What the CMMC Phase II suspension changes
The CMMC Phase II suspension changes the assessment timetable, but it does not cancel contractors’ cybersecurity responsibilities.
On July 13, 2026, the Department of War announced the suspension of Phase II requirements. Those requirements were scheduled to take effect on November 10, 2026.
However, the Department made an important distinction. All Phase I self-assessment requirements remain in place. The Department also initiated a broader review of the CMMC program.
That announcement did not establish a new date for Phase II. Therefore, contractors should not assume the suspended requirements will automatically resume after a fixed period.
The difference matters. A pause in expanding third-party assessments is not a repeal of the obligation to protect covered information.
Which cybersecurity requirements remain in force?
Contractors must continue to meet the cybersecurity requirements that apply to their solicitations, contracts, and subcontractor obligations.
Under the current CMMC program, Level 1 addresses the basic safeguarding of Federal Contract Information (FCI). Level 2 addresses the protection of Controlled Unclassified Information (CUI) using the 110 security requirements in NIST SP 800-171 Revision 2.
During the suspension, the Department continues to rely on applicable self-assessments and selected government-led assessments.
Separate DFARS cybersecurity obligations may also apply. These include requirements associated with safeguarding covered defense information and reporting cyber incidents.
Consequently, organizations should review their actual contractual requirements rather than assume every obligation follows the same CMMC implementation schedule.
How to use the CMMC Phase II suspension
The CMMC Phase II suspension gives contractors additional time to strengthen security and assessment readiness. Organizations should use that time deliberately.
We recommend five practical steps:
- Review contract requirements. Identify applicable CMMC, DFARS, and cybersecurity clauses in solicitations, contracts, and flowdowns.
- Maintain current assessments. Keep self-assessments, SPRS reporting, System Security Plans (SSPs), and related documentation accurate where required.
- Define the security boundary. Identify the systems, users, applications, service providers, and external connections that handle regulated information.
- Remediate weaknesses. Prioritize vulnerabilities and control gaps that create genuine security risk.
- Preserve evidence. Maintain assessment records, remediation decisions, monitoring results, and other documentation supporting compliance.
These actions remain valuable regardless of how the Department revises the assessment rollout.
Security boundaries and evidence still matter
An integrated secure workspace can help organizations manage regulated information inside a defined environment.
For example, RegDOX CCE can support controlled document workflows, access management, and centralized audit evidence. A focused environment may also reduce unnecessary exposure of CUI across business systems.
However, deploying a secure workspace does not automatically satisfy every contractual requirement. Contractors remain responsible for applicable controls, policies, personnel, integrations, and systems outside the managed environment.
The objective is to simplify compliance responsibilities, not merely relocate them.
Do not mistake the CMMC Phase II suspension for cancellation
Contractors should avoid two opposing mistakes.
The first is declaring that CMMC has been canceled. The Department’s announcement does not support that conclusion.
The second is predicting with certainty when the government will restart or revise the suspended assessment requirements.
In addition, the September 3, 2026 DFARS Class Deviation 2026-O0025, Revision 3 provides acquisition guidance for implementing the suspension. Contractors should review applicable solicitation amendments and contract modifications with their contracting officers.
Our original CMMC checklist remains a useful planning tool. This update adds the necessary 2026 qualification: evaluate the checklist against the requirements currently in force.
Above all, make procurement and cybersecurity decisions based on security, scope, and evidence rather than an assumed Phase II date.
Also revisiting: CMMC Phase 2 Suspended (July 14, 2026).
Regulatory references:
- Department of War: CMMC Phase II Suspension (July 13, 2026)
- DoD CIO: About CMMC
- DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026)
Suspended Phase II Is Not Suspended Security
Updating our earlier RegDOX blog: CMMC Compliance Checklist (August 19, 2025).
For help applying these requirements to a controlled workspace, contact RegDOX Solutions.
About RegDOX
At RegDOX Solutions Inc., we help defense contractors and high-security organizations simplify compliance with ITAR, EAR, DFARS, and CMMC requirements. Our secure, cloud-based platforms combine end-to-end encryption, access controls, and audit-ready documentation to keep your data—and your contracts—safe.
Need help navigating evolving cybersecurity regulations?
Request a Compliance Demo
Or contact us directly at info@regdox.com
See the enclave in action.
The Compliant Computing Enclave keeps CUI inside one boundary, with your endpoints out of scope and the evidence trail already built.
Talk to an Expert →