Is CMMC Dead? What the 2026 Phase 2 Suspension Really Means for Contractors

If you do business with the Department of Defense, you’ve probably heard some version of the same question over the last two months: is CMMC dead?

It’s a fair question. On July 13, 2026, the Department of War suspended Phase 2 of the Cybersecurity Maturity Model Certification program, pausing the third-party assessment requirements that were set to take effect that November. Headlines called it a “freeze.” Contractors who had spent a year and a real budget preparing for a C3PAO assessment were left wondering whether that investment still mattered. Others quietly stopped their preparation altogether, betting the program was on its way out.

Here’s the short answer: no, CMMC is not dead. It’s paused for reform, and the underlying cybersecurity obligations it was built on are still very much in force. The longer answer is worth understanding, because how you interpret this suspension will shape decisions your organization is making right now.

What Actually Happened in July 2026

The Department of War suspended CMMC Phase 2 requirements, which would have required many contractors handling Controlled Unclassified Information (CUI) to complete third-party assessments through a C3PAO rather than self-attest to their compliance. That requirement had been scheduled to take effect November 10, 2026.

The stated rationale wasn’t that cybersecurity no longer mattered. Department leadership pointed to the cost and administrative burden the certification process was placing on small and medium-sized businesses in the Defense Industrial Base, citing concerns that the process was pushing capable, innovative companies away from defense contracting altogether. DoW CIO Kirsten Davies was direct about the balance the Department is trying to strike, noting that “robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness,” while Under Secretary Michael Duffey framed the pause as part of a broader push to “reduce bureaucracy” without losing sight of that mission.

In place of Phase 2, the Department launched a CMMC Reform Task Force to conduct a 60-day, top-to-bottom review of the program, including a public Request for Information to gather industry feedback on cost drivers, assessment bottlenecks, and where the framework could be simplified.

Is CMMC Dead? What Hasn’t Changed

This is the part that gets lost in “CMMC is dead” headlines: the suspension applies specifically to Phase 2’s third-party assessment mandate. It does not touch the underlying security requirements contractors have been operating under for years.

Still in force today: DFARS 252.204-7012 continues to require contractors handling covered defense information to implement the 110 security controls in NIST SP 800-171 and to report cyber incidents. FAR 52.204-21’s basic safeguarding requirements for federal contract information remain active for a broader population of contractors. CMMC Phase 1 self-assessment obligations are unaffected — organizations still need to score themselves against Level 1 or Level 2 requirements, submit that score to SPRS, and have a senior official sign an annual affirmation of compliance. System security plans, plans of action and milestones, and subcontractor flow-down requirements all remain exactly where they were.

That last point matters more than it might seem. A paused certification requirement doesn’t pause False Claims Act exposure. Contractors who submit an SPRS score that doesn’t reflect their actual security posture remain exposed to enforcement action, suspension or not.

The Reform Task Force, and What Comes Next

The CMMC Reform Task Force’s 60-day review clock runs out around September 13, 2026 — a matter of days from now. Industry observers following the process expect the resulting recommendations to land somewhere among a few likely outcomes: Phase 2 resuming on a delayed schedule largely as designed; a narrower version that reserves third-party assessment for larger contracts or higher-risk contractors while smaller firms move to enhanced self-assessment; a model built primarily around self-assessment plus executive attestation, with third-party review reserved for a small slice of the DIB; or a more substantial rework of the certification framework itself.

Nobody outside the Department knows yet which of these the report will land on. What we do know is that the direction of travel — a standardized, verifiable cybersecurity baseline across the federal supply chain — hasn’t reversed. The suspension is about how that goal gets implemented, not whether it’s still the goal.

So, Is CMMC Dead?

No. What happened in July was a pause on one enforcement mechanism — third-party certification — while the Department reworks how that mechanism gets applied. The compliance obligations that mechanism was designed to verify are unchanged, and enforcement risk under existing contract clauses hasn’t gone anywhere.

For contractors, treating this as “CMMC is over” is the riskiest possible read of the situation. A better one: the rules for how your compliance gets verified may shift again this fall, but the requirement to actually be compliant with NIST SP 800-171 hasn’t moved.

What Contractors Should Do Now

Don’t stand down. A few concrete steps make sense regardless of which way the Reform Task Force report lands: make sure your current SPRS score is defensible against real evidence, since that is the single highest-risk item during a suspension period. Keep your System Security Plan and POA&M current rather than shelving them until Phase 2’s fate is settled. Continue remediation work already underway rather than pausing it, since NIST SP 800-171 compliance was never contingent on third-party certification in the first place. And watch for the Reform Task Force’s recommendations in the coming weeks, since they’ll determine how — not whether — your organization eventually demonstrates compliance.

CMMC’s certification mechanics are in flux. The security bar defense contractors are expected to clear is not. If you want a clear read on where your organization actually stands against NIST SP 800-171 and CMMC Level 2 today — regardless of how the Phase 2 review resolves — Custom Cybersecurity Solutions can help you find out.