CMMC Reform Review 2026: Official Updates and What They Change
This page is a dated tracker — not an opinion article. It records only verified official actions, their effects, and their primary sources. No predictions about review outcomes.
Current status — verified
- Paused in Phase I
- Suspended — no replacement date announced
- Level 1 (Self), Level 2 (Self)
- Level 2 (C3PAO), Level 3 (DIBCAC)
- NIST SP 800-171 Revision 2 — still in force
- Still in force where contractually applicable
- Suspended — no waivers during review
- CMMC Reform Task Force (60-day review)
- Public RFI notice: SAM.gov Notice ID 89ef9bfb0834473791e991c712698d94. The stated response deadline was August 14, 2026; check the official notice for amendments before relying on a submission window. RFI response history.
- September 2026 — passed. This was a review milestone, not a guaranteed public-release or restart date. Next review trigger: a new official CIO announcement, acquisition deviation, solicitation amendment, or contract modification.
Program implementation timeline
32 CFR Part 170 took effect
DFARS acquisition rule took effect; Phase I began
DoW suspended Phase II transition and all later milestones; Phase I self-assessments remained in force
Next implementation milestone: no replacement Phase II date announced in the official sources checked October 3, 2026. The July direction launched a 60-day review; the September milestone has passed and does not itself establish a restart or public report.
Official update log — reverse chronological
CMMC FAQ suspension update
The FAQ’s Document Revision History records version 2.4, dated July 13, 2026, updating the document to reflect suspension in Phase I.
Underlying regulatory framework.
Implementing Procedures 26-P-1023 issued alongside the release; specifies solicitation amendment, contract modification, and waiver-suspension mechanics.
New Level 2 (C3PAO) designations are prohibited during the review. Existing contracts with C3PAO/Level 3 are directed to be modified before the next option exercise or next scheduled administrative modification.
Codified text of 32 CFR Part 170 and the cited DFARS clause/provision numbers, including DFARS 252.204-7012, 252.204-7021 and 252.204-7025. The implementing procedures direct procurement amendments and modifications; they do not themselves rewrite every executed instrument.
Department of War issues release suspending Phase II transition and all later milestones; CMMC Reform Task Force announced.
November 10, 2026 Phase II start date, new Level 2 (C3PAO) and Level 3 (DIBCAC) procurement designations, and the CMMC waiver process are all suspended. Active solicitations with those requirements are directed to be amended; existing contracts are to be modified.
Phase I Level 1 (Self) and Level 2 (Self) requirements, NIST SP 800-171 Rev. 2 baseline, annual affirmations, SPRS obligations, DFARS 252.204-7012 safeguarding duties, and select government-led assessments.
What the review could change — explicitly labeled unknown
This tracker will be updated with the date, source URL, and exact change when an official announcement is made. Check the “Next check date” field in the status card above.
Version history
- — Page created. Initial entries: DoW July 13 release, Implementing Procedures 26-P-1023, CMMC FAQ suspension update dated July 13.