CMMC Requirements in 2026: What Defense Contractors Need to Know

What changed in July 2026?

On July 13, 2026, the Department announced the immediate suspension of CMMC Phase II requirements originally scheduled for November 10, 2026. Its current program notice says Phase I self-assessment requirements remain in place while the program is reviewed.

The suspension changes the rollout of mandatory third-party assessment requirements. It does not establish that contractors may stop safeguarding covered information, disregard applicable contractual requirements, or submit unsupported assessment results.

No replacement Phase II start date was confirmed in the official sources reviewed for this article. Treat older rollout charts as historical context and check current Department direction before committing to an assessment date.

Implementation phases and assessment levels are different

A phase describes the Department's procurement rollout. A level describes the safeguarding requirements and assessment status associated with an information system. Pausing Phase II does not erase Level 2 or turn CUI into FCI.

Level 1 addresses FCI and uses the basic safeguarding requirements identified in the CMMC rule. Level 2 addresses CUI and incorporates the 110 requirements in NIST SP 800-171 Revision 2. The program distinguishes Level 2 (Self) from Level 2 (C3PAO); they are different assessment paths for the same Level 2 requirement set.

What self-assessment requires when it applies

When Level 1 (Self) is required, the organization must assess annually, submit results in SPRS, and affirm compliance. All applicable Level 1 requirements must be MET; a CMMC Level 1 POA&M is not permitted.

When Level 2 (Self) is required, the organization assesses at least every three years, reports the results in SPRS, and submits an affirmation at assessment and annually thereafter. Conditional status is available only under the rule's specific scoring, POA&M eligibility, and closeout conditions. A remediation backlog alone does not establish an acceptable status.

Self-assessment is an evaluation of implementation and evidence. An affirmation is an authorized organizational official's confirmation of continuing compliance. Recording a score or checking a box does not replace either responsibility.

NIST SP 800-171 and your actual contract still matter

The Department's current CMMC explanation identifies NIST SP 800-171 Revision 2 as the interim enforcement baseline. CMMC's program rule also incorporates Revision 2. NIST published Revision 3 in May 2024, but publication of a newer standard does not by itself change the version incorporated in CMMC.

Separately, review the version of DFARS 252.204-7012 and any class deviations incorporated in your solicitation or contract. Safeguarding, incident reporting, assessment reporting, and CMMC status are related obligations with distinct triggers. Applicable FAR overhaul deviations may also affect the clause references you encounter.

Obtain written clarification from your contracting officer or prime when the stated assessment type conflicts with current direction. Confirm whether an amendment or contract modification applies; do not assume that a public announcement rewrote your signed agreement or your customer's separate supplier instructions.

Practical next steps

Build your plan from the evidence available today. Continuum can help turn that review into a scoped engagement and an accountable compliance roadmap.

• Inventory relevant awards, solicitations, cybersecurity clauses, and subcontract flowdowns.
• Confirm whether you handle FCI, CUI, or both; resolve unclear information designations with the customer.
• Map the systems, people, facilities, and providers involved in those information flows.
• Compare implementation and evidence to the applicable requirements and assessment method.
• Update the SSP and action plan, assign owners, and verify reporting and affirmation obligations.
• Monitor official program updates and adjust the plan when the governing requirements change.