A current, no-hype status update on the Cybersecurity Maturity Model Certification and what to do about it now.
Published June 5, 2026 by the Government.biz editorial team. Last reviewed on September 28, 2026. CMMC dates depend on rulemaking; verify specifics against official DoD sources.
Few topics in defense contracting have generated more confusion than CMMC's timeline. Headlines have promised "CMMC required next year" for several years running. The reality in 2026 is more nuanced — and more manageable — than the headlines suggest: CMMC is real, the rules are final, and the requirement is being phased in over several years rather than switched on all at once. Phase 1 began November 10, 2025; Phase 2, the third-party certification step, was suspended in July 2026 before it started. Here's where things actually stand.
CMMC runs on two separate regulations, and conflating them is the source of most confusion:
Rather than requiring every contractor to be certified on day one, the DoD designed a staged rollout that ramps up over roughly three years:
| Phase | What it introduces |
|---|---|
| Phase 1 (began Nov. 10, 2025) | CMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable solicitations. In effect. |
| Phase 2 (was Nov. 10, 2026) | Level 2 third-party (C3PAO) certification requirements added for applicable contracts. Suspended July 13, 2026; a September 3, 2026 class deviation requires these requirements to be removed from solicitations and contracts. |
| Phase 3 (scheduled Nov. 10, 2027) | Level 3 requirements are introduced for the highest-priority programs. Timing depends on the outcome of the reform review. |
| Phase 4 (scheduled Nov. 10, 2028) | Full implementation — CMMC requirements apply across all applicable DoD solicitations and contracts. Timing depends on the outcome of the reform review. |
Each phase was meant to build on the last, giving the assessor ecosystem time to scale. The DoD cited compliance costs, limited third-party assessment capacity, and small businesses leaving the defense industrial base when it paused Phase 2. Reversing the pause now takes regulatory action rather than a memo, so treat any date for third-party certification with caution until the DoD publishes the reform task force's outcome.
17 basic practices protecting Federal Contract Information (FCI). Met by an annual self-assessment; no external assessor required.
The 110 controls of NIST SP 800-171, protecting Controlled Unclassified Information (CUI). Met by self-assessment for some contracts and, under the original rule, a C3PAO assessment every three years for others. With Phase 2 suspended, C3PAO certification is not currently required as a condition of award. This is where most affected contractors land.
Adds controls from NIST SP 800-172 for advanced-threat protection. Government-assessed and reserved for the highest-priority programs.
For the full breakdown of practices, costs, and the assessment process, see our CMMC certification guide.
The contractors who will struggle are the ones who wait for CMMC to appear in a solicitation and then scramble. Getting to Level 2 from a standing start can take many months. Practical steps to take today:
Yes. On July 13, 2026 the DoD suspended CMMC Phase 2, which was scheduled to begin November 10, 2026 and would have required C3PAO third-party Level 2 certification for applicable contracts involving CUI. On September 3, 2026 a DoD class deviation made the suspension binding by directing contracting officers to remove Phase 2 third-party assessment requirements from active solicitations and existing contracts. A CMMC Reform Task Force conducted a 60-day review; as of late September 2026 its recommendations had not been made public.
Partly. Phase 1 began November 10, 2025, so CMMC Level 1 and Level 2 self-assessment requirements can appear in DoD solicitations. Phase 2 third-party certification is suspended. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 compliance, SPRS scores, and annual affirmations still apply. Whether a specific contract requires CMMC, and at what level, depends on the solicitation — always check it.
Most contractors handling CUI need Level 2 (the 110 NIST 800-171 controls). Those handling only FCI generally need Level 1 (annual self-assessment). Level 3 applies to a small set of the highest-priority programs.
Yes. With Phase 2 suspended, DoD is not requiring C3PAO certification as a condition of award, so Level 2 requirements in contracts are met by self-assessment and annual affirmation. A C3PAO assessment is now voluntary, though some firms still pursue one for competitive positioning. Level 1 is always self-assessed; Level 3 is government-assessed.
Authoritative sources: DoD CIO — CMMC and 32 CFR Part 170; Phase 2 suspension: DoD Office of Small Business Programs and Nextgov/FCW on the September 3 class deviation. This page is general information, not legal or cybersecurity advice.