What changed in July 2026
On July 13, 2026, the Department announced the immediate suspension of CMMC Phase II requirements, previously scheduled for November 10, 2026. The official notice also suspends pending and future implementation milestones while the program is reviewed. The current CIO overview describes implementation as paused in Phase 1. Treat the former rollout dates as historical planning context, not a current promise that a new phase will begin on those dates.
What the announcement keeps in place
The Department states that Phase I self-assessment requirements remain in place. During the interim, it describes enforcement of NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments. The notice expressly preserves contractors’ and subcontractors’ obligations to safeguard covered defense information under DFARS 252.204-7012. A pause in a rollout milestone does not mean a contractor can stop protecting information or disregard its existing contractual commitments.
The model and implementation policy answer different questions
The current text of 32 CFR Part 170 continues to describe the three-level model, the assessment pathways, and a phased framework. The Department’s implementation announcement addresses how the program is being put into effect. Read both sources in context. Our Level 2 and Level 3 explanations describe the codified model; they should not be read as a claim that every contractor currently needs a third-party assessment or a Level 3 engagement.
What to verify before an award or a representation
Start with the current solicitation, contract, subcontract, incorporated clauses, and any amendments. Identify the information involved, the required assessment or representation, and the date it matters. Where an older flowdown or buyer request appears inconsistent with current policy, seek clarification from the appropriate contracting channel. Keep the controlling document and written clarification with the project record. An advisor’s summary or a public timeline is not a substitute for that procurement-specific answer.
Useful readiness work can continue without an artificial deadline
Inventory the information systems, resolve unclear FCI or CUI handling, assign security responsibilities, validate implemented safeguards, and keep evidence current. These activities support the underlying protection obligations and make later assessment work more coherent. CMMC Pulsar can provide a structure for scope, controls, evidence, and documentation; Federal Bid Partners can help define an appropriate readiness engagement. Neither should be sold as a way to purchase an official outcome or avoid determining what the contract actually requires.
How to use a dated policy update
This article reflects the official sources reviewed on October 23, 2026. Follow the current CIO program page and the July announcement directly, then check for subsequent implementation instructions when making a decision. We do not infer that every older clause has been removed, that all assessment pathways are repealed, or that future dates are settled. If policy changes again, the relevant government notice and actual procurement documents should drive the next review.