The CMMC Review Window Closed. Here Is What Is Still Required Today

DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS score submission, and annual affirmations all remain in force. What the Department of War suspended is the Phase 2 requirement for third-party C3PAO assessments and Level 3, while Level 1 and Level 2 self-assessments continue (Secureframe; Department of War). The 60-day review closed on September 11, and nothing about it relieved contractors of their existing clauses.

We covered the initial pause in CMMC Phase 2 is paused: keep moving. With the review period over, contractors are asking what has actually changed. The short answer is that the certification step changed. The security obligations did not.

What is suspended

Under Class Deviation 2026-O0025, now at Revision 3 as of September 3, contracting officers are not including the Phase 2 requirement for Level 2 certification by a C3PAO, or Level 3 certification, in new solicitations (Secureframe). That removes a gate on award. It does not remove the underlying security requirements those assessments would have tested.

What remains in force

• DFARS 252.204-7012 and the obligation to implement NIST SP 800-171 Rev 2, report cyber incidents within 72 hours, and flow the clause down to subcontractors handling CUI.
• DFARS 252.204-7019 and -7020, which require a current SPRS score.
• CMMC Level 1 and Level 2 self-assessments and annual affirmations where contracts require them.
• False Claims Act exposure for inaccurate representations, which the Honeywell Aerospace settlement showed is very much alive.

What the industry told the Pentagon

The Department received more than 1,100 responses to its request for information, along with more than 10,000 pages of documentation, according to Department of War CIO Kirsten Davies (DefenseScoop). The direction of the conversation is telling. Davies has said cybersecurity remains "of utmost importance," that point-in-time assessments were not dynamic enough, and she flagged manufacturers' operational technology as a gap. Her summary: "Compliance equals compliance. Compliance doesn't equal security" (Federal News Network).

Industry voices have cautioned against reading the pause as an exit. "This is not the death knell of CMMC," Kostro told Federal News Network, adding that the class deviation in no way says CMMC is dead (Federal News Network). The most likely outcome is a revised program that leans harder on demonstrated security, which favors contractors who kept investing.

What we would do now

1. Keep your SPRS score honest and current. It is the representation most likely to be tested. Our SPRS improvement guide lists the highest-value controls.
2. Keep your C3PAO relationship warm if you were scheduled. When certification returns, assessor calendars will fill quickly.
3. Invest in operational controls, monitoring, incident response, and vulnerability management, because that is where the stated policy direction is heading and where real attacks land.
4. Do not ignore OT. If you manufacture, the review's attention to operational technology suggests future requirements will look harder at shop-floor systems. See our manufacturing practice.
5. Watch the FAR CUI rule, which would extend NIST SP 800-171 obligations to civilian agency contracts on its own track.

Cyberuptive's CMMC compliance and 24/7 SOC services are built for contractors who want to be ready whichever way the rework lands. Start with a readiness assessment.

Frequently asked questions

Is CMMC cancelled?

No. The Department of War suspended the Phase 2 requirement for C3PAO Level 2 certification and Level 3 in new solicitations under Class Deviation 2026-O0025 while it reworks the program. Level 1 and Level 2 self-assessments continue.

Does DFARS 252.204-7012 still apply during the CMMC pause?

Yes. DFARS 252.204-7012, including NIST SP 800-171 Rev 2 implementation, 72-hour incident reporting, and subcontractor flow-down, remains in covered contracts.

Do I still need to submit an SPRS score?

Yes. DFARS 252.204-7019 and 252.204-7020 still require a current SPRS score for covered contracts.

When did the CMMC review period close?

The Pentagon's 60-day review period closed on September 11, 2026. The Department received more than 1,100 responses to its request for information.

What is Class Deviation 2026-O0025?

The DoD class deviation that directs contracting officers not to include the CMMC Phase 2 third-party certification requirements in new solicitations. Revision 3 was issued September 3, 2026.