Almost everything except the third-party certificate. Phase 2, which would have required C3PAO Level 2 certification from 10 November 2026, was suspended on 13 July 2026 pending a reform review. DFARS 252.204-7012, all 110 NIST SP 800-171 controls, SPRS scores, CMMC self-assessments and annual affirmations still apply, and so does False Claims Act exposure.
On 13 July 2026 the Department of War suspended Phase 2 of the CMMC rollout and set up a CMMC Reform Task Force for a 60-day review, citing cost and limited assessor capacity. During the suspension, programme managers may not put Level 2 (C3PAO) or Level 3 requirements into new solicitations. Level 1 and Level 2 self-assessment requirements can still appear.
As of 1 October 2026, no Task Force report has been published and no new Phase 2 date has been set. This page will be updated when that changes.
| Requirement | Status |
|---|---|
| C3PAO Level 2 / DIBCAC Level 3 in new solicitations | Suspended |
| DFARS 252.204-7012 and NIST SP 800-171 (110 controls) | In force |
| SPRS score and government assessment rights | In force |
| Level 1 / Level 2 self-assessments and annual affirmations | In force where required by contract |
| False Claims Act liability for misrepresentation | Unchanged |
If you handle CUI, the honest answer is that the controls were always required; only the proof changed. C3PAO assessments are still available, certificates remain valid for three years, and over 2,000 Level 2 certificates had been issued by August 2026. For a supplier competing for prime work, a certificate is a differentiator now rather than a mandate. For everyone, an accurate SPRS score and an affirmation you can defend matter more than the timing of the next phase.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →