Updated October 28, 2026: On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to begin November 10, 2026. Phase I self-assessment requirements remain in place.
The analysis below reflects the rollout plan as it stood when this article was published and is now historical. Verify current DoD guidance and confirm the CMMC level, assessment type, scope, and timing in your specific solicitation, contract, and applicable flow-down. The Phase II suspension does not itself waive other contract-specific cybersecurity requirements. Official references: DoD announcement; DFARS Subpart 204.75.
What contractors should verify now
On July 13, 2026, DoD announced the immediate suspension of Phase II requirements. Phase I self-assessment requirements remain. That program announcement does not by itself change the CMMC level, assessment type, or other cybersecurity terms written into a solicitation or contract.
Review the solicitation, contract, and applicable flow-down to identify the required level, assessment pathway, covered systems, and any status or affirmation deadlines. For unclear requirements, seek written clarification from the contracting officer or prime. Do not infer a Phase II certification deadline solely from the former November 10 date.
Assessment planning depends on the contract
Earlier capacity estimates and assumed Phase II timelines are not current planning facts after the suspension. If your contract or solicitation specifies an assessment, confirm the route, scope, and scheduling with the contracting authority and an authorized C3PAO.
Accuracy and existing obligations
Accurate SPRS scores and affirmations remain important where required. Continue safeguarding FCI and CUI and meeting applicable contract reporting, flow-down, and status requirements. The Phase II suspension does not itself waive those obligations. Consult counsel about legal questions involving government representations; this article is not legal advice.
Practical readiness steps
- Map where FCI or CUI resides, flows, and is stored; record system boundaries and assumptions; confirm scope against applicable contract terms. Scope drives which controls and evidence need attention.
- Where required, verify the SPRS score and affirmation for the in-scope system against current requirements; update them when control implementation or the assessed environment changes.
- Prioritize remediation against applicable requirements. Confirm with the contracting authority which items may be tracked in a POA&M and what status or assessment criteria apply; do not rely on former Phase II thresholds without current direction.
- Maintain evidence that reflects implemented controls. If a contract requires an assessment, prepare documentation for the currently applicable criteria and confirm assessment objectives and evidence expectations against current DoD guidance.
- Exercise the response and evidence process internally. A readiness review can surface gaps before any assessment required by a contract; it is not a C3PAO certification assessment.
DoD’s July 13, 2026 announcement suspended Phase II. The November 2027 and November 2028 Phase III/IV dates described in the original article should not be treated as current rollout dates without updated official guidance.
Daytol supports defense contractors with contract-specific CMMC readiness, including FCI/CUI scoping, control-gap review, documentation support, evidence organization, and practical remediation planning. Engagements clarify the applicable scope and do not issue CMMC status or substitute for a C3PAO assessment.