CMMC 2.0: Navigating the Suspension of Phase II Requirements

Understanding the Current Compliance Landscape

On July 13, 2026, the Department of War announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally slated for implementation in November 2026. As detailed in the official CMMC FAQs, this suspension does not mean a total abandonment of cybersecurity rigor. All CMMC Phase I, Level 1, and Level 2 self-assessment requirements remain firmly in place.

Maintaining NIST SP 800-171 Compliance

Despite the suspension of Phase II, the underlying security requirements defined in NIST SP 800-171 continue to serve as the bedrock for protecting Controlled Unclassified Information (CUI). Defense contractors must continue to maintain their System Security Plans (SSP) and Plans of Action and Milestones (POA&M). The CMMC Assessment Guide Level 2 remains the primary reference for evaluating the effectiveness of these controls.

Strategic Recommendations for Compliance Leads

1. Prioritize Self-Assessments: Since Level 2 self-assessments are still required, ensure your SPRS (Supplier Performance Risk System) score is current and accurate.
2. Monitor Policy Updates: The suspension of Phase II is a dynamic policy shift. Continue to track dodcio.defense.gov/CMMC for further guidance.
3. Document Everything: Even without the immediate pressure of third-party assessments for Phase II, maintaining a robust audit trail is essential for demonstrating compliance under the False Claims Act.

| CMMC Level | Status | Requirement | |---|---|---| | Level 1 | Active | Annual Self-Assessment | | Level 2 | Active | Annual Self-Assessment | | Level 3 | Suspended | Triennial Gov-Led Assessment |