Update, July 2026: The mandatory Level 2 third-party assessment requirement that this article was originally written to prepare contractors for — the "Phase 2" milestone that was set to take effect November 10, 2026 — was suspended by the Department of Defense on July 13, 2026. If you came here expecting a countdown to a hard C3PAO deadline, the countdown has been paused. It has not been cancelled, and the underlying compliance obligations that already apply have not changed. This guide covers what was planned, what actually happened, what still applies today, and what a genuinely prudent defense contractor does with that information.
What the Phase 2 Deadline Was Supposed to Do
The CMMC 2.0 final rule (32 CFR Part 170) took effect December 16, 2024, and the companion acquisition rule (48 CFR) that actually puts CMMC clauses into DoD contracts took effect November 10, 2025 — the start of Phase 1. Under the DoD's published phased-rollout plan, Phase 1 requires self-assessment attestation for Level 1 and Level 2 status on applicable new solicitations. Phase 2, scheduled to begin one calendar year after Phase 1 — November 10, 2026 — was set to add a requirement for independent third-party certification (CMMC Status of Level 2 via a C3PAO, a CMMC Third-Party Assessment Organization accredited by the Cyber AB) as a condition of contract award for solicitations involving Controlled Unclassified Information (CUI). Phase 3, one year further out, was planned to extend that C3PAO requirement to contract option exercises and add a government-led Level 3 assessment requirement for the most sensitive programs.
That structure is why this deadline drew so much attention through the first half of 2026: it was the point at which self-attestation — "we assessed ourselves and we're compliant" — stopped being sufficient for most Level 2 contracts, and an independent assessor's sign-off became mandatory instead.
The July 13, 2026 Suspension
On July 13, 2026, DoD CIO Kirsten Davies announced the immediate suspension of the Phase 2 third-party assessment ramp-up. According to the department's own release and subsequent reporting, all pending and future CMMC milestones tied to the Phase 2 rollout are suspended "until further notice," while Phase 1 self-assessment requirements — in effect since November 2025 — remain fully in force. DoD launched a 60-day "top-to-bottom" review, run by a task force charged with recommending a revised framework that "prioritizes speed to capability" and lowers barriers for small, medium, and non-traditional defense businesses. Davies characterized the existing rollout as imposing burdens on the Defense Industrial Base that were, in her words, often prohibitive — particularly for smaller subcontractors. SBA Administrator Kelly Loeffler publicly welcomed the move, citing feedback from small businesses that CMMC compliance costs were pushing some out of the defense supply chain entirely.
This is a fast-moving situation as of publication. The 60-day review window means a revised timeline, a scaled-back assessment model, or a reinstated Phase 2 date could all be announced before this page's next update. Contractors should treat this section as the most current public information available, not as a permanent resolution, and should verify current status directly at the DoD CMMC program's official site before making contract-bid decisions.
What the suspension does not do: it does not remove Phase 1 self-assessment obligations, it does not retroactively invalidate CMMC clauses already written into active contracts, and it does not signal that CUI-handling security requirements under NIST SP 800-171 have gone away. The suspension is specifically about the mandatory independent verification layer — not about whether the underlying security practices are still expected.
What Still Applies Today
Every contractor and subcontractor handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under an active or new DoD contract that includes CMMC clauses is still subject to Phase 1 requirements: annual self-assessment and affirmation for Level 1 (FCI-handling companies, 17 practices from NIST SP 800-171) or Level 2 self-assessment for companies whose specific contract does not require third-party certification. The underlying control set — 110 security requirements from NIST SP 800-171 across 14 domains, covering access control, incident response, configuration management, and the rest — has not changed and remains the operative standard contractors are attesting against.
Existing contracts that already specify a C3PAO Level 2 requirement (because they were awarded or modified with that clause already in place) are not automatically relieved of that requirement by this announcement — the suspension applies to the planned expansion of the mandatory C3PAO requirement to new solicitations under Phase 2, not to clauses already executed. Contractors with an active contract specifying third-party certification should confirm their specific contractual obligation with their contracting officer rather than assume the suspension applies to them.
What CMMC Level 2 Actually Requires (Still the Baseline)
Regardless of whether certification is self-attested or third-party assessed, Level 2 maps to the 110 practices in NIST SP 800-171, spanning access control, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, system and information integrity, and awareness and training. The most operationally demanding requirements for a small contractor typically involve CUI scoping and data mapping (identifying every system that stores, processes, or transmits CUI — harder than it sounds once CUI is flowing through email and shared drives), mandatory multi-factor authentication with no convenience exceptions, a documented System Security Plan and Plan of Action and Milestones, and a documented incident response capability with CUI-incident reporting to DIBNet within 72 hours.
Under CMMC 2.0's Plan of Action and Milestones (POA&M) rules, certain critical controls cannot be deferred via POA&M at all, and any open POA&M on an eligible control must be closed within 180 days — a meaningful tightening compared to earlier compliance regimes where documentation of "planned" controls could substitute indefinitely for implemented ones.
Where MSPs Fit Into CMMC Scope
CMMC follows the CUI, not the org chart. An MSP that accesses, stores, processes, or transmits CUI on behalf of a defense contractor client — or whose remote-management tooling reaches into systems where CUI lives — sits inside that contractor's CMMC assessment boundary and is subject to the same Level 2 practices. Activities that commonly pull an MSP into scope include remote monitoring of CUI-hosting servers or endpoints, backup services that replicate CUI-containing systems onto MSP-controlled infrastructure, email management where CUI transits MSP-hosted systems, help-desk access to CUI-processing workstations, and cloud infrastructure management where CUI workloads run.
An MSP can potentially scope-reduce by architecturally isolating its management plane from CUI-handling systems, but that requires documented technical separation — a contract clause stating "we don't look at your data" does not satisfy an assessor who checks the actual network architecture. Any defense contractor evaluating or re-evaluating their IT provider should ask directly: what is your current CMMC status, what documentation can you produce, and how is your access to our environment architecturally scoped relative to our CUI systems? See our guide to choosing an MSP for the broader evaluation framework this fits into.
What a C3PAO Assessment Costs and Takes (Still Worth Budgeting For)
Even with the mandatory timeline paused, contractors who expect a third-party assessment requirement to return in some form should understand the real cost and duration involved, since this is the figure most under-budgeted item in defense-contractor compliance planning. A Level 2 C3PAO assessment for a small contractor typically involves document review (System Security Plan, POA&M, policies, and supporting evidence), personnel interviews, and technical testing of controls, and commonly takes 3–5 days of assessor time on top of substantial pre-assessment preparation. Assessment fees for a small-to-mid-size contractor commonly run $20,000–$60,000 depending on company size, number of in-scope systems, and the assessor firm selected — and that figure covers only the assessment itself, not the remediation work required to be ready for it, which can exceed the assessment cost for a contractor starting from a weak security baseline.
There are approximately 83 accredited C3PAOs authorized to conduct Level 2 assessments as of mid-2026, and even before the suspension, that pool was reported to be booked out 6–9 months in advance as contractors raced to beat the original November deadline. Whatever assessment cadence emerges from DoD's review, that capacity constraint is a structural feature of the market, not a temporary one tied to a single deadline — contractors that wait until a new date is announced to begin engaging a C3PAO or a Registered Practitioner Organization (RPO) should expect the same queuing pressure to reassert itself quickly.
An RPO can help identify control gaps and prepare documentation ahead of a formal assessment, but RPO status does not authorize an organization to conduct the C3PAO assessment itself — those are separate accreditations, and contractors sometimes confuse "we work with an RPO" with "we're assessment-ready."
What Contractors Should Actually Do Right Now
The practical guidance for defense contractors during the review period is not "wait and see" — it's "don't stop the work you should have been doing anyway, and don't over-invest in a specific date that's no longer fixed." Concretely:
Keep your Phase 1 self-assessment current and accurate. That obligation has not moved. A self-assessment score of 110/110 without substantiating evidence does not hold up under DoD scrutiny even absent a formal C3PAO review, and false attestation carries its own liability exposure under the False Claims Act.
Continue closing gaps identified in your System Security Plan and POA&M rather than treating the suspension as a reason to pause remediation. Whatever framework emerges from the 60-day review is highly likely to still be anchored in NIST SP 800-171 — the practices themselves are not what's under review; the assessment mechanism and its burden on small businesses is.
Don't cancel a C3PAO engagement you've already started without confirming your specific contract's requirements with your contracting officer. If your contract already carries a third-party certification clause, the suspension of the broader Phase 2 rollout does not necessarily relieve your specific obligation.
Confirm your subcontractors' and your MSP's status the same way you'd confirm your own. The flow-down requirement — a prime contractor's CMMC obligations extending to sub-tier suppliers handling CUI — has not been suspended, and the DIB supply chain conversation about compliance costs cuts in both directions: primes are still asking subs about security posture in source selection.
Watch the 60-day review's output, not just the calendar. Given the stated goal of "speed to capability" for small and non-traditional businesses, a plausible outcome is a scaled-down or tiered third-party assessment model rather than a straight reinstatement of the original Phase 2 timeline — but that is informed expectation, not confirmed policy, as of this writing. The task force's Request for Information closes August 14, 2026; our follow-up on what the review could mean for defense-contractor MSPs covers what it is asking and how providers inside a client's assessment boundary should respond.
Frequently Asked Questions
Is CMMC Level 2 third-party certification cancelled?
No. As of July 13, 2026, DoD suspended the planned November 10, 2026 expansion of the mandatory C3PAO requirement pending a 60-day review, and described the pause as "until further notice" rather than a cancellation. Existing contracts that already specify third-party certification are a separate question — confirm your specific obligation with your contracting officer.
Do I still need to complete a CMMC self-assessment?
Yes. Phase 1 self-assessment and affirmation requirements for Level 1 and Level 2, in effect since November 10, 2025, are unaffected by the Phase 2 suspension and remain a condition of contract award on applicable solicitations.
Should I still hire a C3PAO or keep an existing engagement?
If your contract already requires third-party certification, that obligation stands until your contracting officer confirms otherwise. If you were preparing for the now-paused Phase 2 expansion specifically, continuing your NIST SP 800-171 remediation work is still worthwhile — the practices are the durable requirement regardless of which assessment mechanism DoD ultimately adopts — but the urgency of booking a specific C3PAO assessment slot before November 2026 has eased.
Does the suspension apply to subcontractors too?
Yes, in the sense that it applies to the same Phase 2 milestone across the DIB. It does not remove the flow-down requirement itself — primes can still require subcontractors handling CUI to demonstrate CMMC compliance as a condition of subcontract award, and many are continuing to ask.
← CMMC for Small Defense Contractors | NY DFS Cybersecurity Regulation →