- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
- November 10, 2028 is a contract-clause date, not a restart. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) sets November 10, 2028 as the date the CMMC clause (DFARS 252.204-7021) is inserted broadly when contractor systems handle FCI or CUI. It is not a Phase II restart, and class deviations can be revised or rescinded.
The short answer
Nothing new takes effect on November 10, 2026. That was the scheduled start of CMMC Phase II, when Level 2 (C3PAO) certification would have become a condition of award in many DoD contracts. On July 13, 2026, the Department of War suspended Phase II. Until that changes, new solicitations may require only CMMC Level 1 (Self) or Level 2 (Self). Third-party certification is voluntary.
What does and doesn't change on November 10
| Item | Status on November 10, 2026 |
|---|---|
| Level 2 (C3PAO) as a condition of award | Does not start. Phase II is suspended. |
| Level 1 (Self) and Level 2 (Self) | No change. Still allowed in solicitations, as in Phase 1. |
| DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 | No change. Still in effect where you handle CUI. |
| SPRS scores and annual affirmations | No change. Must still be accurate where your contract requires them. |
| Voluntary C3PAO certification | No change. Still available through Authorized C3PAOs. |
Under the July 13 memo, solicitations that already listed Level 2 (C3PAO) or Level 3 (DIBCAC) are to be amended to remove those requirements, and existing contracts are to be modified at the next option or scheduled administrative modification.
What November 10, 2028 means
DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) sets November 10, 2028 as the date the CMMC clause, DFARS 252.204-7021, is included broadly when contractor systems process, store, or transmit FCI or CUI. That is about when the clause goes into contracts. It is not a Phase II restart, and it does not by itself bring back the C3PAO requirement. The DoW CMMC review is ongoing, and its recommendations have not been published as of November 9, 2026.
Why some contractors certify anyway
- Primes set their own supplier terms. Some may still ask for independent evidence of NIST SP 800-171. See what primes can require.
- A certificate lasts three years. Final Level 2 (C3PAO) status is valid for three years under 32 CFR Part 170, so earning it now can cover you if requirements return.
- Self-assessments carry legal weight. Your SPRS score and affirmation are statements to the government. An independent check helps confirm they are accurate.
- Assessor schedules are open. Without a deadline, you can choose timing that suits your team.
None of this makes certification mandatory today. If your contracts only call for Level 2 (Self), a careful self-assessment may be enough. See Level 2 Self vs C3PAO.
Want an outside view before deciding? The optional Spot Check takes 1 day, is complimentary, and you get results in writing or verbally.
Get My Complimentary CMMC Readiness Spot CheckWhat to do before and after November 10
- Read your current solicitations and contracts for DFARS 252.204-7019, -7020, -7021 and any CMMC level.
- Keep your SSP, POA&M, and SPRS score current and accurate.
- Ask your primes what they expect from suppliers in 2027.
- Watch for the DoW review results and any new rule or deviation.
123 Efficient CMMC, LLC is an Authorized C3PAO. We do not provide implementation consulting to organizations we assess.