CMMC Deadlines 2026: Status Tracker, Phase 2 Pause & What Still Applies

What changed: CMMC dates and developments

Dates below are event or document dates, not claims that this page was updated on those dates. Reporting and official actions are labeled separately.

We record verified changes in this log and identify the source and date for each entry.

Task Force report status: We did not locate an official public report or a confirmed public-release date in the official sources checked on September 25. That does not establish whether a report was delivered internally. See our CMMC reform review coverage for the developing analysis.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC and defense industrial base compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis or provider-category recommendations. We are not affiliated with the Department of War/Department of Defense, DCMA DIBCAC, The Cyber AB, or any U.S. government agency. This article is educational, not legal, contracting, or compliance advice. For interpretation of your procurement, consult your contracting officer and qualified counsel.

Current CMMC implementation status

Source: July 13 implementation procedures, attachment pages 1–2. For existing contracts, the procedures direct removal of affected requirements before the next option exercise or during the next scheduled administrative modification. Active solicitation amendments are to be issued as soon as practicable.

Already assessed? See our JSVA status and expiration guide for qualifying legacy assessments, our voluntary assessment decision guide for assessment timing, and our conditional-status closeout guide for the separate 180-day clock.

The 30-second answer: which 2026 date is yours?

Need a starting checklist? Get our free 32-point CMMC Level 2 readiness checklist by email. It helps organize a readiness discussion; it does not determine your binding contractual deadline.

Working on a COTS-only procurement? Check the COTS exclusion and current waiver policy. The exclusion is procurement-specific, not a blanket exemption for a company.

What is the real CMMC deadline in 2026?

There is no universal date in 2026 when every defense contractor must hold a CMMC certificate. The original Phase 2 transition was suspended on July 13. Your applicable obligations depend on the current written solicitation, contract, option, or subcontract requirement.

A deadline article—including this one—cannot tell you your exact contractual deadline without reviewing that requirement. A program milestone describes rollout policy; an award, option, status expiry, affirmation, or closeout requirement can create a different deadline for your organization. The pause is not permission to stop safeguarding covered information.

Rule-stated date vs. your contract-triggered deadline

Why you keep seeing “October 31, 2026”

You will still find pages describing October 31 or November 10, 2026 as a universal deadline. October 31 is not the original Phase 2 transition date. November 10, 2026 was the original date derived from the phase intervals in 32 CFR § 170.3(e) and the November 10, 2025 DFARS effective date. That transition was suspended. Neither date should replace a review of your current written requirement.

The date that actually matters: your award, option, or flow-down date

Two DFARS provisions explain the standing contract mechanism. Read them alongside current suspension guidance and the actual version incorporated in your procurement:

• DFARS 252.204-7025 is a solicitation provision. It identifies the required level and requires the relevant current SPRS status and affirmation for each covered contractor information system before award. Its printed list of assessment types does not override the suspension instructions for new designations.
• DFARS 252.204-7021 is the contract clause. It addresses maintaining the required status, annual affirmations, applicable subcontract flow-down, and the CMMC UID information supplied for covered systems.

An option or subcontract does not necessarily contain a new -7025 provision. For those events, read the incorporated clause, modification, or subcontract requirement. Ask which clause version and any applicable acquisition deviation govern the instrument; an older citation number alone does not tell you whether the requirement applies.

The original CMMC implementation timeline: Phase 1, 2, 3, and 4

This is the original rollout schedule, not a list of currently active future deadlines. Phase 1 self-assessment requirements remain active; the July 13 direction suspended the Phase 2 transition and later pending milestones.

Sources: 32 CFR § 170.3(e), DFARS final rule effective date, and July 13 CIO memorandum. The original end of Phase 1's first calendar year does not terminate applicable self-assessment or safeguarding obligations.

The two rules behind the original timeline

CMMC became real in two steps:

1. The CMMC Program Rule was published October 15, 2024 and became effective December 16, 2024. It established the program's assessment, scoring, status, POA&M, and affirmation structure.
2. The DFARS CMMC Acquisition Rule, Case 2019-D041 was published September 10, 2025 and became effective November 10, 2025. It established the acquisition mechanism using the revised -7021 clause and new -7025 provision.

These historical effective dates do not cancel the subsequent suspension direction. For the current implementation position, use the status table above.

Phase 1: current active phase

Phase 1 remains active where applicable. Maintain the required self-assessment status, SPRS information, annual affirmation, and safeguarding duties. Obtain the written amendment or modification when existing paperwork contains a third-party or Level 3 requirement affected by the suspension.

CMMC assessment statistics: latest figures verified for this update

The newest quantitative primary source we could substantiate for this update is The Cyber AB's August 14, 2026 RFI response. These are figures reported on that date, not a live September 25 census.

How to use these figures. Keep the qualifiers “over” and “approximately.” The source is The Cyber AB's own account of the ecosystem; we did not independently recount active Marketplace listings or reconcile certifications across unique companies and information systems. These numbers do not measure appointment availability, readiness, or how many organizations face an operative certification deadline.

Why the old readiness percentage is no longer here. Dividing a rounded certification figure by a broad historical population estimate does not establish the share of the defense industrial base that is ready. The units, populations, and assessment types need to match. We also removed the claim that the pipeline cannot absorb a late-2026 surge: the figures shown do not establish that forecast, and the November transition is suspended.

Next published event to watch: The Cyber AB lists its September Town Hall for September 29, 2026 at 6:00 p.m. Eastern. That is a scheduled event, not a source of completed September results. Check the official event listing.

For citations, use the permanent statistics section and retain both the source date and the qualifier attached to each figure.

Which CMMC level and assessment type is your deadline for?

Your required CMMC level depends on the information, assessment scope, mission requirements, and current written procurement requirement. The table describes the standing program structure; it does not mean every listed assessment type may be newly designated during the suspension.

Sources: 32 CFR § 170.5, § 170.15, § 170.16, § 170.17, and § 170.18.

Read your solicitation: the contract-wording decoder

Level 1 is not “CMMC-lite” for CUI

Level 1 exists for FCI-only situations. It’s an annual self-assessment against the 15 safeguarding requirements in FAR 52.204-21, and — this trips people up — it allows no plans of action and milestones. Every Level 1 requirement has to be met. If you touch CUI, Level 1 is not your shortcut; you’re in Level 2 territory. For a full breakdown, see our guide on CMMC Level 1 vs Level 2.

Level 2 is the common CUI path — and it’s Revision 2, not Revision 3

CMMC Level 2 continues to use NIST SP 800-171 Revision 2: 110 requirements across 14 families. That basis is in the current program rule, including 32 CFR § 170.24, and is reaffirmed in the July 13 implementation procedures. Publication of a newer NIST revision does not by itself change CMMC's incorporated assessment baseline. Build and assess the relevant SSP and evidence against the version required for your actual obligation; do not confuse a roadmap to newer standards with a change already made to CMMC.

Level 2 Self vs Level 2 C3PAO is a contract requirement — not your choice

Self-assessment and C3PAO assessment are different status paths, not interchangeable purchases. During the suspension, the Department's procedures permit new Level 1 (Self) and Level 2 (Self) designations. When existing paperwork still specifies a C3PAO, obtain the relevant amendment or modification rather than silently substituting a self-assessment. Self-assessment results go into SPRS; C3PAO results are submitted to eMASS and transmitted to SPRS under § 170.17. See RPO vs C3PAO: which do you need?.

Level 3 is not the normal 2026 path for a small contractor

The standing Level 3 pathway requires a Final Level 2 (C3PAO) status for the same assessment scope and a DIBCAC assessment under 32 CFR § 170.18. The July 13 instructions suspend new Level 3 procurement designations. A company's size alone does not determine its level; obtain written clarification if an active document still specifies Level 3.

The wrong scope makes every quote, timeline, and assessment plan wrong. For scope and applicability background, see who needs CMMC certification and our CMMC levels breakdown.

What has to be in SPRS before you can win the award?

Where the applicable solicitation requires CMMC, eligibility depends on the required current status and a current affirmation in SPRS for each relevant contractor information system—not merely a certificate PDF. Read the actual provision and any current amendment. Source: DFARS 252.204-7025(b) and (d).

A CMMC status is not just a certificate

Under the standing acquisition mechanism, required current status and affirmation are checked for applicable awards and options. During the suspension, read those requirements together with the current written amendment or modification. See DFARS Subpart 204.75 and our SPRS guide.

Annual affirmations don't end at the assessment

All applicable CMMC levels require affirmation—not just Levels 2 and 3. Level 1 also requires a new self-assessment annually. Level 2 and Level 3 generally have three-year assessment cycles, but annual affirmation and continuous compliance remain necessary. A Conditional status has its own shorter closeout clock. The Affirming Official is the senior-level representative responsible for the affirmation; a certificate's date alone is not proof the status remains current. Sources: § 170.15, § 170.16, § 170.17, § 170.18, and § 170.22.

The affirmation has teeth: False Claims Act risk

A knowingly false cybersecurity representation can create False Claims Act exposure when the legal elements are met. DOJ's Civil Cyber-Fraud Initiative addresses knowing misrepresentations about cybersecurity practices and related obligations. The practical instruction is simple: do not affirm compliance your evidence does not support. A missed control or later incident does not, by itself, establish fraud.

Can you win a 2026 award on a conditional status or a POA&M?

A valid Conditional status can satisfy the CMMC-status portion of eligibility where the applicable requirement permits it; it does not guarantee an award. Level 1 has no conditional/POA&M pathway. Level 2 requires at least 88 of 110 weighted points, only eligible gaps, a current affirmation, and timely closeout. A raw count of 88 implemented requirements is not the test.

This table explains the standing program, not permission to add a currently suspended C3PAO or Level 3 procurement requirement. Source: 32 CFR § 170.21.

Level 2 begins with a maximum of 110 points and deducts the assigned value for each NOT MET requirement; scores can be negative. The methodology includes limited scoring adjustments for multifactor authentication (IA.L2-3.5.3) and CUI encryption (SC.L2-3.13.11). A score from 88 through 109 is not sufficient on its own for Conditional status: every remaining gap must also be eligible. Final status requires all applicable requirements to be satisfied under the rule's assessment findings and scoring provisions. Source: 32 CFR § 170.24.

What you cannot put on a POA&M

Level 2 POA&Ms generally may contain only eligible 1-point requirements. The narrow exception is SC.L2-3.13.11, when encryption is in use but is not FIPS-validated, producing the permitted 3-point deduction. Missing encryption entirely is not that exception.

| Cannot be deferred to a Level 2 POA&M |

| --- |

| Every 5-point requirement |

| Every 3-point requirement except the specific deployed-but-not-FIPS-validated encryption case above |

| AC.L2-3.1.20 — external connections |

| AC.L2-3.1.22 — control public information |

| CA.L2-3.12.4 — System Security Plan |

| PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5 — the specified physical-access requirements |

Source: 32 CFR § 170.21(a)(2). A qualifying score does not override these exclusions.

Level 3 is scored on its own scale

Do not apply the Level 2 88/110 threshold to Level 3. Level 3 uses its own selected 24 requirements. Conditional Level 3 requires the score ratio in § 170.21(a)(3), compliance with that paragraph's non-deferrable requirements, the applicable affirmation, and Final Level 2 (C3PAO) for the same scope under § 170.18. DCMA DIBCAC performs Level 3 POA&M closeout. These are standing status rules, not a new procurement designation during the pause.

A POA&M is not a rescue plan

If closeout is not successfully completed within 180 days of the Conditional CMMC Status Date, that status expires. The July suspension is not a stated extension of this separate status clock. Do not treat closeout as starting a fresh three-year assessment cycle. Track the actual status, affirmation, and closeout dates in SPRS and your assessment record. Sources: § 170.21(b), § 170.16, and § 170.17. See our conditional-status closeout guide.

Compare readiness vs. assessment-ready paths → A C3PAO assessment is not the same thing as implementation help. If your scope, SSP, evidence, and control ownership aren’t stable, you need readiness support first — not an assessor. See which provider category fits your situation.

Do subcontractors face the same 2026 CMMC deadline?

A subcontractor can have a different relevant date and scope from the prime. For applicable subcontracts involving FCI or CUI, read the current flow-down and required status—not merely the prime's company-wide certification level. Sources: DFARS 252.204-7021 and 32 CFR § 170.23.

What to ask your prime before you accept a deadline

Don't accept a vague “you'll need CMMC.” Ask for written answers:

1. Will this work require us to process, store, or transmit CUI, FCI, or neither, and on which systems?
2. Which clauses, level, assessment type, and versions apply to our subcontract?
3. Is the requested certification a government flow-down or your company's separate supplier policy?
4. What current amendment or modification addresses the July 13 suspension?
5. What event and date require our status, and what must be completed before information is shared?

The answers turn “someday” into a documented planning requirement.

For a full look at how requirements move through the supply chain, see our CMMC flow-down requirements guide.

What to do now, based on how much runway you have

Work backward from a documented requirement, not an assumed program restart. A close award date matters only after the applicable requirement and current status are clear.

A consultation about scope or scheduling can happen before readiness is complete. That is different from paying to begin a formal assessment before the necessary controls and evidence are ready. See our voluntary assessment decision guide for the separate timing decision.

Which provider category fits your 2026 CMMC deadline?

If you are still scoping, remediating, or building evidence, you need readiness or implementation help. If you have a reason to pursue certification and your scope, controls, SSP, and evidence are ready, you need an authorized or accredited C3PAO for the assessment. A GRC tool can organize work; it cannot, by itself, make the organization compliant.

Readiness help is not the same as assessment help

Do not assume a firm can implement your controls and then certify that same work. Verify the applicable independence and conflict-of-interest requirements, including 32 CFR § 170.9, before engaging a C3PAO. Separate contracts or engagements do not automatically resolve a prohibited conflict.

What to verify before you pay anyone

Confirm the provider's actual role, current authorization/accreditation where relevant, proposed scope, deliverables, information-handling arrangements, pricing, scheduling, and any referral compensation. For cloud or enclave decisions, evaluate the particular offering and your obligations rather than assume one product is universally required.

See CMMC provider categories, how to find an authorized C3PAO, and who to hire first. These guides are for choosing support; they do not replace the current written contract requirement.

Do COTS-only contracts and DoD waivers change your deadline?

COTS-only exclusions and waivers are different mechanisms. The COTS-only exclusion concerns the procurement's scope. The July 13 implementation procedures separately suspend waiver procedures during the review.

COTS-only procurement. The standing acquisition rule excludes contracts solely for commercially available off-the-shelf items. Do not extend that exclusion to a mixed procurement or to every contract held by a company that also sells COTS products. Check the actual solicitation and applicable definition. Source: DFARS Subpart 204.75.

Waivers during the review. 32 CFR § 170.5(d) contains limited waiver authority in the standing program rule. However, the July 13 implementation procedures, attachment page 2 state that no waivers are to be granted during the program review. Do not present a waiver as an available route around a current requirement during that period. The pause does not erase otherwise applicable safeguarding and incident-reporting duties, including those in DFARS 252.204-7012.

What we verified for this CMMC deadlines 2026 guide

Check date: September 25, 2026. We distinguish the standing program rule, current implementation directions, source-reported ecosystem statistics, and secondary reporting. The eCFR pages consulted displayed Title 32 as current through September 23, 2026. That is the source's currency date—not a claim that Part 170 changed on that date.

What we did not establish

We did not review your contract, determine your CUI scope, certify any organization, verify a named provider's current Marketplace status, or establish that the Task Force report was delivered internally. We did not substantiate newer numerical results from the August Town Hall slides or a September Town Hall that had not yet occurred. We did not calculate an industry readiness percentage or infer a national assessment backlog from the reported counts.

Report a source-backed correction through our corrections policy.

CMMC deadlines 2026: FAQ

Phase 2 is suspended, but applicable self-assessment, safeguarding, affirmation, and closeout obligations continue. These answers separate the paused rollout from obligations that may still apply to your organization.

What is the CMMC deadline in 2026?

There is no universal 2026 certification deadline for every defense contractor. The original November 10 Phase 2 transition is suspended, and no replacement date was found in the official sources checked for this update. Check the current written requirement and any separate status, affirmation, or closeout deadline.

Is the CMMC deadline October 31 or November 10, 2026?

October 31 was not the original Phase 2 transition date. November 10, 2026 was the original transition date derived from the rule's phase intervals and the DFARS effective date, but it was suspended on July 13. Neither date is a universal current contractor deadline.

Do existing contracts have to meet CMMC in 2026, or only new awards?

It depends on the current contract and applicable clauses. The July 13 instructions direct amendments to affected active solicitations and modifications to existing contracts containing C3PAO or Level 3 requirements. Obtain the actual written change; do not assume the announcement removed every obligation from an existing contract.

Do option periods after November 10, 2026 trigger CMMC?

An option can require verification of the status required by the applicable contract. November 10 is not currently an automatic Phase 2 trigger. Check the actual clause and any modification issued under the suspension instructions before the option is exercised.

Are COTS-only contracts excluded from CMMC?

Yes. Contracts solely for commercially available off-the-shelf (COTS) items are excluded under DFARS Subpart 204.75. Confirm your solicitation is truly COTS-only before relying on the exclusion.

Can DoD waive a CMMC requirement?

Not as a route available during the current review: the July 13 implementation procedures suspend waiver procedures and say no waivers are to be granted during the review. The standing limited authority in 32 CFR § 170.5(d) should not be presented without that current restriction.

Is CMMC mandatory in 2026?

Applicable Phase 1 self-assessment requirements remain active. The pause does not remove safeguarding duties or required SPRS status and affirmations from covered work. Phase 2's original November 10 transition is suspended; applicability still depends on the actual work and written requirement.

Do all Level 2 contractors need a C3PAO in 2026?

No. During the suspension, the Department's procedures permit new Level 1 (Self) and Level 2 (Self) procurement designations, not Level 2 (C3PAO) or Level 3 (DIBCAC). Existing documents should be addressed through the directed amendments/modifications. A voluntary assessment or separate commercial supplier condition is a different question.

Can DoD require a C3PAO assessment before November 10, 2026?

The Phase II transition has been suspended. New Level 2 (C3PAO) and Level 3 designations are suspended during the suspension period. Verify the current written solicitation amendment or contract modification before relying on any Level 2 (C3PAO) or Level 3 requirement.

Do subcontractors need CMMC?

Applicable FCI/CUI subcontract work can carry CMMC requirements. Verify the actual flow-down, system scope, assessment type, date, and any suspension-related update. Ask whether a prime's additional certification demand is a government flow-down or its own commercial supplier requirement.

Can a POA&M get us through award?

A qualifying Conditional Level 2 or Level 3 status can satisfy the CMMC-status condition where applicable, but a POA&M alone does not guarantee eligibility or award. Level 2 needs at least 88/110 weighted points, only eligible gaps—including the narrow deployed-but-not-FIPS-validated encryption exception—and closeout within 180 days of the Conditional CMMC Status Date. Level 3 has separate criteria. Level 1 does not permit POA&Ms.

Does CMMC use NIST SP 800-171 Rev. 2 or Rev. 3 in 2026?

The current rule maps Level 2 to Revision 2 (110 requirements, 14 control families). Don't treat Revision 3 as controlling unless and until DoD updates the rule.

What should we do first if we're behind?

Confirm whether you handle FCI, CUI, or both. Then check the solicitation or flow-down language, identify the required level and assessment type, verify your current SPRS status, and build a plan backward from your award or option date.

Can a C3PAO implement our controls and then assess us?

Do not assume that implementation and certification by the same firm are permissible. Check the applicable independence and conflict-of-interest rules; separate engagements alone are not a safe harbor. Formal Level 2 certification assessments must be performed by an authorized or accredited C3PAO.

Need help deciding what type of CMMC provider you need?

Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options. Please do not submit CUI, export-controlled files, drawings, source code, sensitive contract attachments, or controlled technical information through this form.

Related reading

• CMMC implementation phases explained
• The CMMC certification process, step by step
• CMMC Level 2 requirements (all 110)
• CMMC levels breakdown: Level 1, 2, and 3
• CMMC readiness checklist
• How SPRS scoring works
• CMMC certification cost and timeline
• CMMC flow-down requirements for subcontractors
• GCC High and CMMC
• Who needs CMMC certification

Last checked: September 25, 2026. Source dates and the limits of this review are listed in what we verified. This is an independent editorial resource, not a government notice or a determination of your contractual obligations. For corrections, see our corrections policy.