CMMC Phase 2 is suspended. What still applies on Nov 10?

What happened to CMMC Phase 2?

The Department of War suspended it. On July 13, 2026, the department's CIO announced "the immediate suspension" of CMMC Phase 2 requirements, which had been scheduled to start on November 10, 2026, and opened a comprehensive review of the program. The CIO's CMMC page states that "All Phase I self-assessment requirements remain firmly in place."

Phase 2 was the step most design firms were planning around. Under 32 CFR 170.3(e), Phase 1 began on the effective date of the DFARS acquisition rule, which the Federal Register notice set as November 10, 2025. Phase 2 was to begin one calendar year later and add the Level 2 (C3PAO) certification as a condition of award in applicable solicitations. That third-party requirement is what has been paused.

What did the implementing memo tell contracting officers to do?

Remove C3PAO and DIBCAC requirements from active solicitations and contracts. The department's implementing memo directs contracting officers to issue solicitation amendments "as soon as practicable" when program managers submit them, and to remove these requirements from existing contracts by modification before the next option period is exercised.

The memo also says "no waivers shall be granted during the review of the program," and that further guidance will follow the CIO's 60-day review. As of this writing, the CIO's CMMC page does not show a new Phase 2 start date. For an architecture or engineering firm on a DoD project, that means a solicitation you bid this fall should not require a C3PAO certificate as a condition of award, and one that still does is likely due for an amendment.

What still applies on November 10?

Everything that applied before the suspension, except the new third-party certification step. The implementing memo is explicit on three points that matter to AEC firms handling defense work.

• Level 1 (Self) still applies to contracts involving Federal Contract Information, covering the basic safeguarding requirements of FAR 52.204-21.
• Level 2 (Self) still applies where Controlled Unclassified Information is involved, and the memo notes that "CMMC Level 2 is aligned with NIST SP 800-171 Rev 2."
• The cybersecurity requirements in DFARS 252.204-7012 "remain in effect," including rapid reporting of cyber incidents to DoD within 72 hours of discovery.

The contract clause that makes CMMC status a condition of award, DFARS 252.204-7021, is still in the rulebook, and the DFARS rule's preamble says contracting officers must not award to an offeror that lacks a current CMMC status at the level the solicitation requires. If the solicitation requires Level 2 (Self), a missing or expired self-assessment in SPRS can still cost you the award.

How often does a Level 2 self-assessment have to be refreshed?

Every three years, with an affirmation every year in between. 32 CFR 170.16 requires the Level 2 self-assessment to be repeated on a three-year cycle, with results posted in the Supplier Performance Risk System (SPRS). An affirming official must affirm continuing compliance "at the time of each assessment, and annually thereafter."

The rule also allows a Conditional Level 2 (Self) status when some requirements are tracked on a plan of action and milestones (POA&M). Those open items must be remediated and posted to SPRS "within 180 days of the CMMC Status Date," or the conditional status expires. A firm that posted a conditional score last spring should check that clock now.

Does the pause lower the risk of a weak self-assessment?

No. An annual affirmation is a statement signed by a named official at your firm, and a SPRS score is a representation to the government. The suspension changed who verifies the controls, at least for now. It did not change what you are attesting to. A score that overstates your NIST SP 800-171 implementation carries the same exposure it did before July.

For design firms, the practical gap tends to sit in places the original Phase 2 deadline was forcing firms to address: CUI scattered across project file shares, drawings shared through consumer file links, personal devices with access to project email, and subconsultants who receive CUI without a flow-down plan. Those are self-assessment questions as much as certification questions.

What should an AEC firm on DoD work do this quarter?

Treat November 10 as a checkpoint, not a deadline. Five steps keep you ready for whatever the review produces.

• Pull your SPRS record and confirm the assessment date, score, and the date of your last affirmation. Put the next affirmation on the calendar now.
• If you hold a Conditional status, list every open POA&M item with an owner and a close date inside the 180-day window.
• Read the CMMC language in each active DoD solicitation and contract. Ask the contracting officer whether a C3PAO requirement will be removed by amendment or modification, and keep the answer in writing.
• Map where CUI lives today: project folders, email, collaboration platforms, plotters, and laptops. A scope you can describe is the starting point for any future assessment.
• Confirm your incident response plan can meet the 72-hour DFARS 7012 reporting requirement, including who at the firm makes the report.

Firms that had already booked a C3PAO assessment should talk with their assessor about whether to keep the date. A certification earned during the pause still documents your posture, and the review may end with third-party assessments back on the schedule.

Where does s90 fit?

s90 runs IT for architecture, engineering, and construction firms in Los Angeles and Orange County, including firms on defense work. We maintain the NIST SP 800-171 controls behind a Level 2 self-assessment, keep the evidence current between affirmations, and track the CMMC review so your team is not reading memos on deadline. If you want a second set of eyes on your SPRS score or POA&M before your next affirmation, we are glad to help.