rather than a pause in defense cybersecurity. The status date that governs your next award is the one attached to your own assessment and affirmation in SPRS, and it keeps running whatever the program does. Phase 1 is live, Level 1 and Level 2 self-assessments still condition awards where contracts carry them, and DFARS 252.204-7012 never moved.

Suppliers who treat this period as free time will meet the same requirements later with less notice. Suppliers who use it to scope honestly, close POA&M items toward a full score, and keep evidence current will be ready for whatever the Task Force review produces. That holds for the government contractors, manufacturers, healthcare organizations, and financial firms we work with across Huntsville and North Alabama, since the underlying discipline is identical even when the frameworks differ.

If you want a clear picture of where your score stands against what your contracts actually require, the team at Interweave Technologies is glad to walk through it with you. Give us a call at 256.837.2300.

‍