What the Phase 2 suspension actually changed
On 13 July 2026 the Department suspended the rollout of CMMC Phase 2, the step that would have put third-party assessments into new solicitations, pending a program review. This page separates what that paused from what it left exactly where it was. It will be revised; the date below is the one that counts.
The short version
The certification mechanism paused. The obligation to protect the information did not. DFARS 252.204-7012, NIST SP 800-171 Rev. 2, the accuracy of your SPRS score and the annual affirmation all survive the suspension unchanged.
What was suspended
Phase 2 of the CMMC rollout would have expanded mandatory third-party assessments: Level 2 certification by a C3PAO written into new solicitations, on a schedule set by the CMMC rule. On 13 July 2026 the Department suspended that rollout and opened a 60-day review of the program. Pending milestones paused with it.
What that means in practice: the timeline on which a contractor would be required to hold a third-party certification is no longer running. It has not been replaced with a new date.
What did not change
DFARS 252.204-7012
The clause is untouched. If it is in your contract, you owe adequate security on every system that handles covered defense information, you owe incident reporting to DoD within 72 hours, and you owe the flow-down to your own subcontractors. None of that was ever a CMMC provision; it predates CMMC and it does not depend on it.
NIST SP 800-171 Rev. 2
The interim guidance issued alongside the suspension confirmed Rev. 2 as the active baseline for self-assessments, contract requirements and 7012 compliance. Contractors were told plainly not to abandon their Rev. 2 programs. Rev. 3 remains published but not adopted; see Rev. 2 vs Rev. 3 for the standing class deviation and the parameter memo.
SPRS accuracy
The score you post in SPRS is a representation to the government. A suspension of assessments does not lower the standard for that representation. A score that overstates your implementation was a problem before 13 July and is the same problem after it.
The annual affirmation
Where a contract already requires a senior official's affirmation of your self-assessment, that requirement continues on its own cycle. The suspension paused the arrival of third-party checks; it did not pause the self-assessment regime that Phase 1 established.
What happens next
Nothing changes for you until one of two things lands: a class deviation, or a published rule. The review may recommend changes to the program, to its phases, or to the standard it points at, but a recommendation is not a requirement. Watch for the deviation or the rule, not the commentary.
Meanwhile the durable work is the same as it was: know your boundary, keep the system security plan true, collect evidence per assessment objective, close the five-point items, and keep your SPRS score honest. The list is here.
Readers of this page usually also want
Basis for this page
The suspension date, the 60-day review, and the interim guidance confirming Rev. 2 as the active baseline are taken from the Department's July 2026 announcements as summarised in the publisher's research notes of 2026-09-08. The four things that did not change are the publisher's reading of the clause and the rule. This page is revised when the review reports or a deviation or rule is published.