Current program status — paused in Phase I
CMMC is currently paused in Phase I. The Department suspended the Phase II transition and later implementation milestones on , while a CMMC Reform Task Force conducts a 60-day review. No replacement Phase II date has been announced.
During the suspension, requiring activities may designate only Level 1 (Self) or Level 2 (Self) in new CMMC requirements. They may not issue new Level 2 (C3PAO) or Level 3 (DIBCAC) designations. Active solicitations containing those requirements are to be amended; existing contracts are to be modified. Contractors should obtain the actual written amendment or modification — not treat a press release as a substitute for their controlling instrument.
Phase I — November 10, 2025, continuing through the suspension
Phase I began when DFARS 252.204-7021 took effect on . During Phase I, DoD solicitations may include CMMC requirements at any permitted level. The primary active requirements are:
- Level 1 (Self):Annual self-assessment against FAR 52.204-21(b)(1)’s 15 basic safeguarding requirements; result and senior-official affirmation posted in SPRS.
- Level 2 (Self): Self-assessment against all 110 NIST SP 800-171 Revision 2 requirements; score and annual affirmation posted in SPRS.
- DFARS 252.204-7012 safeguarding: Remains in force where included in a contract, regardless of the Phase II suspension.
- Select government-led assessments: May continue under current authorities; do not assume every government review is a CMMC Level 3 assessment.
The contract clause that operationalizes CMMC in DoD solicitations. Specifies the required Level, assessment type (self-assessment or C3PAO), and timing. Effective November 10, 2025.
View at Acquisition.govFormerly scheduled phases — now suspended
The following milestones were part of the DoD’s original implementation schedule. They are retained here as a historical record only. None are currently operative.
| Formerly scheduled phase | Original date | Current status |
|---|---|---|
| Phase I — Level 1 and Level 2 self-assessments | Active — in force | |
| Phase II — Level 2 (C3PAO) as permitted procurement designation | Formerly scheduled | Suspended July 13, 2026; no replacement date |
| Phase III — expansion of C3PAO requirement | Formerly scheduled | Suspended — pending milestone |
| Phase IV — full implementation | Formerly scheduled | Suspended — pending milestone |
What the suspension means for Level 2 contractors
During the suspension, new procurement designations for CUI contracts are limited to Level 2 (Self). The 110 NIST SP 800-171 Revision 2 requirements that underpin Level 2 remain the active baseline. Contractors handling CUI should continue self-assessment, SPRS posting, annual affirmation, and DFARS 252.204-7012 safeguarding work.
If a solicitation or existing contract already names Level 2 (C3PAO), contractors should look for a post-July 13 written amendment or modification. Do not assume the announcement alone rewrote the instrument. See the full Phase II suspension explainer.
What contractors should verify now
- Obtain and read your current solicitation, contract, subcontract, and any post-July 13 amendments or modifications.
- Identify the written CMMC designation: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or unspecified.
- If the instrument says C3PAO or Level 3 and predates July 13, 2026, ask the contracting officer or prime for the written change.
- Continue Level 1/2 self-assessment, SPRS, annual affirmation, POA&M, and DFARS 7012 duties that already apply.