CMMC Phase 2 is suspended. Here is what defense contractors still have to do

On 13 July 2026, the Department of War suspended CMMC Phase 2. The third-party audit that was due to become a condition of contract award on 10 November 2026 is on hold. If you run compliance for a defense contractor, the temptation is to breathe out and pause the program. That would be a mistake.

The audit is paused. The standard is not. Every control you were building towards is still contractually required under the clauses already in your contracts, and the one part of the framework that historically fails most assessments, identity and authentication, is exactly where the deadline pressure has now been removed and the technical work still must happen.

Here is what actually changed on 13 July, what did not change, and where the real risk sits now.

What the Department of War changed on 13 July 2026

Two memoranda, signed by the Department of War Chief Information Officer and the Under Secretary for Acquisition and Sustainment, suspended Phase 2 of the Cybersecurity Maturity Model Certification program, along with every pending and future milestone. In plain terms:

• Phase 2 is paused. The requirement for a Certified Third-Party Assessment Organization (C3PAO) to certify you at Level 2 before you can win a Controlled Unclassified Information (CUI) contract does not take effect on 10 November 2026 as planned.
• Phases 3 and 4 are frozen too. The suspension reaches every future implementation milestone, not just the November date.
• Active contracts are being amended. Contracting officers were told to strip Level 2 (C3PAO) and Level 3 requirements out of live solicitations and existing contracts.
• A reform task force is reviewing the whole program. The CMMC Reform Task Force ran a public request for information that closed on 14 August 2026, and is expected to deliver recommendations to the Department CIO around 13 September, with a public version to follow.

The stated reason was cost. The Department’s own figures, drawing on Small Business Administration data, put the annual burden of the full program on small and mid-size businesses at more than seven billion dollars, against an assessor shortage that leaves roughly one hundred authorized C3PAOs to certify a base of more than one hundred thousand companies. The Under Secretary for Acquisition and Sustainment was blunt about intent: the Department is not relaxing the standard, it is removing the bureaucracy of the third-party assessment.

What did not change, and why it matters more now

This is a policy pause, delivered by memo. It is not a repeal, and it did not touch the underlying law. Three things remain fully in force, and if you only remember one section of this article, make it this one.

Phase 1 self-assessment is still mandatory. Level 1 self-assessments for Federal Contract Information and Level 2 self-assessments for CUI, with the associated attestations, took effect on 10 November 2025 and remain in place. You still upload your score to the Supplier Performance Risk System.

DFARS 252.204-7012 still binds you. The clause requiring you to safeguard covered defense information and to implement NIST Special Publication 800-171 was never part of the suspension. It sits in contracts you have already signed.

The False Claims Act still applies to your attestation. With the auditor removed, your signature is the only thing standing behind your compliance claim. An inaccurate self-assessment uploaded to the Supplier Performance Risk System carries real legal exposure. Removing the third party did not remove the liability. It concentrated it on you.

There is a second reason not to relax. The proposed Federal Acquisition Regulation rule on CUI, updated on 23 June 2026, would extend 800-171-derived safeguarding and incident-reporting requirements to all CUI across the entire federal contracting base, not just Department of War work. Any narrowing of CMMC for defense purposes may be offset by a broader obligation arriving through a different door. Build to the standard, and you are covered either way.

The mistake to avoid: pausing the program instead of the audit

The common failure over the coming months will be quiet and expensive. A contractor halts its “CMMC program” and, because internally the CMMC project and the 800-171 remediation project were the same budget line with one name, inadvertently halts its control implementation as well. Six months later a prime demands 800-171 conformance as a condition of a subcontract, or a new solicitation lands with Level 2 self-assessment already required, and the remediation that was parked has to restart cold.

Primes are not waiting for the Department. Several are already writing 800-171 conformance into subcontracts regardless of the federal timeline, because their own contracts still require them to flow the obligation down. The gap assessment documenting your shortfalls did not evaporate when Phase 2 was suspended. It is still an accurate description of the work in front of you.

Separate the two budget lines. Pausing a C3PAO booking that no customer is currently demanding is reasonable. Pausing the identity and authentication controls that 800-171 requires, and that a prime can ask for tomorrow, is not.

Where MyID fits: the identity and authentication controls

Of the fourteen control families in NIST SP 800-171, the Identification and Authentication family (3.5) is consistently among the hardest to satisfy and among the most cited in failed assessments. It is also the family Intercede has built its business around for more than twenty years. MyID^® covers the identity and authentication requirements that sit at the centre of a Level 2 self-assessment, across the whole spectrum of your workforce.

Authentication maturity is a progression. Most defense contractors need several kinds of authentication at once: passwordless multi-factor for the general workforce, high-assurance PKI smart cards for privileged and classified-adjacent roles, and clean password hygiene for the systems that are not there yet. MyID is one suite that spans all of it.

Two attributes matter especially for defense work. MyID is air-gap capable, which means the same identity and authentication controls apply on classified and disconnected networks where cloud-only tools cannot go. And it is proven at scale across major defense programs and federal agencies, so the deployment risk on a Level 2 remediation is low.

What to do before the task force reports

The task force recommendations are due around mid-September, with a public version expected later that month. The plausible outcomes range from Phase 2 resuming on new dates, to third-party assessment being narrowed to higher-risk data, to a shift toward government-led or continuous-monitoring models. Every scenario on the table keeps NIST SP 800-171 as the substantive standard. The mechanism is uncertain. The controls are not.

So, the no-regret position is straightforward. Keep your Phase 1 self-assessment current and your Supplier Performance Risk System score honest. Keep implementing the 110 controls and give the identity and authentication family the attention it needs rather than the attention the old November deadline forced. Treat any prime’s 800-171 demand as live, because it is. When the audit requirement returns, in whatever form, the contractors who kept building will compete for work while the ones who paused are still catching up.

Intercede has spent more than twenty years issuing and managing high-assurance credentials for governments, defense contractors and financial institutions across more than twenty countries. If you want to see exactly which 800-171 identity and authentication requirements MyID covers against your own gap assessment, book a demo today.