CMMC Phase 2 Is Paused — But the Requirements That Reach Your Front Desk Never Moved

When a headline says a compliance deadline was “suspended,” the dangerous reaction is relief. For most of the defense industrial base, the July 13 decision on CMMC is genuinely good news — a costly, capacity-starved requirement got pushed back. But if a contractor reads “Phase 2 paused” as “we can ease off,” they will walk straight into the requirements that did not pause.

On July 13, 2026, the Department of War (DoW) announced the immediate suspension of CMMC Phase 2 — the phase that would have made an independent third-party assessment a condition of award — and launched a 60-day “CMMC Reform Task Force” to review the program, with recommendations expected around mid-September 2026. The memo, issued by the department's Chief Information Officer, framed the pause around a blunt problem: the combination of prohibitive compliance costs, a severe shortage of third-party assessor capacity, and complex timelines was pushing small businesses and new entrants out of defense work.

What was actually suspended

Phase 2 was the point at which CMMC got teeth from an outside party. For most contracts involving Controlled Unclassified Information (CUI), it would have required a Level 2 certification assessment performed by an accredited third party — a Certified Third-Party Assessment Organization, or C3PAO — as a condition of award, replacing the self-attestation contractors use today. That transition, scheduled to begin appearing in solicitations on November 10, 2026, is what the DoW suspended.

Follow-up guidance after the memo indicated that active solicitations and contracts that already contain a Level 2 or Level 3 assessment requirement are to be amended to remove it during the review. If that describes one of your contracts, the status of that clause is a conversation with your contracting officer — not something any software vendor can change or interpret for you.

What remains fully in force today

This is the part worth reading twice, because it is where the misread costs money. The suspension touched the assessment mechanism. It left the underlying obligations standing:

Both the program rule at 32 CFR Part 170 and the acquisition rule that lets a contracting officer require a CMMC status remain on the books; neither can be rewritten without going back through rulemaking. And a Level 2 self-assessment still requires you to meet the same NIST SP 800-171 controls a C3PAO would have checked — you are simply attesting to them yourself, with an official signing the affirmation, for now.

The smart way to use the pause

The reprieve is real, and it is worth something: the C3PAO queue was always going to be the binding constraint, and now there is breathing room. But the contractors who come out ahead will treat the review window as time to close the same gaps on their own terms, not as permission to stop. When third-party assessment returns in some form — and the program rule staying in force is a strong signal that it will — readiness will still be measured against NIST SP 800-171. The work does not change; only the audience does.

There is also a quieter point in the DoW's own reasoning. The task force was told to favor “scalable, realistic security measures” over “prohibitive, third-party compliance models.” Whatever emerges, it will still reward the contractor who can show controlled access and clean screening with evidence, cheaply and continuously — not the one who bought a certificate and stopped.

Where SecurePoint fits: our visitor platform generates the timestamped access logs, escort records, and audit trail that support the NIST 800-171 Physical Protection and Audit & Accountability control families, and screens visitors and vendors against restricted-party lists with a recorded disposition. That is assessment evidence — for a self-assessment today or a C3PAO later. It is not, and we never claim it to be, a CMMC certification.