Last Updated: September 23, 2026
CMMC has been a contract requirement since November 10, 2025, when the DFARS acquisition rule took effect and Phase 1 began. Phase 2 was scheduled for November 10, 2026 and would have made third-party C3PAO certification a condition of award for most contracts involving Controlled Unclassified Information (CUI). The Department of War suspended it on July 13, 2026, and no replacement date has been set. This page tracks the CMMC implementation timeline and is updated when the program changes.
Current CMMC status (last verified September 23, 2026)
What Is the CMMC Implementation Timeline?
CMMC is built on two rules. The program rule at 32 CFR Part 170 defines the levels and how assessments are scored. The acquisition rule in 48 CFR puts the DFARS 252.204-7021 clause into contracts and makes CMMC status a condition of award. Department documents issued since late 2025 use the name Department of War (DoW), so this timeline uses DoD for earlier events and DoW for recent ones.
| Date | Event | Source |
|---|---|---|
| September 29, 2020 | Interim DFARS rule, effective November 30, 2020, adds the NIST SP 800-171 DoD Assessment Methodology and the original five-level CMMC framework, often called CMMC 1.0. | 85 FR 61505 |
| November 2021 | DoD announces CMMC 2.0, reducing five levels to three and allowing self-assessment at Level 1 and for some Level 2 contracts. | DoD announcement |
| December 26, 2023 | Proposed 32 CFR Part 170 program rule published. | Federal Register |
| August 15, 2024 | Proposed 48 CFR acquisition rule published. | 89 FR 66327 |
| October 15, 2024 | Final 32 CFR Part 170 program rule published. | Federal Register |
| December 16, 2024 | 32 CFR Part 170 takes effect, and Level 2 certification assessments by C3PAOs can begin under the rule. | 32 CFR Part 170 |
| September 10, 2025 | Final 48 CFR acquisition rule published. | 90 FR 43560 |
| November 10, 2025 | 48 CFR rule takes effect and Phase 1 begins, adding Level 1 and Level 2 self-assessment requirements to applicable new solicitations. | DFARS 252.204-7021 |
| July 13, 2026 | DoW CIO memorandum suspends Phase 2 and all later phases, stands up a CMMC Reform Task Force with 60 days to report, and opens a request for information. | DoW CIO memorandum |
| July 16, 2026 | DARS Class Deviation 2026-O0025, Revision 2 writes the suspension into acquisition instruction. | DARS class deviation |
| August 14, 2026 | Request for information closes after drawing more than 1,100 responses. | CMMC Reform Task Force RFI |
| September 3, 2026 | Revision 3 supersedes Revision 2. Its CMMC language is unchanged, and it sets no new Phase 2 date. | DARS class deviation |
| September 11, 2026 | Task Force report due to the DoW CIO. It has not been made public. | Internal delivery |
| Pending | Public release of Task Force recommendations. No date announced. | Advisory only |
CMMC rulemaking and implementation milestones, oldest first. Updated when a new milestone is published.
What Are the Four CMMC Phases?
32 CFR 170.3(e) set four implementation phases. Phase 1 started when the 48 CFR rule took effect, and each later phase was set to begin one calendar year after the one before it. The July 13, 2026 memorandum suspended every phase after Phase 1.
| Phase | Original start | What it adds | Status |
|---|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 and Level 2 self-assessments in applicable solicitations, with DoD discretion to require Level 2 (C3PAO) | In effect |
| Phase 2 | November 10, 2026 | Level 2 (C3PAO) certification as a condition of award for applicable contracts involving CUI | Suspended |
| Phase 3 | November 10, 2027 | Level 3 (DIBCAC) certification for applicable contracts | Suspended |
| Phase 4 | November 10, 2028 | Full implementation in all applicable solicitations and contracts, including option periods | Suspended |
Phase dates as written in 32 CFR Part 170. The suspension operates through policy memorandum and class deviation, and the rule text has not been amended.
What Changed in July 2026?
On July 13, 2026, the DoW CIO suspended the transition to Phase 2 and every milestone after it. The same memorandum formed a CMMC Reform Task Force to review the program and asked industry for comments on cost and compliance burden, with a focus on small and non-traditional businesses.
A memorandum sets policy, and a class deviation turns it into instructions contracting officers must follow. DARS Class Deviation 2026-O0025 did that first in Revision 2 on July 16 and again in Revision 3 on September 3. Revision 3 directs contracting officers to remove or revise Phase 2 requirements in solicitations and contracts. On existing contracts, the CMMC clause stays in force until a modification removes it, which the deviation ties to the next option exercise or scheduled administrative modification. Our post on the CMMC Phase 2 suspension covers the memorandum and the deviation in more detail.
What Still Applies During the CMMC Suspension?
The obligations underneath CMMC did not move. DFARS 252.204-7012 still requires contractors that handle covered defense information to implement the 110 requirements of NIST SP 800-171 Revision 2, and the class deviation keeps Revision 2 as the baseline even though NIST published Revision 3 in 2024.
Contracting officers still check SPRS for a current CMMC status before award and before exercising an option or extending a period of performance. For CUI work during the suspension, that status is usually a Level 2 (Self) score backed by an annual affirmation from a senior official. A contractor that already holds Level 2 (C3PAO) status meets a Level 2 (Self) requirement, because DFARS 252.204-7021 accepts the required level or higher.
With self-assessment as the main way the Department verifies compliance, the accuracy of a submitted score matters more than it did before July. An SPRS score is a representation to the government, and an overstated one creates False Claims Act exposure whether or not Phase 2 returns.
What Are the Three CMMC Levels?
CMMC 2.0 has three levels. The level a contract requires depends on the information involved, and the assessment type is set in the solicitation.
| Level | Information protected | Requirements | Assessment | Frequency | POA&M |
|---|---|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 requirements in FAR 52.204-21 | Self-assessment | Annual, with annual affirmation | Not permitted |
| Level 2 | CUI | 110 requirements in NIST SP 800-171 Revision 2 | Self-assessment or C3PAO, as the contract specifies | Every three years, with annual affirmation | Permitted for Conditional status if the score is at least 88 of 110 and only eligible requirements are open; must close within 180 days |
| Level 3 | CUI in the highest-priority programs | 24 selected requirements from NIST SP 800-172, added to Level 2 | DIBCAC, after the contractor holds Final Level 2 (C3PAO) status | Every three years, with annual affirmation | Permitted for Conditional status; must close within 180 days |
Level requirements under 32 CFR Part 170. During the suspension, Level 2 requirements in new solicitations can be met through self-assessment.
Level 2 scoring starts at 110 and deducts 1, 3, or 5 points for each requirement not met. A score of 110 earns Final status. Conditional status is a temporary bridge, and it expires if the POA&M is not closed out within 180 days of the status date.
What Should Defense Contractors Watch for Next?
The next public development is likely to be the Task Force's recommendations. A Task Force report is advisory and does not change any contract obligation by itself. Binding changes would arrive through another revision of Class Deviation 2026-O0025 or through rulemaking that amends 32 CFR Part 170 or the DFARS, and this page will be updated when either happens.
Until then, the practical position is the same for most contractors. Keep closing gaps against NIST SP 800-171 Revision 2 and keep the SPRS score accurate. Read each new solicitation for the CMMC level and assessment type it requires.
Where MyWorkDrive Fits in a CMMC Level 2 Environment
MyWorkDrive is a file access gateway that runs on Windows Server in your environment and publishes existing file shares over HTTPS, so CUI stays on storage you control and is not copied to a vendor cloud. Access follows your NTFS permissions and Active Directory groups, with MFA enforced at your identity provider, and file activity is logged for export to a SIEM. The MyWorkDrive server transmits CUI, so it sits inside your assessment boundary and belongs in your System Security Plan. The CMMC compliance file sharing page maps MyWorkDrive to the relevant NIST SP 800-171 controls, and the CMMC file sharing guide for NAVFAC contractors covers construction and A-E firms.
Update History
- September 23, 2026: Rewritten as a living timeline page. Added the July 13, 2026 suspension, Class Deviation 2026-O0025 Revisions 2 and 3, and Task Force status. Removed forward-looking dates from the 2024 version.
- November 7, 2024: Original publication.
Frequently Asked Questions
Is CMMC still required in 2026?
Yes. CMMC has been a condition of award in applicable DoD contracts since the DFARS acquisition rule took effect on November 10, 2025. The July 13, 2026 suspension paused Phase 2 and every later phase, while Phase 1 requirements continue, and contracting officers still check SPRS for a current CMMC status before award and before exercising an option. During the suspension, Level 1 and Level 2 requirements can be met through self-assessment.
When does CMMC Phase 2 start?
No date is currently set. Phase 2 was scheduled for November 10, 2026, when Level 2 (C3PAO) certification would have become a condition of award for most contracts involving CUI. The Department of War suspended it on July 13, 2026, and DARS Class Deviation 2026-O0025, Revision 3, issued September 3, 2026, continues the suspension without setting a new date.
What are the CMMC phases?
32 CFR Part 170 set four implementation phases, each starting one year after the last. Phase 1 began November 10, 2025 with Level 1 and Level 2 self-assessments in applicable solicitations. Phase 2 would have added Level 2 C3PAO certification on November 10, 2026. Phases 3 and 4 were set for November 10, 2027 and November 10, 2028, bringing in Level 3 and then full implementation across applicable contracts. The July 2026 suspension covers Phase 2 and every later phase.
What is the difference between CMMC 1.0 and CMMC 2.0?
CMMC 1.0, introduced through the September 2020 interim DFARS rule, had five levels and required third-party assessment at every level. CMMC 2.0, announced in November 2021, reduced the model to three levels built on FAR 52.204-21 and NIST SP 800-171, and permits self-assessment at Level 1 and for some Level 2 contracts. CMMC 2.0 is the version codified in 32 CFR Part 170.
Can contractors still get a C3PAO assessment during the CMMC suspension?
Yes. C3PAO certification assessments remain available on a voluntary basis, and a Level 2 (C3PAO) status satisfies a Level 2 (Self) requirement because DFARS 252.204-7021 accepts the required level or higher. Revision 3 of the class deviation directs contracting officers to remove or revise Phase 2 requirements, so whether to schedule an assessment now depends on the contracts you hold and the ones you plan to pursue.
Does the CMMC suspension change NIST SP 800-171 requirements?
No. DFARS 252.204-7012 still requires contractors that handle covered defense information to implement NIST SP 800-171 Revision 2, and Revision 3 of the class deviation keeps Revision 2 as the baseline. SPRS scores and the annual affirmation are still required. Self-assessment is now the main verification method, so an inaccurate score carries False Claims Act risk.