CMMC Reform Review 2026: Official Updates and What They Change
This page is a dated tracker — not an opinion article. It records only verified official actions, their effects, and their primary sources. No predictions about review outcomes.
Current status — verified
- Paused in Phase I
- Suspended — no replacement date announced
- Level 1 (Self), Level 2 (Self)
- Level 2 (C3PAO), Level 3 (DIBCAC)
- NIST SP 800-171 Revision 2 — still in force
- Still in force where contractually applicable
- Suspended — no waivers during review
- CMMC Reform Task Force (60-day review)
- Announced; official public link not yet confirmed by DCR as of
- ~ (60-day review window)
Program implementation timeline
32 CFR Part 170 took effect
DFARS acquisition rule took effect; Phase I began
DoW suspended Phase II transition and all later milestones; Phase I self-assessments remained in force
Next milestone: no replacement date announced. CMMC Reform Task Force conducting 60-day review.
Official update log — reverse chronological
CMMC FAQ v6 published by DoW CIO reflecting suspension.
FAQ answers updated to reflect suspension status, permitted designations, and waiver procedures.
Underlying regulatory framework.
Implementing Procedures 26-P-1023 issued alongside the release; specifies solicitation amendment, contract modification, and waiver-suspension mechanics.
New Level 2 (C3PAO) designations are prohibited during the review. Existing contracts with C3PAO/Level 3 are directed to be modified before the next option exercise or next scheduled administrative modification.
Codified text of 32 CFR Part 170, DFARS 252.204-7012, DFARS 252.204-7021, or 32 CFR 252.204-7025.
Department of War issues release suspending Phase II transition and all later milestones; CMMC Reform Task Force announced.
November 10, 2026 Phase II start date, new Level 2 (C3PAO) and Level 3 (DIBCAC) procurement designations, and the CMMC waiver process are all suspended. Active solicitations with those requirements are directed to be amended; existing contracts are to be modified.
Phase I Level 1 (Self) and Level 2 (Self) requirements, NIST SP 800-171 Rev. 2 baseline, annual affirmations, SPRS obligations, DFARS 252.204-7012 safeguarding duties, and select government-led assessments.
What the review could change — explicitly labeled unknown
This tracker will be updated with the date, source URL, and exact change when an official announcement is made. Check the “Next check date” field in the status card above.
Version history
- — Page created. Initial entries: DoW July 13 release, Implementing Procedures 26-P-1023, CMMC FAQ v6.