DoD CIO program page, current as of October 24, 2026; suspension announced July 13, 2026
CMMC Phase II Stays Suspended: Self-Assessments Still Rule the Defense Supply Chain
With the November 10, 2026 Phase II start date now weeks away, the Department of Defense's own CMMC page confirms the program remains paused in Phase 1: the July 13 suspension of Phase II third-party certification requirements still stands, a CMMC Reform Task Force review is under way, and in the interim the Department enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. Phase 1 duties are unchanged: annual Level 1 self-assessment and affirmation for Federal Contract Information, and Level 2 self-assessment against the 110 requirements of NIST SP 800-171 Rev 2 for Controlled Unclassified Information, with results and affirmations entered in SPRS. The Department cited SBA data that compliance costs were pushing innovative companies out of the defense industrial base as a reason for the pause.
Executives
The certification deadline moved; the underlying obligations did not. Budget relief is real, but treating the suspension as a holiday risks contracts, because DFARS 252.204-7012 duties and SPRS affirmations continue and a false affirmation is a legal exposure, not a paperwork issue.
CIO / CISO
Keep the NIST SP 800-171 program running: current SSP, honest SPRS score, POA&M items closing inside 180 days, and annual affirmations calendared. Document the suspension decision trail so an auditor or customer can see you tracked the official program page, not headlines.
Engineers
The work is unchanged in substance: implement and evidence the 110 controls, from MFA and access control to audit logging and incident response. Use the breathing room to close the hard controls properly instead of papering them for an assessment date.
Everyone (non-IT)
If your employer sells to the Defense Department, you may hear that a big certification was postponed. The day-to-day rules for handling sensitive contract information stayed exactly the same, so handle that information with the same care as before.