- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
- November 10, 2028 is a contract-clause date, not a restart. DFARS Class Deviation 2026-O0025, Revision 3 sets it as the date the CMMC clause is inserted broadly when contractor systems handle FCI or CUI. It is not a Phase II restart and can be revised.
Since the Department of War suspended CMMC Phase II on July 13, 2026, many subcontractors have heard two different messages: DoD solicitations can require only Level 1 (Self) or Level 2 (Self), yet some primes still ask suppliers about third-party certification. Others have heard nothing from their primes at all. This guide explains why those messages can both be true, what still flows down under DFARS, and what to confirm in writing so you are not guessing.
Why DoD and your prime may expect different things
The suspension controls what a DoD requiring activity may designate in a solicitation. It does not rewrite every subcontract or purchase order already in place, and it does not stop a prime from setting its own supplier standards. Primes manage their own risk: they are responsible for flowing down security clauses, they answer for their supply chain, and many planned for Level 2 (C3PAO) before the pause.
So a prime may reasonably keep asking for a Certificate of CMMC Status, a minimum SPRS score, or evidence of NIST SP 800-171 implementation as a business requirement, even while DoD cannot require Level 2 (C3PAO) in new solicitations. The only reliable answer is what your subcontract and your prime's written guidance actually say.
What still flows down during the pause
- DFARS 252.204-7012. Where your subcontract involves covered defense information, the safeguarding and incident-reporting clause still applies, including the 110 security requirements of NIST SP 800-171 Revision 2.
- DFARS 252.204-7021, when it is in the prime contract. The prime must include it in subcontracts involving FCI or CUI and make sure subcontractors have a current CMMC status at the appropriate level before award. During the suspension, that level is Level 1 (Self) or Level 2 (Self).
- SPRS and affirmations. Self-assessment results and annual affirmations still go into SPRS. An inflated score is a real risk whether or not Phase II is active. See how SPRS scores work.
For a side-by-side look at the two Level 2 pathways, see Level 2 (Self) vs Level 2 (C3PAO).
What to confirm with your prime, in writing
A short email to your prime's supplier or subcontracts contact can settle most of the uncertainty. Ask:
- Which CMMC level do you require from us, and is it Level 2 (Self) or Level 2 (C3PAO)?
- Is that a contract requirement or a preference? Ask them to point to the subcontract, PO term, or supplier policy.
- By when? Get a date, and ask whether it changed after the July 13, 2026 suspension.
- What evidence will you accept? An SPRS score and affirmation, a Certificate of CMMC Status, or something else.
- What information will you flow to us? FCI only, or CUI? That drives the level and your assessment scope.
- Will you notify us if your expectations change? Especially when the CMMC Reform Task Force recommendations or a new DFARS action is published.
Keep the answers with your System Security Plan records. They help you scope your work and show why you chose the path you did.
Want an outside read on where you stand before you answer your prime? Our Complimentary CMMC Readiness Spot Check is optional but highly recommended. It takes one day, and you get results in writing or verbally.
Get My Complimentary CMMC Readiness Spot CheckHow to respond to your prime
If they require Level 2 (Self)
Make sure your self-assessment is accurate, posted to SPRS, and backed by a current SSP and any POA&M. Consider an independent review before you submit, so the score you report is one you can defend.
If they require or prefer Level 2 (C3PAO)
Voluntary certification assessments remain available through Authorized C3PAOs today. Ask about timing early, since scheduling and readiness both take time. Our guide to the Level 2 certification assessment walks through how it runs.
If they haven't said anything
Don't treat silence as relief. Send the questions above, keep working on NIST SP 800-171, and keep your SPRS information current.
The November 10, 2028 date
DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) says that until November 9, 2028 the CMMC clause is inserted only when a requiring activity designates a CMMC level. On and after November 10, 2028, contracting officers insert it broadly when contractor systems will process, store, or transmit FCI or CUI. That is a contract-clause date, not a Phase II restart, and class deviations can be revised or rescinded. It is still a useful planning marker when you talk with primes about longer-term expectations.
Where an independent check fits
123 Efficient CMMC, LLC is an Authorized C3PAO. We do not provide implementation consulting to organizations we assess. That independence is the point when a prime wants assurance from someone other than the people who did the implementation work. Our services range from the optional one-day Complimentary Spot Check to an independent review before SPRS, a Detailed Mock Assessment covering all 320 Level 2 objectives, and the formal Level 2 C3PAO certification assessment. If you are still choosing a readiness partner, see C3PAO vs RPO.