CMMC 2.0 for Small Business: Phase 2 Is Suspended

CMMC certification is the Department of War's check that a defense contractor protects the information in its contracts: Level 1 covers 15 basic safeguards for Federal Contract Information (FCI), Level 2 covers the 110 NIST SP 800-171 requirements for Controlled Unclassified Information (CUI), and Level 3 adds selected NIST SP 800-172 requirements. The result is a CMMC status recorded in SPRS, and a certificate is issued only when a C3PAO or the government's DCMA DIBCAC performs the assessment. As of October 10, 2026, Phase 2 is still suspended, so new contracts can require only a Level 1 or Level 2 self-assessment, not a third-party certificate.

The 60 days set for the review that came with the suspension ran out in mid-September with no new guidance posted. The Department of War issued the suspension on July 13, 2026. As of October 10, 2026, its CMMC pages still describe the program as paused in Phase 1, and it hasn't announced when the review's results will be published.

What didn't pause: the cybersecurity obligations already written into your contracts. The suspension memo says so directly.

• Phase 2 is off the calendar. The November 10, 2026 start of third-party assessments is suspended.
• Self-assessments only. Contracting officers may designate CMMC Level 1 (Self) or Level 2 (Self), nothing higher.
• DFARS 252.204-7012 is untouched. NIST SP 800-171, 72-hour incident reporting, and subcontractor flowdown all still apply.
• Separately, DFARS 252.204-7019 was eliminated in February 2026, and the basic self-assessment SPRS upload went with it. DIBCAC Medium and High assessments are still posted to SPRS. Most contractors haven't caught this change.

Is CMMC Phase 2 suspended?

Yes. The Department's implementing memo states that "the upcoming November 2026 transition to Phase 2 of CMMC implementation is suspended," pending a 60-day review (Department of War CIO memorandum, July 2026).

Phase 2 was the point at which third-party C3PAO assessments would have become a condition of award on new contracts involving Controlled Unclassified Information. That start date was November 10, 2026.

The 60-day clock started July 13, so the review period ran to mid-September. The memo says further guidance will follow the review. As of October 10, 2026, none has been posted on the Department's CMMC pages, and treating any specific date as firm would be guessing.

Can you get CMMC certified right now?

Not by a third party. While Phase 2 is suspended, the only CMMC requirements a solicitation can carry are Level 1 (Self) and Level 2 (Self), so no new contract can require a C3PAO certificate, and existing contracts that carry one are supposed to lose it at the next option period or administrative modification. What you can hold today is a CMMC status in SPRS, backed by your own assessment and an affirmation signed by a company official. As of October 10, 2026, the Department of War's About CMMC page says the program is paused in Phase 1 and that the Department is enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments.

• Level 1 (Self). An annual self-assessment against the 15 requirements in FAR 52.204-21, entered in SPRS with an annual affirmation. No Plan of Action and Milestones is allowed, so every requirement has to be met.
• Level 2 (Self). A self-assessment every three years against the 110 requirements of NIST SP 800-171 Rev. 2, entered in SPRS and affirmed after each assessment and every year after that. A limited POA&M is allowed, and open items must be closed within 180 days. Miss an annual affirmation and the status lapses.
• DFARS 252.204-7012 still applies. The suspension changed how compliance is checked, not what your contracts require.

A note on the words. "CMMC certified" is shorthand. The rule records a CMMC status in SPRS, Conditional or Final, for a level and an assessment type, and the DoD's Level 2 Assessment Guide says a Certificate of CMMC Status is issued only when a C3PAO or DCMA DIBCAC performs the assessment. A company that self-assesses holds a status, not a certificate, and that status is what a contracting officer checks today.

Treat the self-assessment as if an assessor will review it. The affirmation is a company official's signature, and government-led assessments can still happen. If third-party certification returns, it will come from a C3PAO that is independent of whoever built your environment; the Cyber AB, the CMMC accreditation body, lists certified assessors in its marketplace. NetSys is not a C3PAO and certifies no one. We scope where FCI and CUI live, build and document the controls, and prepare the evidence a self-assessment and affirmation rest on.

What can a contracting officer still require during the suspension?

Self-assessments only. The memo is specific: "The allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self)."

That's the rule for anything being solicited or awarded right now. A program office can't make a C3PAO certification a condition of award while the suspension holds, and DIBCAC assessments are barred from new designations during the review (Latham & Watkins).

Check your existing contracts for the modification

This is the item most contractors are missing. The memo directs contracting officers to remove higher-level CMMC requirements from existing contracts "prior to the exercise of the next option period or during the next scheduled administrative modification."

So a contract carrying a Level 2 (C3PAO) designation is supposed to shed it, but only through a contract action someone has to take. Don't assume it happened.

Pull your active awards, check the CMMC designation on each, and raise it with your contracting officer if the next modification passes without the change. Chasing a requirement that should have been stripped is expensive. So is assuming it was stripped when it wasn't.

What still applies under DFARS?

The suspension memo confirms that "the cybersecurity requirements outlined in the clause at DFARS 252.204-7012 ... remain in effect." That clause requires covered contractors to implement NIST SP 800-171, report cyber incidents within 72 hours, and flow the clause down to subcontractors.

Two clause changes from February 1, 2026 matter more than most contractors realize, and they're separate from the CMMC suspension:

• DFARS 252.204-7019 was eliminated. The standalone basic self-assessment provision no longer exists, and the requirement to upload a basic self-assessment score to SPRS went with it (DoD Class Deviation 2026-O0025; Summit 7 analysis).
• DFARS 252.204-7020 was renumbered to 252.240-7997, keeping its title, NIST SP 800-171 DoD Assessment Requirements. Medium and High assessments run by DCMA DIBCAC still get posted to SPRS by those teams.
• DFARS 252.204-7021 survives. You still maintain your CMMC status for the life of the contract, with an annual affirmation from a company official.

Read those changes carefully before concluding your SPRS obligations vanished. They were restructured, not abolished, and 7012, the clause that carries the actual security requirements, never moved.

The suspension paused the verification layer. It didn't pause the security requirements. A contractor who reads the pause as permission to stop patching, drop MFA, or let documentation go stale is reading it the way that ends in a False Claims Act case.

What is CMMC 2.0, in plain terms?

CMMC is the Department of War's method for verifying that contractors follow the cybersecurity rules already in their contracts.

Three levels. Level 1 covers basic safeguarding of Federal Contract Information. Level 2 maps to the 110 controls in NIST SP 800-171. Level 3 applies to the most sensitive programs, adds a subset of NIST SP 800-172 requirements, and is assessed by DCMA DIBCAC only after a company holds a Final Level 2 (C3PAO) status.

Those requirements are what people mean by "CMMC requirements." The CMMC Model Overview groups them into 14 domains that mirror the NIST SP 800-171 families, from Access Control, Awareness and Training, and Audit and Accountability through Incident Response, Risk Assessment, and System and Information Integrity. If you want the standard behind Level 2 on its own, our NIST SP 800-171 explainer covers it.

For years contractors self-attested and nobody checked. Supply-chain breaches made it clear that a signature on a form isn't a working security program. CMMC was built to require proof.

How does a CMMC assessment work?

Every CMMC assessment, self or third party, follows the same path: define the scope, score each requirement, record the result in SPRS, and affirm it. The Department publishes the rulebook for each step on its CMMC resources page: scoping guides for Levels 1 and 2, the Level 1 Self-Assessment Guide, and the Level 2 Assessment Guide (version 2.13), the document assessors work from.

1. Scope. List every asset that stores, processes or transmits FCI or CUI, plus the security tools that protect those assets. The scoping guides define the asset categories.
2. Assess. Score each requirement MET, NOT MET or NOT APPLICABLE. The guide's three methods are to examine documents and settings, interview the people who run them, and test that the control works.
3. Record. Enter the result in SPRS. A Level 2 assessment that reaches at least 80 percent of the maximum score (88 of 110) with only POA&M-eligible items open earns a Conditional status, and those items must be closed within 180 days to reach Final.
4. Affirm. A senior company official affirms continued compliance after each assessment and every year after that.

When third-party assessments return, they will be run by a C3PAO, a Certified Third-Party Assessment Organization authorized by the Cyber AB and listed in its CMMC Marketplace. Final determinations on those assessments are made by Certified CMMC Assessors, and an assessor who helped your company prepare can't sit on your assessment team.

Which level does your business need, and what does it cost?

It comes down to the data you handle. Federal Contract Information is the routine, non-public data involved in delivering a product or service. CUI is the sensitive technical and program data.

For the detail behind each level, see our CMMC Level 1 checklist, which walks through the 15 FAR 52.204-21 requirements, and our guide to CMMC Level 2 requirements and the 110 NIST SP 800-171 controls.

Clause and regulation numbers are shifting under the FAR overhaul. Confirm the exact citation in your own contract rather than the one in any article, including this one.

Cost estimates are the Department's own, from Tables 9 and 10 of the CMMC Program final rule in the Federal Register (October 15, 2024). Each range spans its estimates for small and larger companies. They cover assessment only. The real number runs higher once you add the work of closing gaps: MFA, encryption, logging, access controls, written policies, and the staff time to keep them running. Our CMMC certification cost guide walks through what Level 1 and Level 2 cost in 2026.

It lands hardest on the smallest shops. By the rule's own count, 23,475 of the 31,338 companies receiving contracts with the DFARS 252.204-7012 clause, about 75 percent, are small entities, so a rule aimed at protecting national security data turns into a small-business budgeting exercise.

The consolation is real. The controls that satisfy CMMC are the same ones that stop the ransomware and email fraud already hitting companies your size.

Scoping is where small contractors get it wrong

In both directions. Over-scope and you buy controls no contract asked for. Under-scope and you're non-compliant on data you didn't know you held.

The cloud question catches the most people. If CUI lands in a commercial Microsoft 365 tenant, that tenant is in scope, and commercial cloud isn't automatically sufficient for CUI. That's why GCC High comes up in nearly every Level 2 conversation. Settle that before you budget anything else, because it changes the licensing, the migration, and the timeline.

When do you have to comply?

Nobody can give you a date, and anyone who does is guessing. The rollout is paused, and as of October 10, 2026 the Department hasn't published the review's results.

Don't let that feel comfortable. In our experience Level 2 readiness runs six to nine months. Assessor capacity will tighten the moment a new date is announced, and the firms that kept working through the pause clear the queue first.

Whatever the review recommends, NIST SP 800-171 is still the standard your contracts name today.

How a small contractor gets ready without panic

Start with scope: where CUI and Federal Contract Information live. Which systems, which mailboxes, which shared drives, which cloud tenants.

Then run a gap assessment against the 110 controls in NIST SP 800-171. From there you build a System Security Plan documenting how you meet each control, and a Plan of Action and Milestones for the gaps you haven't closed. Not every control is POA&M-eligible, so confirm which of your gaps have to be closed outright before you plan around a deferral.

Most of the remediation is ordinary security hygiene done thoroughly: enforced MFA, encryption at rest and in transit, centralized logging, tightened access, and an incident response process someone has rehearsed. Our rundown of the controls that stop attacks covers much of the same ground, our explainer on NIST, ISO 27001, and CIS shows how the frameworks connect, and our vendor risk management guide helps with the flowdown questions your primes are asking.

A CMMC readiness checklist for a small contractor:

1. Pull every active award and open solicitation, and note the CMMC level, the assessment type, and the DFARS clauses (7012 and 7021) each one carries.
2. Map where FCI and CUI enter, live and leave: mailboxes, file shares, cloud tenants, laptops, and the subcontractors you send it to.
3. Decide the boundary: an enclave, a separate GCC High tenant, or the whole company.
4. Score yourself against the Level 1 or Level 2 assessment guide, requirement by requirement, with the evidence for each finding.
5. Write or update the System Security Plan, and a POA&M for open items that are allowed to sit on one.
6. Close the gaps that block a passing score first: MFA, encryption, logging, access control and incident response.
7. Enter the result in SPRS, have a senior official affirm it, and put the annual affirmation on the calendar so the status doesn't lapse.
8. Keep the evidence current and dated: configuration exports, training records, access reviews and incident response tests.

Plenty of small contractors handle this with a fractional security leader or a CMMC compliance partner rather than a full-time hire, which keeps the cost proportional to the contract.

Frequently asked questions

What is CMMC?

CMMC, the Cybersecurity Maturity Model Certification, is the Department of War's program for verifying that defense contractors and subcontractors protect Federal Contract Information and Controlled Unclassified Information. It is codified in 32 CFR Part 170 and has three levels. Our CMMC glossary entry has the short definition.

What is CMMC compliance?

CMMC compliance means meeting every requirement for your level in the systems that handle FCI or CUI, holding a current CMMC status in SPRS, and keeping the annual affirmation up to date. During the suspension, that means a Level 1 (Self) or Level 2 (Self) status, on top of the NIST SP 800-171 obligations DFARS 252.204-7012 already puts in your contracts.

What is a CMMC Certified Professional?

A CMMC Certified Professional (CCP) is an individual credential, not a company certification. According to the Cyber AB, a CCP completes a course from an approved training provider and passes the CCP exam, administered through ISACA, and can then take part in Level 2 assessments without making final determinations. A Certified CMMC Assessor (CCA) is the next step up and can make those determinations on a C3PAO team.

Does CMMC apply to subcontractors?

Yes. If you handle Federal Contract Information or CUI, the requirement flows down to you from the prime. A prime can't legally pass CUI to a subcontractor that lacks the appropriate level, which is why primes are still asking suppliers about status during the suspension.

Can a contract still require a C3PAO assessment right now?

No. The suspension memo limits allowed designations to CMMC Level 1 (Self) or Level 2 (Self), and directs contracting officers to remove higher-level requirements from existing contracts at the next option exercise or administrative modification. Check your active awards rather than assuming the change was made.

Do I still have to post a self-assessment score to SPRS?

The basic self-assessment provision at DFARS 252.204-7019 was eliminated effective February 1, 2026, and the basic SPRS upload requirement went with it. Medium and High assessments run by DCMA DIBCAC are still posted to SPRS by those teams under the renumbered clause 252.240-7997. Check what your specific contracts require rather than assuming the obligation disappeared.

How long is a CMMC certification valid?

A Level 2 C3PAO certification runs three years, paired with an annual affirmation from a company official. A Level 2 (Self) status also lasts three years from its status date, with the same annual affirmation, and Level 1 self-assessments are annual. It's a program you maintain, not a project you finish.

Should we stop readiness work during the pause?

No. DFARS 252.204-7012 is untouched by the suspension, so the NIST SP 800-171 controls are still contractually required. Every gap you close now counts under the current rules, on insurance questionnaires, and under whatever verification regime follows.

We're not a defense contractor. Does any of this matter?

The certification doesn't. The controls do. NIST SP 800-171 is a solid baseline for any small business, and cyber insurers and larger customers increasingly ask for the same safeguards.

Sources and further reading

• Department of War CIO: Implementing the Suspension of CMMC Phase II: the suspension itself, the allowed Level 1 (Self) and Level 2 (Self) designations, the DFARS 252.204-7012 carve-out, and the direction to modify existing contracts. Accessed September 2026.
• Federal News Network: Pentagon suspends CMMC Phase 2 requirements: the July 13, 2026 announcement and the 60-day reform review. Accessed September 2026.
• Latham & Watkins: What Defense Contractors Should Know About DoD's Suspension of CMMC Phase 2: the review timeline and the DIBCAC designation pause. Accessed September 2026.
• DoD Class Deviation 2026-O0025: the February 1, 2026 DFARS changes themselves. Accessed September 2026.
• Summit 7: Why the FAR Overhaul Ended DFARS 7019 and 7020: the February 1, 2026 elimination of 252.204-7019, the renumbering of 7020 to 252.240-7997, and what changed for SPRS. Accessed September 2026.
• Federal Register: Cybersecurity Maturity Model Certification (CMMC) Program final rule, October 15, 2024: the cost estimates in Tables 9 and 10, the count of small entities, the 80 percent minimum score for a Conditional status, and the Final Level 2 (C3PAO) prerequisite for Level 3. Accessed October 2026.
• Department of War CIO: About CMMC, the program status page: Phase II suspended July 13, 2026, the program paused in Phase 1, and the Level 1 (Self) and Level 2 (Self) assessment, POA&M and affirmation rules. Checked October 10, 2026.
• DoD CMMC Assessment Guide, Level 2 (version 2.13): CMMC statuses, certificates, the MET, NOT MET and NOT APPLICABLE findings, and the examine, interview and test methods. Accessed October 2026.
• DoD CMMC Model Overview (version 2.13): the three levels and the 14 domains. Accessed October 2026.
• The Cyber AB: Assessing and Certification roles: C3PAO, CCP and CCA requirements and limits. Accessed October 2026.

Book a call with an engineer if you are not sure whether your contracts pull you into Level 1 or Level 2, or whether a stale Level 2 designation is still sitting on an active award, and we'll scope it with you before a new deadline forces the question.

By Joel Baum, who leads cybersecurity, threat research, and compliance strategy at The NetSys Group. NetSys has delivered managed IT, cybersecurity, and cloud services since 1998, on site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, Connecticut, and remote-first everywhere else.