Phase II certification is paused. DFARS 252.204-7012, 7019, and 7020 are not. Self-assessments, SPRS scores, and 72-hour incident reporting remain contractually binding, and with no assessor in the room, the accuracy of your score matters more, not less.
CMMC Level 1 and Level 2 don’t follow the same logic, and treating them as steps on the same ladder is where scoping goes wrong. This guide breaks down what triggers each level, how the assessments differ, and the decisions defense contractors need to make before either one gets scheduled.
On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which were scheduled to take effect on November 10, 2026. Within hours, defense contractors started asking the same question: “Do we still need to spend money on this?”
Yes. Here’s why, and what actually changed.
Learn about the 17 cybersecurity practices required for CMMC Level 1 compliance. Understand basic safeguarding measures and how they help protect federal contract information (FCI).
