On July 13, 2026, the Department of War paused the third-party audit portion of CMMC. On September 3, it made that pause binding on every contracting officer. Neither action touched the rules that require you to protect CUI, score yourself honestly in SPRS, and have a senior official affirm that score every year.
If anything, the pause puts more weight on your self-assessment. With no outside assessor reviewing your environment before award, the score you post and the affirmation behind it are what the government relies on. And the Justice Department showed twice this summer that it will test that reliance.
CMMC was rolling out in phases. Phase I, already in effect, let contractors meet Level 1 and Level 2 requirements through self-assessment. Phase II, due November 10, 2026, would have made a Level 2 certification from a third-party assessor (a C3PAO) a condition of award for many contracts involving CUI.
On July 13, the Department of War announced that it was suspending Phase II immediately, along with all later implementation milestones. The same announcement said every Phase I self-assessment requirement stays in place. The stated reason was to cut compliance costs and barriers for small, medium, and non-traditional businesses.
The pause came through two memos rather than a rule change: a policy memo from the DoW Chief Information Officer and an implementation memo for contracting officers from the Under Secretary for Acquisition and Sustainment (Holland & Knight). The practical effect, per Morgan Lewis: while the suspension lasts, contracting officers may include only CMMC Level 1 (Self) or Level 2 (Self) requirements in contracts.
The memo also created a CMMC Reform Task Force with 60 days to review the program. Its report was due to the CIO on September 11 and had not been made public as of late September (Covington).
A memo states policy. It does not rewrite the contract rules contracting officers work from, and another memo can reverse it. That gap closed on September 3.
That day, John Tenaglia, the Department's principal director for Defense Pricing, Contracting, and Acquisition Policy, signed a class deviation (Washington Technology). A class deviation is a formal, binding instruction to depart from the codified acquisition regulations. This one, Revision 3 of deviation 2026-O0025, is listed with the Department's other FAR overhaul deviations on the Defense Acquisition Regulations System site.
It does two things that matter here. It directs contracting officers to follow the Revolutionary FAR Overhaul requirements instead of the November 2025 CMMC final rule when writing contract clauses. And it orders them to remove every CMMC third-party assessment requirement from contracts (Nextgov/FCW).
Because the pause now lives in regulation rather than a memo, reversing it takes a more formal process. For planning purposes, self-assessment is the operating model until the Department takes affirmative action to change it.
What the deviation did not do is repeal CMMC. The CMMC program rule and the clause framework remain on the books; the change governs which requirements contracting officers put into contracts during the suspension.
The list is short. Everything removed is about who verifies your security, not what security you owe.
Two cautions. First, nothing changes in your contract until the modification actually arrives. Existing CMMC clauses and prime contractor flowdowns remain enforceable until they are modified (Government Contracts Law). Second, a prime managing its own supply chain risk may keep requiring a Level 2 certification from subcontractors (same source). Read your contracts and subcontracts, not the headlines.
The obligations that actually govern how you protect CUI never depended on CMMC Phase II. As the Department put it on July 13, the action does not eliminate the requirement for companies to protect federal data (WilmerHale).
|
Obligation |
What it requires |
Status after July 13 and September 3 |
|---|---|---|
|
DFARS 252.204-7012 |
Implement the 110 security requirements of NIST SP 800-171 on systems that process, store, or transmit covered defense information; report cyber incidents within 72 hours |
Unaffected (Crowell & Moring) |
|
NIST SP 800-171 score in SPRS |
Post a summary score of your implementation, from -203 to a perfect 110 (Sidley) |
Still required |
|
CMMC Level 1 and Level 2 (Self) |
Self-assess against the required level and post results in SPRS |
Still required where the contract carries it (WilmerHale) |
|
Annual affirmation |
A senior official affirms each year that the company continues to meet the requirements it self-assessed |
Still required (same source) |
The enforcement backdrop has not paused either. In June, a Huntsville contractor paid $507,144 after posting a perfect 110 SPRS score while, according to DOJ, failing to implement required NIST SP 800-171 controls (DefenseScoop). On September 1, Honeywell Aerospace agreed to pay $2,042,518 over alleged NIST SP 800-171 noncompliance on one of its networks (Justice Department). Both cases rest on 252.204-7012 and the False Claims Act, not on CMMC certification.
A SPRS score is not a statement about your company in general. It is a statement about specific systems: the ones that process, store, or transmit CUI. Every control you score, and every point you claim, depends on where that boundary is drawn. And the boundary depends on knowing where the CUI actually is.
That is the weak point in most self-assessments. The boundary is usually drawn from a system security plan, an asset inventory, and interviews about where CUI is supposed to live. But CUI moves. Drawings get emailed, specs get saved to a personal OneDrive, old project shares keep copies nobody remembers. Each copy outside the documented boundary sits on a system your score never covered.
The result is a score that may be accurate for the environment you assessed and wrong for the environment you actually have. Consider what that means under each obligation:
Enforcement is already drawing these distinctions. The Honeywell allegations concerned noncompliance on one of the company's networks, not the whole enterprise (Justice Department). Compliance is judged system by system, and a system full of CUI that sat outside your boundary is exactly where that judgment lands.
A defensible self-assessment rests on three things you can show: current evidence of where CUI exists, a boundary that matches that evidence, and a record of checking again as the environment changes. The suspension removed the outside assessor. It did not remove the need to prove your score, and with less third-party review, that proof falls on you.
Can you show where your CUI lives today? Talk to Teramis about a CUI discovery assessment.
Government
Law firms
News