Where CMMC stands in October 2026

The CMMC Program rule, 32 CFR Part 170, set up a four-phase rollout. Phase 1 began on November 10, 2025, and lets DoW solicitations require a Level 1 or Level 2 self-assessment posted in the Supplier Performance Risk System (SPRS). Phase 2 was due to start on November 10, 2026, and would have made Level 2 certification by an accredited third-party assessor (a C3PAO) a condition of award.

That second date will not happen as planned. On July 13, 2026 the DoW suspended the Phase 2 transition, put the later phases on hold and set up a CMMC Reform Task Force to review the program. While the suspension lasts:

  • Program offices may designate only CMMC Level 1 (Self) or Level 2 (Self). They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC).
  • Active solicitations that asked for third-party assessments are being amended. Existing contracts are being modified at the next option exercise or administrative modification.
  • The DoW says it will enforce NIST SP 800-171 Rev. 2 through self-assessments and "select Government-led assessments." It also says plainly that the suspension "does not eliminate the requirement for companies to protect federal data."

On September 3, 2026, Class Deviation 2026-O0025, Revision 3 told DoW contracting officers to remove or revise CMMC requirements in line with the July 13 suspension memo. It sits alongside the Revolutionary FAR Overhaul, which moves information-security clauses into a new FAR Part 40. As of this writing, DoW had not published a replacement schedule. Check the clause in each solicitation, and watch the DoW CIO's CMMC page and the Federal Register.

Why the pause does not lower the bar

Contractors are tempted to read "suspended" as "deferred." That is a mistake, for three reasons.

  1. The contract clause predates CMMC. DFARS 252.204-7012 has required NIST SP 800-171 since December 31, 2017. It also requires you to report cyber incidents within 72 hours and to use cloud services that meet the FedRAMP Moderate baseline or its equivalent for covered defense information.
  2. Your SPRS score is a claim. Under DFARS 252.204-7020, the government can run a Medium or High assessment of the score you posted. Under the CMMC rule, DIBCAC findings take precedence over your self-assessment.
  3. Enforcement continues. In September 2026 the Department of Justice announced that Honeywell Aerospace agreed to pay over $2 million to resolve False Claims Act allegations that it did not meet NIST SP 800-171 requirements on one network, as its contract and DFARS required. (The claims are allegations only; there was no determination of liability.) Cases like this rest on the 800-171 obligation, not on CMMC certification.

The practical result: a Level 2 self-assessment now carries more weight, not less. It is the main thing the government sees.

What Level 2 actually measures

Level 2 maps one-to-one to the 110 security requirements of NIST SP 800-171 Rev. 2, grouped into 14 families. Assessors test them against the 320 assessment objectives in NIST SP 800-171A. The rule's scoring methodology works as follows:

  • Each requirement is worth 1, 3 or 5 points. You start at 110 and subtract the value of every requirement that is NOT MET, so the score can go as low as −203.
  • A requirement is MET only when every objective under it is satisfied by evidence in final form. The rule names working papers, drafts and unapproved policies as unacceptable evidence.
  • Partial credit exists only in narrow cases, such as multi-factor authentication.

To reach Conditional Level 2 (Self) status, § 170.21 requires all of the following:

  • A score of at least 88 (80% of 110).
  • Only 1-point requirements on your Plan of Action and Milestones (POA&M). The one exception is CUI encryption that is in place but not FIPS-validated.
  • None of six named requirements on the POA&M. These include the System Security Plan and the physical-access requirements.
  • Every POA&M item closed within 180 days. If they are not closed, the conditional status expires.

Under § 170.16, a self-assessment lasts three years, and a senior official must affirm compliance every year.

Start with scope, not controls

Scope is the biggest cost lever. § 170.19 sorts assets into categories:

  • CUI assets: systems that process, store or transmit CUI.
  • Security protection assets: tools that protect the CUI environment, such as identity, logging and endpoint security.
  • Contractor risk-managed assets.
  • Specialized assets, such as operational technology, IoT and test equipment.
  • Out-of-scope assets.

Each category has its own documentation and assessment treatment.

A mid-sized contractor whose CUI is spread across the corporate file share, email and a few engineering laptops has to apply all 110 requirements to the whole company. One that confines CUI to a defined enclave applies them to that enclave and to the security tools around it. The enclave might be a separate tenant, a virtual desktop environment or a dedicated network segment. Before you buy anything, map where CUI actually enters the business: contracts, drawings, technical data and subcontractor exchanges. Then decide where it is allowed to live.

The 110 requirements, grouped by effort

The families are uneven. For a typical mid-sized contractor, effort falls into three tiers. Your own tiering will depend on what you already run.

Tier 1: Mostly policy, procedure and records

These requirements need careful writing and consistent records more than new technology:

  • Awareness and Training (3)
  • Personnel Security (2)
  • Risk Assessment (3)
  • Security Assessment (4), including the System Security Plan, which cannot be on a POA&M
  • Most of Physical Protection (6): escorts, visitor logs, managing physical access

The common failure here is not a missing policy. It is a policy that nobody follows, or one with no dated approval.

Tier 2: Configuration of tools you probably own

The following families can usually be met by configuring your existing identity platform, endpoint management and IT service tools properly:

  • Access Control (22)
  • Identification and Authentication (11)
  • Configuration Management (9)
  • System and Information Integrity (7)
  • Maintenance (6)
  • Media Protection (9)

The work is real: least privilege, MFA, session locks, baselines, patching and malware protection. But it is mostly configuration plus proof that the configuration holds over time.

Tier 3: Engineering and operations

Most of the effort, and most cost surprises, sit in three families:

  • Audit and Accountability (9): deciding what to log, keeping the logs, protecting them and showing that someone actually reviews them.
  • System and Communications Protection (16): boundary protection, separating public-facing systems, denying traffic by default, preventing split tunneling and using FIPS-validated cryptography for CUI. That last item is often the gap in cloud and mobile setups.
  • Incident Response (3): an incident-handling capability that has been tested and can meet the 72-hour reporting rule in DFARS 7012.

If you have limited time, close the 5-point and 3-point gaps in Tiers 2 and 3 first. They move the score most, and they cannot go on a POA&M.

What assessors expect to see

NIST SP 800-171A uses three assessment methods: examine (documents and configurations), interview (the people responsible) and test (showing the mechanism working). A credible Level 2 file usually includes:

  1. A System Security Plan that describes how each requirement is met in your environment, not boilerplate.
  2. An asset inventory and a network and data-flow diagram that match the scope you declared.
  3. Policies and procedures with owners, approval dates and review cycles.
  4. Configuration evidence: exported settings, group policies and conditional-access rules, tied to specific requirements.
  5. Operational records: access reviews, log-review tickets, vulnerability scans with remediation history, training completions, visitor logs and maintenance records.
  6. An incident-response test record and a contact path to DIBNet.
  7. A shared-responsibility matrix for every external service provider, plus evidence that cloud services handling CUI meet FedRAMP Moderate or its equivalent.
  8. A SPRS submission that matches all of the above, including the scope and CAGE codes.

A useful test: could someone who has never met your team rebuild your score from the file alone? If not, the score is not yet defensible.

Plan for Revision 3 without rebuilding twice

NIST published SP 800-171 Rev. 3 in 2024. Two pending actions point toward it:

  • The FAR Case 2026-001 proposed rule (June 23, 2026) would set CUI safeguarding requirements for contractors government-wide in FAR Part 40, and would reference Rev. 3.
  • A pending amendment to 32 CFR 170 would set a transition period from Rev. 2 to Rev. 3. It notes that Rev. 3 adds detail and organization-defined parameters.

Neither is final. Meet Rev. 2 now, record your evidence by control objective, and keep a crosswalk to Rev. 3 so that a change of baseline means updating a map, not starting over.

A practical sequence for the next two quarters

  • Confirm which contracts and subcontracts include DFARS 7012, 7019 or 7020, or any CMMC clause, and record the CMMC level each requires.
  • Trace where CUI enters, moves and is stored. Decide on an enclave or a whole-company scope.
  • Classify every asset using the categories in § 170.19, and update the inventory and diagrams.
  • Self-score against all 320 objectives in SP 800-171A, not just the 110 headline requirements.
  • Fix 5-point and 3-point gaps first, especially MFA, FIPS-validated encryption, logging and boundary protection.
  • Get written responsibility matrices and FedRAMP evidence from every external service provider in scope.
  • Test incident response against the 72-hour reporting rule.
  • Rebuild the SSP from the evidence, then post an accurate score to SPRS. Have a senior official affirm it knowing what it means.
  • Put an annual affirmation and a three-year reassessment on the calendar, and keep a Rev. 3 crosswalk up to date.

Getting help

If you need a second opinion on scope, a score you can defend, or a remediation plan ranked by points and cost, tell us what you are working toward. We will reply with a short scope and timeline, or tell you plainly if we are not the right fit.

This article is general information, not legal advice. CMMC policy is changing; confirm requirements against your contract clauses and current DoW guidance.

Sources

  1. DoW press release, 'Department of War Suspends CMMC Phase II Requirements' (13 Jul 2026)
  2. DoW CIO CMMC Resources & Documentation
  3. 32 CFR Part 170 (CMMC Program), eCFR
  4. 32 CFR 170.16, Level 2 self-assessment
  5. 32 CFR 170.19, scoping
  6. 32 CFR 170.21, POA&M requirements
  7. 32 CFR 170.24, scoring methodology
  8. DFARS 252.204-7012
  9. DFARS 252.204-7020
  10. NIST SP 800-171 Rev. 2
  11. NIST SP 800-171A
  12. NIST SP 800-171 Rev. 3
  13. FAR Case 2026-001 proposed rule, 91 FR 37550 (23 Jun 2026)
  14. DARS Class Deviation 2026-O0025, Revision 3 (Sept. 3, 2026)
  15. Revolutionary FAR Overhaul, Part 40
  16. Unified Agenda, RIN 0790-AM01 (32 CFR 170 Rev. 3 transition)
  17. DOJ press release, cyber False Claims Act settlement (1 Sep 2026)

Facts and regulatory status checked as of October 24, 2026. This article is general information, not legal advice.

All insights