CMMC phase 2 suspension 2026

Defense contractors preparing for the next stage of Cybersecurity Maturity Model Certification received an important change in direction during 2026.

On July 13, 2026, the Department announced the suspension of CMMC Phase 2 requirements, which had originally been scheduled to begin on November 10, 2026. The Department has also made clear that Phase 1 self assessment requirements remain in place. Contractors can review the latest information on the official CMMC website.

That distinction is important.

CMMC has not simply disappeared, and organizations working with Federal Contract Information or Controlled Unclassified Information should not assume that cybersecurity requirements no longer apply.

For defense contractors, subcontractors, procurement professionals and technology teams, the more practical question is this:

What still needs to be done while CMMC Phase 2 is paused?

Understanding that question is especially important when purchasing computers, servers, network equipment, software, cloud services and other technology that may become part of an environment used to process, store or transmit government information.

What Happened to CMMC Phase 2?

CMMC implementation began with Phase 1 on November 10, 2025.

Phase 2 had been scheduled to begin November 10, 2026 and was expected to expand the use of third party CMMC Level 2 assessments for applicable defense contracts.

That transition is now suspended.

The Department’s current CMMC guidance states that implementation remains paused in Phase 1. During this period, the Department may require Level 1 or Level 2 self assessments and continues to enforce applicable cybersecurity obligations.

A further acquisition update arrived on September 3, 2026 with Revision 3 of Class Deviation 2026 O0025. The official Defense Acquisition Regulations System lists the revised deviation as effective September 3.

For contractors, this means the calendar changed, but many of the underlying cybersecurity responsibilities did not.

CMMC Phase 2 Being Paused Does Not Mean Cybersecurity Is Paused

This may be the most important point for organizations working in the Defense Industrial Base.

Companies should distinguish between a certification process and the underlying security requirements associated with their contracts.

DFARS 252.204 7012 continues to address safeguarding covered defense information and cyber incident reporting.

The Department’s current CMMC guidance also states that, during the Phase 2 suspension, cybersecurity compliance involving Controlled Unclassified Information will continue to be enforced using NIST SP 800 171 Revision 2 through self assessments and selected government assessments.

This means a contractor should not interpret the Phase 2 suspension as permission to discontinue security controls, documentation, assessment activities or protection of government information.

The method used to verify compliance may be changing, but applicable contract requirements still need to be understood and followed.

What About NIST SP 800 171 Revision 2?

This is an area where contractors may encounter understandable confusion.

NIST officially superseded SP 800 171 Revision 2 with Revision 3 in 2024. The NIST website therefore identifies Revision 2 as withdrawn. Contractors can review the publication history on the NIST SP 800 171 Revision 2 page.

However, current Department CMMC guidance specifically states that NIST SP 800 171 Revision 2 remains the cybersecurity baseline being enforced during the current CMMC Phase 1 period for applicable requirements.

Organizations should therefore avoid assuming that the newest NIST publication automatically replaces the requirements written into an existing defense contract.

The governing contract clauses, solicitation requirements and current Department guidance should be reviewed carefully.

When there is uncertainty, contracting, legal, cybersecurity and program personnel should determine which requirements apply to the specific contract.

Self Assessments and SPRS Still Matter

The current CMMC framework allows Level 1 and Level 2 self assessments during the Phase 1 period.

For Level 1, the Department describes an annual self assessment based on the 15 safeguarding requirements associated with FAR 52.204 21.

For Level 2 self assessment, the Department currently identifies the 110 security requirements from NIST SP 800 171 Revision 2 and provides for an assessment every three years, together with required affirmations.

Assessment information is entered into the Supplier Performance Risk System, commonly known as SPRS.

Contractors should therefore continue treating assessment information as an important part of their government contracting responsibilities.

A self assessment is not simply an administrative exercise.

The results should reflect the organization’s actual environment, implemented security controls, documentation and technical practices.

Why the CMMC Change Matters to IT Procurement

CMMC is commonly discussed as a cybersecurity subject, but technology procurement is an important part of the same operational picture.

Organizations cannot protect information effectively without understanding the systems that process, transmit and store that information.

A new server, workstation, network appliance, storage platform, software application or cloud service can change the technical environment.

That makes procurement an important opportunity to identify security requirements before a product is purchased rather than trying to address them after deployment.

For organizations supporting defense programs, technical and procurement teams should communicate before placing orders for systems that may interact with Federal Contract Information or Controlled Unclassified Information.

The goal is not simply to purchase a product that performs the required function.

The organization should also understand how that technology will fit within its existing security architecture, configuration standards, documentation requirements and contractual obligations.

For additional planning guidance, CCCS previously discussed seven key verifications for mission critical IT hardware procurement.

1. Review the Contract Before Defining the Technology Requirement

The procurement process should begin with the actual requirement.

Before requesting pricing, teams should determine whether the applicable contract or solicitation includes cybersecurity clauses, CMMC requirements, information handling requirements or other restrictions.

Different contracts can contain different requirements.

A requirement included in one program should not automatically be assumed to apply in exactly the same manner to another program.

Procurement personnel do not need to become cybersecurity assessors, but they should know when a technology purchase needs additional review from the organization’s technical, security or compliance personnel.

Organizations can also review DFARS 252.204 7021 for the contractual language associated with CMMC requirements.

2. Understand Where Government Information Will Be Processed

Technology teams should understand whether the equipment or software being purchased will process, store or transmit Federal Contract Information or Controlled Unclassified Information.

This can affect system design, configuration, access controls, logging, authentication, encryption, network architecture and other security decisions.

It can also affect which products, services or deployment models are appropriate.

Understanding this before purchasing a product can prevent an organization from investing in technology that later requires expensive changes or replacement.

3. Verify Hardware and Software Specifications Carefully

Mission critical technology should be purchased using exact specifications whenever possible.

Part numbers, configurations, firmware requirements, operating systems, software editions, support levels, licensing models and included components should be confirmed before an order is placed.

This is especially important when products will become part of a controlled technical environment.

An apparently small substitution can introduce a different component, operating system, management interface or support model.

Those differences can affect security configuration as well as compatibility.

CCCS provides procurement support across a range of government and enterprise technology requirements. More information is available on our procurement capabilities page.

4. Consider the Supply Chain

Cybersecurity does not begin when a system is connected to the network.

It also involves understanding where technology comes from and whether the organization can establish reasonable confidence in the source.

Federal acquisition rules contain several requirements intended to address technology supply chain risks. Current GSA acquisition policy, for example, includes specific procedures for cyber supply chain risk management.

For mission critical purchases, organizations should consider authorized distribution channels, manufacturer traceability, product authenticity, country of origin requirements and applicable restrictions before accepting equipment.

A low price should not replace supplier verification.

CCCS has also discussed how federal purchasing is changing through federal IT procurement consolidation in 2026, including the increased focus on coordinated purchasing, vendor relationships and supply chain verification.

5. Maintain Documentation With the Purchase

Documentation can become as important as the physical equipment.

Purchase records, serial numbers, model numbers, licensing information, warranty records, configuration information, certificates and supplier documentation can support future inventory management, technical review and compliance activities.

Procurement teams should establish documentation requirements before the purchase order is released.

Requesting records after equipment has already been shipped can make them considerably more difficult to obtain.

6. Coordinate Procurement, IT and Cybersecurity

One of the simplest improvements an organization can make is also one of the most valuable.

Procurement, IT and cybersecurity personnel should communicate.

The purchasing team understands vendors, pricing, delivery and documentation.

The technical team understands compatibility, configuration and performance.

The cybersecurity team understands information boundaries, security controls and assessment requirements.

When those groups work together before an order is placed, the organization is more likely to purchase technology that fits both the operational requirement and the security environment.

This coordination can become especially important near the end of the federal fiscal year. CCCS provides additional planning guidance in our article on federal fiscal year end IT procurement.

7. Continue Monitoring CMMC Guidance

The current CMMC situation is still evolving.

The September 2026 acquisition updates continue the Phase 2 suspension, and the Department has not announced a replacement date for the suspended November 10, 2026 Phase 2 transition.

Contractors should monitor the official CMMC website and current federal acquisition resources rather than relying solely on older implementation schedules.

This is particularly important when reviewing a new solicitation, contract modification or option period.

Requirements should always be confirmed against the documents that actually apply to the procurement.

CMMC Should Be Part of the Procurement Conversation

Cybersecurity compliance cannot be solved simply by purchasing different hardware or software.

At the same time, purchasing decisions can make cybersecurity easier or considerably more difficult.

The right time to identify these issues is before the purchase.

Organizations should know what information the system will handle, what contract requirements apply, where the equipment or software will operate, who will access it, how it will be managed and what documentation needs to be retained.

This allows procurement decisions to support the organization’s wider security program instead of creating additional problems for it.

How CCCS Supports Mission Critical Technology Procurement

CCCS has supported government agencies, defense contractors, scientific organizations and enterprise customers with technology procurement for decades.

Our role is not to determine an organization’s CMMC certification status.

Our role is to help customers manage the technology procurement process with the attention to specifications, sourcing, documentation, logistics and technical requirements that mission critical environments demand.

CCCS supports the procurement of IT hardware, software, licensing, networking equipment, servers, storage, specialized electronics and other technology through established manufacturer and distribution relationships.

For requirements involving specialized products, difficult sourcing conditions or government contract requirements, our team works with customers to understand the complete purchasing requirement before the order is placed.

That includes identifying exact product specifications, coordinating manufacturer and distributor resources, reviewing availability, managing documentation requirements and supporting delivery through the complete order lifecycle.

Organizations can learn more about our technology procurement capabilities or contact CCCS to discuss an upcoming requirement.

CMMC Phase 2 Is Paused, but Preparation Still Has Value

The suspension of CMMC Phase 2 gives defense contractors a different implementation environment than many expected at the beginning of 2026.

It does not eliminate the need to protect government information.

Organizations should continue understanding their applicable contracts, maintaining accurate self assessments where required, protecting Federal Contract Information and Controlled Unclassified Information, maintaining appropriate documentation and reviewing technology purchases carefully.

The companies that approach cybersecurity as an ongoing operational responsibility rather than a single certification event will also be better prepared for whatever direction the CMMC program takes next.

For procurement teams, that starts with something very practical:

Know what you are buying, know where it came from, know how it will be used and maintain the documentation needed to support the mission.

CCCS provides value added technology procurement and supply chain support for government agencies, defense contractors, research organizations and enterprise customers nationwide.

Organizations planning upcoming technology requirements can contact CCCS to discuss hardware, software, specialized components, licensing, documentation and mission critical procurement needs.

This article is provided for general informational purposes and is based on publicly available CMMC and federal procurement guidance. It is not legal advice, cybersecurity advice, certification guidance, or a determination of compliance. Organizations should review their specific contract requirements and consult qualified legal, cybersecurity, or compliance professionals when appropriate.