The deadline is off. Your obligations are not.
On July 13, 2026, the Department of War suspended CMMC Phase 2. While the suspension holds, DoD contracting officers may require only Level 1 (Self) or Level 2 (Self) assessments, and solicitations that carried a third-party certification requirement are being amended to remove it. If someone is still selling you a November 10 deadline, they are selling you a date that stopped existing in July.
status: phase 2 suspended · reform task force reporting_
Four dates that changed the program.
The 48 CFR CMMC acquisition rule takes effect. Phase 1 self-assessment requirements begin appearing in DoD solicitations.
The Department of War suspends CMMC Phase 2 and launches a 60-day reform task force. Phases 3 and 4 are suspended with it. No waivers are issued during the review.
The task force's request for information closes. It asked industry about readiness, cost drivers, and which controls are actually implemented.
The task force delivers its findings and recommendations to the DoD CIO. A public report is expected late September or early October.
Suspended is not cancelled. The program is under review, the review has not reported, and officials have declined to rule out any outcome. We will update this page the day the report lands.
The certificate paused. The rules did not.
The suspension paused the certification, not the rules underneath it. DFARS 252.204-7012, NIST SP 800-171, your SPRS score, your annual affirmation, and your prime's flow-down all still apply.
DFARS 252.204-7012
The clause in your contract has not changed. If you handle CUI you still owe adequate security, incident reporting inside 72 hours, and media preservation.
NIST SP 800-171 and your SPRS score
Still 110 controls, still self-assessed, still submitted to SPRS, still the number a contracting officer looks at before award.
Your annual affirmation
Someone senior at your company still signs that the score is accurate. That signature is the exposure the next section is about.
Your prime's flow-down
Primes set their own supply-chain terms and most have kept them. A flow-down letter binds you by contract whatever the government does with the program.
Nobody is checking your score. That is the risk.
With no third-party assessment standing between your SPRS score and your contract, that score is a self-attestation the government can sue you over. In June 2026, an Alabama defense contractor paid $507,144 to settle False Claims Act allegations that it reported a perfect SPRS score of 110 while the Defense Contract Management Agency scored it at -170.
Read the mechanism, not just the number. The exposure did not come from a missing certificate. It came from a number the company put in SPRS and affirmed, and a later assessment that did not match it. Suspending third-party assessment removes the check that would have caught an inflated score early. It does not remove the affirmation, and it does not remove the False Claims Act.
The practical version: an honest low score with a plan behind it is a manageable business problem. A flattering score you cannot defend is a legal one, and it stays a legal one for years after you submit it.
Source: United States Department of Justice, Office of Public Affairs, June 2026 (LOGZONE Inc., Huntsville, Alabama; Department of the Navy contracts; conduct from May 2021 to March 2025; $253,572 of the settlement is restitution). The settlement includes no admission of liability, and it was a False Claims Act matter, not a CMMC enforcement action.
The phases as written, and on hold.
| Phase | Date in the rule | Status | What it said |
|---|---|---|---|
| Phase 1 | November 10, 2025 | In force | The acquisition rule takes effect. Self-assessment requirements appear in DoD solicitations. This phase was never suspended and is the regime in force today. |
| Phase 2 | November 10, 2026 | Suspended | Third-party CMMC Level 2 certification as a condition of award on new CUI solicitations. Suspended July 13, 2026. |
| Phase 3 | November 10, 2027 | Suspended | Certification requirements extend to option exercises on existing contracts, and Level 3 requirements begin. Suspended. |
| Phase 4 | November 10, 2028 | Suspended | Full implementation across applicable DoD solicitations and contracts. Suspended. |
Sources: the 48 CFR CMMC acquisition rule (effective November 10, 2025), DFARS 252.204-7021, and the Department of War CIO implementing memo of July 13, 2026.
The math that broke the model.
About 80,000 contractors need CMMC Level 2; as of March 2026, only 1,074 were certified. That is about 1.3 percent.
Certifications were running at under 200 a month against a base of roughly 80,000 companies, and assessment wait times ran 6 to 12 months for the firms that got in the queue at all. For a year that arithmetic was the industry's argument for starting early. It turned out to be the reform task force's argument too: a third-party model that cannot physically reach the defense industrial base is a model that shrinks the industrial base instead. Whatever replaces it is likely to lean harder on the self-assessment you are already required to do.
Work that no outcome wastes.
Every one of these is required under the rules in force today, and every one of them is the foundation of any framework the task force recommends. None of it depends on a date.
Score yourself honestly
All 110 controls, weighted the way the DoD methodology weights them. Our scorer does exactly that, in your browser, with no email gate.
Write the plan you are missing
No system security plan means no defensible score. It is the first thing an assessor asks for and the most common thing small contractors do not have.
Fix the 5-point controls
A handful of heavyweight controls usually explains most of the distance to 110. Weight order beats alphabetical order every time.
Make SPRS match reality
Update the score to the one you can defend, with dated evidence behind it. This is the step the suspension made more important, not less.
We got this page wrong for eight weeks.
Until September 8, 2026, this page told you that starting November 10, 2026, new DoD solicitations involving CUI would require third-party CMMC Level 2 certification as a condition of award. That was true when we wrote it and false from July 13, when Phase 2 was suspended. We left it up anyway, because we were not watching our own claims closely enough.
We are leaving this note here permanently rather than quietly swapping the copy. A firm that asks you to trust its assessment of your controls should show you what it does when its own facts expire. If a badge is on this site, it is real. When a claim on this site stops being real, this is where it gets said.
We do readiness. We do not certify.
Certification, when it is required, only ever comes from a C3PAO, a Certified Third-Party Assessment Organization conducting the official assessment. What comes before that is readiness: closing gaps against the 110 NIST SP 800-171 controls, building the evidence, and running an environment that can pass.
cloudcorps does readiness, remediation, and managed enclave work. We are not a C3PAO. We do not certify. In a category full of overclaiming, we would rather be the clearest explainer of that distinction than the loudest voice in it.
The questions owners actually ask.
Is CMMC still required?
Partly, and the distinction is the whole story. On July 13, 2026, the Department of War suspended CMMC Phase 2. While the suspension holds, DoD contracting officers may require only Level 1 (Self) or Level 2 (Self) assessments, and solicitations that carried a third-party certification requirement are being amended to remove it. Self-assessment requirements from Phase 1 were not suspended and are in force today. The program has not been cancelled; it is under review.
So is November 10, 2026 still a deadline?
No. That date was the start of Phase 2, and Phase 2 is suspended. Any consultant still selling you a November 10 deadline either has not read the July 13 memo or is counting on you not having read it. We ran that framing on this page ourselves until September 2026, and we were wrong to leave it up as long as we did.
What still binds me?
The suspension paused the certification, not the rules underneath it. DFARS 252.204-7012, NIST SP 800-171, your SPRS score, your annual affirmation, and your prime's flow-down all still apply. If you handle CUI on a DoD contract, essentially every obligation you had in June is still yours today. What changed is who checks it.
If nobody is checking, why should I spend anything on this?
Because the checking moved rather than stopped. With no third-party assessment standing between your SPRS score and your contract, that score is a self-attestation the government can sue you over. In June 2026, an Alabama defense contractor paid $507,144 to settle False Claims Act allegations that it reported a perfect SPRS score of 110 while the Defense Contract Management Agency scored it at -170. That settlement includes no admission of liability, and it was a False Claims Act matter rather than a CMMC enforcement action, which is exactly why it matters here: the exposure runs through what you attested, not through a certificate you were missing.
What happens next?
The reform task force reports to the DoD CIO around mid-September 2026, with a public report expected late September or early October. Its stated mandate is to recommend a framework that replaces prohibitive third-party compliance models, so a shift toward more self-attestation is the outcome most consistent with the mandate. Officials have not ruled out any result, including cancelling the program. We will update this page when the report lands, on the day it lands.
What should I actually do in the meantime?
Know your real score. Run an honest 110-control self-assessment, fix the 5-point controls first, write the system security plan if you do not have one, and make sure the number in SPRS is one you could defend to a Defense Contract Management Agency assessor. That work is required under the rules in force today, it is what any restructured framework will be built on, and it is the only version of this spending that cannot be wasted by a policy change.
Does cloudcorps certify companies?
No. cloudcorps does readiness, remediation, and managed enclave work: getting your environment and your evidence to the point where your score is real. We are not a C3PAO and we do not certify. If a badge is on this site, it is real.
Why did the department suspend it?
Cost and scale, by its own account. About 80,000 contractors need CMMC Level 2; as of March 2026, only 1,074 were certified. That is about 1.3 percent. With Small Business Administration data putting the cost of the later phases far beyond what much of the small-business base could absorb, the department concluded the third-party model was structurally incompatible with expanding the defense industrial base. The capacity math that used to be an argument for starting early is now the argument the reformers are using.
Find out what your score really is.
All 110 controls, scored the way the DoD methodology scores them. No email required.