CMMC Program Status: What Changed, and What Still Applies

The short answer is that CMMC certification is paused and NIST 800-171 compliance is not.

On 13 July 2026 the Department of War suspended CMMC Phase 2, including the third-party C3PAO assessment requirements due to begin on 10 November. On 3 September, Class Deviation 2026-O0025 Revision 3 turned that pause into an instruction: contracting officers are directed to remove CMMC assessment requirements from new and existing solicitations.

What did not change is the part with teeth. DFARS 252.204-7012 still applies. NIST SP 800-171 Revision 2 still applies. You are still required to self-assess and post a score to SPRS under 252.204-7019 and 7020, and you are still liable for that score being accurate. In June 2026, a contractor settled for roughly $500,000 over scores that DoD audits contradicted. The verification layer was removed. The obligation was not.

What remains in force

• DFARS 252.204-7012 — safeguarding covered defense information, and 72-hour cyber incident reporting.
• DFARS 252.204-7019 and 7020 — self-assessment and posting a score to SPRS.
• NIST SP 800-171 Revision 2 — all 110 requirements.
• Government-led assessments — DIBCAC retains the ability to assess directly.

What we are advising clients to do

• Do not abandon scoping work. It underpins the self-assessment regime as much as it did certification.
• Make sure your posted score is defensible. If it was submitted a year ago and your environment has changed, refresh it.
• Keep the evidence. A government-led assessment can still happen, and evidence assembled now is cheaper than evidence assembled under notice.
• Treat the pause as a planning window, not a cancellation. Reinstatement would not require new rulemaking.

What the class deviation actually instructs

A class deviation is not a repeal. It is an instruction to contracting officers that overrides the standing regulation for a defined class of contracts, and it can be withdrawn without new rulemaking. That distinction matters for planning: the underlying rule, 32 CFR Part 170, is still on the books.

Revision 3, issued 3 September 2026, directs contracting officers to remove or revise CMMC requirements in new solicitations and in existing contracts. In practice contractors are seeing three things: solicitations issued without the CMMC clause, modifications stripping it from live contracts, and supplier questionnaires quietly dropping the certification question while keeping the SPRS one.

That last detail is the tell. Primes are still asking for scores because scores are still required.

Why your SPRS score now matters more, not less

Before the suspension, a self-attested score sat upstream of a third-party assessment that would eventually test it. The C3PAO was, in effect, a verification backstop. Remove that layer and the self-attestation is no longer preliminary — it is the whole control.

The enforcement route does not disappear with it. DIBCAC retains the ability to conduct government-led assessments, and the False Claims Act applies to representations made to obtain a contract. The June 2026 settlement is the shape of that exposure: roughly $500,000 over scores that audits contradicted.

If your posted score is a year old and your environment has moved, that gap is now the risk. See how the score is calculated and refresh it.

The CMMC Reform Task Force

The suspension came with a review. A CMMC Reform Task Force was stood up with recommendations due to the DoD CIO in roughly sixty days, alongside a public Request for Information. The stated direction was toward “tangible cyber hygiene rather than third-party certifications and bureaucratic, high cost-imposing red tape,” with explicit concern for small and non-traditional businesses in the defense industrial base.

The report was due 11 September 2026. As of this page’s last review it had not been published. Three outcomes look plausible: reinstatement on a revised timeline, a tiered model where third-party assessment applies only above some contract threshold, or a permanent shift to self-attestation with sharper enforcement. Nothing currently in the public record picks between them.

What we are advising clients to do

The honest position is that the obligation did not change and the deadline pressure did. That argues for continuing, at a pace you choose rather than one a date imposes.

• Finish scoping. It underpins the self-assessment regime as much as it did certification, and it is the work that makes every later cost predictable. See finding CUI in your environment.
• Make the posted score defensible. Not optimistic — defensible, at objective level, with evidence behind each claim.
• Keep the evidence current. A government-led assessment can still happen, and evidence assembled calmly now is far cheaper than evidence assembled under notice.
• Do not dismantle what you have built. Reinstatement would not require new rulemaking, and rebuilding a lapsed programme costs more than maintaining one.

Change log

• 16 Sep 2026 — page created; reflects Class Deviation Revision 3 of 3 September. Task force report not yet public.

For the mechanics of the score that now carries the weight, see how SPRS scoring works and the control families behind it. If you want to know where you actually stand, that is a readiness assessment. For the structure that was suspended — the three levels, the rulemaking behind them and what each one requires — see the CMMC 2.0 overview.

For what this means in practice, see the CMMC certification process, the CMMC Level 2 requirements that still apply through self-assessment, and what DFARS 252.204-7012 requires.