CMMC status today: Phase 2 suspended, what still applies

The short answer

Part 170 was written to bring in third-party assessments one phase a year. Phase 1 arrived on schedule. Phase 2, the step that would have started putting Level 2 (C3PAO) certification into contracts, was suspended on 2026-07-13, four months before it was due. The order reached contracting officers through a class deviation, so it changes what new contracts ask for and what old ones keep, not the rule itself.

For a small shop that holds CUI, the practical answer has three parts. The NIST SP 800-171 work is still owed under DFARS 252.204-7012. A contract may still ask for a Level 1 or Level 2 self-assessment. And no contract should be adding a C3PAO certification while the suspension stands. If you are not sure which of these your own contracts carry, read your contract below, or start with which CMMC level you need.

Every date so far, with its source

News stories about CMMC quote each other. This log quotes the documents: the Federal Register, the eCFR, and the class deviations the Pentagon's acquisition office publishes. Each row links to the document that dates it, and the last column says where that event stands today.

Two rows deserve a second look. The rule itself, Part 170, has not changed: the suspension works through the contract clauses, not by rewriting the rule. And the July 2026 interim rule on DoD's regulatory plan, the one that would move CMMC to NIST SP 800-171 Rev 3, has not appeared in the Federal Register. Until it does, Rev 2 is the version you are assessed against; CMMC vs NIST SP 800-171 explains how the two fit.

Fig. 02

What binds today, rule by rule

"CMMC is paused" is the headline, and it is the wrong takeaway for a shop that holds CUI. What paused is the third-party step. The cybersecurity work it was meant to check was already a contract requirement, and it still is.

Note what the second bullet does. It names DFARS 7012 as the baseline, so the 110 requirements stay the measure of a CUI system whether or not anyone outside the company checks them. What 7012 asks, line by line, is in DFARS 252.204-7012 explained; how the SPRS clauses work is in DFARS 7019 and 7020.

Read your own contract

The suspension is applied contract by contract, so the answer for your shop is in your paperwork, not in the news. Look in the clause list of each contract, order and open solicitation for the numbers below, then pick the line that matches.

A solicitation that will ask for a CMMC level also carries the notice provision DFARS 252.204-7025, so you see the level before you bid. If a prime flows a CMMC level down to you, the level it may ask for depends on what it sends you: FCI only means Level 1 (Self), CUI means Level 2 (Self) at minimum. The split is explained in FCI vs CUI.

What a small shop should do this quarter

A pause is a good quarter to do the unglamorous work, because nothing on this list waits on the suspension. It is ordered so the cheap checks come first: weeks 1 and 2 tell you which contracts matter, and the rest is the clause work that a C3PAO checks anyway.

A Conditional Level 2 status needs a score of at least 88 of 110; the POA&M builder shows which gaps may wait on a plan and which may not. To put a number on the work, the CMMC cost estimator uses DoD's own figures.

What would change this status

Six things can move the status, and each leaves a document behind. We read all six when one moves and once a month when none does. When one moves, the status box at the top of this page changes first, and every page on this site that states a CMMC rule shows that same box.

Fig. 03

Questions about the suspension

How we keep this page