31
July
CMMC Phase 2 is Suspended, Your Security is Not
The Department of Defense has suspended the CMMC Phase 2 transition that was set to take effect on November 10, 2026. For contractors handling CUI (Controlled Unclassified Information), this means a third-party CMMC Level 2 assessment won’t be required for now, and subcontractors can continue after completing a self-assessment.
It’s important to be clear about what’s actually delayed. The piece being paused is the audit itself, not the security requirements needed. While the Phase 1 self-assessment requirements remain fully in effect, the formal assessment outlined in for level 2 contractors to