Partly Suspended Checked October 24, 2026
On July 13, 2026, the Department suspended Phase 2, the third-party (C3PAO) Level 2 certifications due from November 10, 2026, and launched a review. Phase 1 self-assessments, SPRS scores, and annual affirmations remain in force.
Next: Watch for the outcome of the CMMC Reform Task Force review. Until then, keep meeting DFARS 252.204-7012, NIST SP 800-171 Rev. 2 and the Phase 1 self-assessment requirements.
What It Covers
A program that verifies defense contractors protect Federal Contract Information and Controlled Unclassified Information, at three levels, with the level set in each solicitation.
Who It Applies To
Defense contractors and subcontractors whose contracts involve Federal Contract Information or Controlled Unclassified Information.
Key Requirements
- Level 1: annual self-assessment against the 15 basic safeguarding requirements of FAR 52.204-21.
- Level 2: the 110 requirements of NIST SP 800-171 Rev. 2, by self-assessment now; third-party certification is suspended.
- Level 3: added NIST SP 800-172 requirements, assessed by the government (DIBCAC); also affected by the suspension.
- Scores posted to SPRS, with annual affirmations by a senior official.
What an Auditor Asks to See
- The System Security Plan and the current SPRS score.
- The affirmation, and who signed it.
Where Systems Fall Short
- A self-assessment score that the System Security Plan cannot support.
- Plans of action that never close.
How QES Helps
CMMC readiness through QES’s risk and cybersecurity partner, coordinated with the quality system’s document control.
Related Standards
Sources. eCFR — 32 CFR Part 170 (opens in a new tab); WilmerHale — Pentagon suspends CMMC Phase 2 requirements (July 2026) (opens in a new tab). Status checked October 24, 2026. This page summarizes CMMC · 32 CFR Part 170; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.