# DoD Suspends CMMC Phase Two Rollout

The Department of Defense suspended CMMC Phase 2 and later rollout milestones on July 13, 2026. As of October 20, certification requirements under Phase 2 remained suspended in new DoD solicitations, and the planned November 10, 2026 Level 2 third-party certification date is not an operative deadline; no replacement date has been confirmed. Phase 1 remains in effect, and individual contracts may still require Level 1 or Level 2 self-assessments or Level 2 C3PAO certification. For contractors handling CUI, this means the solicitation and contract terms—not the paused rollout date—determine the required assessment route. Level 2 assessments examine evidence, interview personnel, and test controls against 110 NIST SP 800-171 requirements.

- Contractors should keep SPRS submissions accurate and maintain assessment-ready evidence, since self-assessments and existing contractual requirements continue despite the Phase 2 suspension.
- Companies handling CUI can continue scoping systems and conducting gap analyses, while confirming each solicitation’s assessment requirements before pricing or proposing.
- Budget planning should account for implementation and remediation costs in addition to assessment fees; the planned November 10 certification date should not be treated as a current deadline.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 04, 2026

### Government Entities
- Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- CLOUD2E (Registered Provider Organization and External Service Provider; describes its C3PAO Level 2 assessment experience)

### Sources
- [Assessment week, demystified: what assessors examine, interview and test. https://t.co/FhXkbjpFoS #CMMC](https://x.com/CLOUD2ELLC/status/2117980194338381898) - twitter-govtech
- [CMMC Level 2 vs 1 vs 3: Costs and Phase 2 Status [2026]](https://tech-insider.org/cmmc-level-2-vs-level-1-vs-level-3-costs-phase-2-suspension-2026) - https://tech-insider.org/