When does CMMC phase in, and what must contractors do now?
The CMMC program rule took effect on 16 December 2024, and the DFARS clause that puts CMMC into contracts took effect on 10 November 2025. On 13 July 2026 the Department of War suspended Phase II, so the CMMC level a contract requires now depends on that contract and on the program office or requiring activity that issued it. Check each solicitation and each prime's flowdown notice for the level it names, because a general statement about CMMC no longer tells you what you must hold. Under the DFARS class deviation issued on 3 September 2026, requiring activities may specify Level 1 (Self) or Level 2 (Self), and contracting officers are working to remove or revise affected requirements in active and existing contracts.
The published sources do not agree yet. The eCFR text of 32 CFR 170.3(e) still lists the original four-phase schedule, while the DoW CIO's About CMMC page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2. Do not plan around either text alone. Ask the contracting officer in writing which level and assessment type applies to each contract, and record the answer in your contract file. Keep the schedule under review, since the 13 July 2026 suspension opened a 60-day review by a CMMC Reform Task Force.
Several obligations stay in force regardless of the phase. Phase I self-assessments, SPRS postings and annual affirmations by an Affirming Official remain required where a contract calls for them, and DFARS 252.204-7012 has required implementation of NIST SP 800-171 since 31 December 2017. Confirm your current SPRS score and affirmation dates, and check whether your system security plan and POA&M reflect your actual environment. Your organization owns its controls and the evidence behind them. An implementation partner can prepare systems and documentation, but only an independent assessor can issue a certification assessment result, and that is a separate contract to plan for when a requirement calls for it.
How the rollout sequence stands in October 2026
The sequence shows which CMMC requirements already bind contracts, which stage has been paused, and which dates still control what a solicitation can require. Contractors should use it to decide what to prepare now and what to confirm with each contracting officer.
Publish the CMMC Program rule
The CMMC Program rule in 32 CFR Part 170 was published in the Federal Register on 15 October 2024 and took effect on 16 December 2024. It created the three CMMC levels, the assessment types and the rules for who may assess. On its own it does not change any contract, because a DFARS clause must place the requirement into an agreement. Contractors can confirm the rule text in the eCFR, and the rule's effective date is the point from which the program's rules govern assessments.
Put CMMC into contracts through DFARS
The DFARS rule that adds clause 252.204-7021 and provision 252.204-7025 was published on 10 September 2025 and took effect on 10 November 2025. This is the step that lets a program office attach a CMMC requirement to a solicitation or contract. Its effective date started Phase 1 under 32 CFR 170.3(e)(1), which allows Level 1 or Level 2 (Self) at award. Contractors can check whether a solicitation names a CMMC level and an assessment type in its requirements section.
Schedule Phase II for 10 November 2026
The original four-phase schedule in 32 CFR 170.3(e) set Phase II to begin on 10 November 2026. That phase would have added Level 2 (C3PAO) certification for applicable contracts. The schedule was a plan for contracting officers and primes, so contractors had to prepare for third-party certification within it. Organizations that planned around that date should compare their readiness work against the later steps before making commitments.
Suspend Phase II on 13 July 2026
On 13 July 2026 the Department of War suspended CMMC Phase II and the later implementation milestones that depended on it. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remained in place. The DoW CIO's About CMMC page now describes implementation as paused in Phase 1 and says it may only require self-assessments at Levels 1 and 2. Contractors should confirm the current status on that page before relying on any phase date.
Complete the 60-day CMMC Reform Task Force review
The suspension started a 60-day review by a CMMC Reform Task Force. Its output determines how the program moves forward after the pause. Contractors should not assume the review outcome until the Department publishes it. Until then, the working assumption for planning is that self-assessments at Level 1 and Level 2 are the requirements that a requiring activity can specify, and that certification timelines are subject to change.
Apply the 3 September 2026 class deviation
DoW Class Deviation 2026-O0025, Revision 3, dated 3 September 2026, cites the 13 July 2026 memorandum. It lets requiring activities specify Level 1 (Self) or Level 2 (Self), and directs contracting officers to remove or revise CMMC requirements in active solicitations and existing contracts. Existing contracts are modified before the next option is exercised or through the next scheduled administrative modification. Contractors should ask the contracting officer which modification changes their contract and keep the signed modification on file.
Reach the 9 November 2028 clause boundary
The deviation keeps the original clause schedule. Until 9 November 2028, clause 252.204-7021 enters a contract only when the program office or requiring activity specifies a CMMC level. Contractors should track which of their contracts name a level and which level, since this is the period in which requirements vary by solicitation. Their records should show the level stated in each contract.
Apply the clause from 10 November 2028
From 10 November 2028, the deviation says clause 252.204-7021 applies whenever contractor systems will process, store or transmit FCI or CUI, except for contracts solely for commercial off-the-shelf items. This is the date on which the clause reaches most covered contracts without a specific level being named. Organizations should confirm, with their contracting officers and in their own systems, which contracts will fall under the clause and what assessment each requires.
What the Phase II suspension and class deviation changed
The 13 July 2026 suspension removed the near-term requirement that most contractors obtain a Level 2 C3PAO certification. The Department of War paused CMMC Phase II, which had been scheduled to start 10 November 2026, and opened a 60-day review by a CMMC Reform Task Force. What stays in force matters just as much as what paused. Phase I self-assessments, SPRS postings, annual affirmations and the obligations of DFARS 252.204-7012 continue, and that clause has required implementation of NIST SP 800-171 since 31 December 2017. A contractor that treated the suspension as permission to pause its security program has misread the notice. Confirm which obligations apply to your current contracts, and keep your SPRS score and affirmation current.
DoW Class Deviation 2026-O0025, Revision 3, dated 3 September 2026, is the instrument contracting officers now work from. It lets requiring activities specify CMMC Level 1 (Self) or Level 2 (Self) assessments, which means the level written into your solicitation or contract may differ from what earlier schedules implied. The deviation also directs contracting officers to remove or revise affected CMMC requirements. For existing contracts, that happens by modification before the next option is exercised or through the next scheduled administrative modification. For active solicitations, amendments are issued as soon as practicable. Review each contract and each open bid for the CMMC language it contains and for any amendment that followed. Ask the contracting officer in writing which level and which assessment type now apply.
The official sources do not yet agree. The DoW CIO *About CMMC* page, as of 17 October 2026, describes implementation as paused in Phase 1 and says it may require only self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still lists the original four-phase schedule. Do not resolve that conflict yourself. Treat the requirement in your signed contract, and any modification or amendment that changed it, as controlling, and get the contracting officer's answer in writing. Record the date and content of that answer in your compliance file, because it determines whether you need a self-assessment, a certification assessment, or neither for a given award. Your readiness work should keep moving either way, since the underlying NIST SP 800-171 Rev. 2 requirements are unchanged.
What contractors must still do now
If a prime contract or subcontract still names a CMMC level, that requirement stays live until the contracting officer changes it. Under the 3 September 2026 class deviation, contracting officers work with requiring activities to remove or revise CMMC requirements, and existing contracts are modified before the next option is exercised or at the next scheduled administrative modification. Until that modification arrives, the level in the contract governs what you must demonstrate. The DoW CIO About CMMC page describes the current status of implementation.
- Assessment at the named level: Complete the self-assessment or certification assessment the contract specifies, and keep the result posted in SPRS at that level.
- NIST SP 800-171 Rev. 2 baseline: DFARS 252.204-7012 has required implementation since 31 December 2017, whatever CMMC level the contract names.
- Annual affirmation: Keep the affirmation current for the level you hold, signed by an Affirming Official.
- Final evidence only: Assessors credit a requirement only when the evidence is in final form, so drafts of the system security plan or POA&M do not support a result.
Confirm in writing which level applies today and whether a modification is scheduled before the next option date.
Bids submitted now can carry clause 252.204-7021 into performance, so the clause date matters for pricing and compliance planning. The deviation keeps the original schedule: until 9 November 2028, the clause goes into a contract only when the program office or requiring activity specifies a CMMC level. From 10 November 2028, it applies whenever contractor systems will process, store or transmit FCI or CUI, except for contracts solely for commercial off-the-shelf items. Under the deviation, the level specified before that date may be Level 1 (Self) or Level 2 (Self).
- Clause review: Check the solicitation clause list and its level instructions, since the presence of 252.204-7021 signals that a level will be checked.
- Pre-2028 specifications: Before the default date, the requiring activity decides the level, so the same workload can carry different requirements across contracts.
- Assessment-ready systems: Once the clause applies to your systems, the environment must support an assessment, so keep scope, the system security plan and evidence current.
- Long performance periods: A contract that runs past the default date inherits its clauses, so ask how options will be handled.
Ask the contracting officer which level the solicitation specifies and whether the 2028 default would change requirements during performance.
A contractor that handles only federal contract information (FCI) has a narrower set of duties, but it still has to prove them. Level 1 covers the 15 safeguarding requirements of FAR 52.204-21, assessed by self-assessment. The baseline for controlled unclassified information (CUI) under DFARS 252.204-7012 does not apply to systems that never receive CUI, so the first task is to confirm that no CUI enters your environment through the statement of work, data feeds or shared files. If CUI does appear, the NIST SP 800-171 Rev. 2 baseline applies to the systems that hold it.
- Level 1 self-assessment: Assess each of the 15 requirements against the systems that hold FCI, recognizing that scoring is all or nothing.
- SPRS entry and affirmation: Post the Level 1 result in SPRS and keep the annual affirmation current when a contract names Level 1.
- CUI boundary check: Document how you confirm that CUI is absent, and reassess when the contract scope changes.
- Written records: Keep documentation of how each requirement is met, in final form, for as long as the contract requires.
Confirm in writing whether the contract names Level 1 (Self) and whether any CUI is in scope before you post a result.
Why planning on the old schedule creates avoidable rework
The phase-in schedule has moved, and the rule text, the DoW CIO page and the class deviation do not all say the same thing. Each card below names a planning mistake that is easy to make under that uncertainty, and the requirement your organization owns to check before it acts.
Relying on the eCFR table alone
The eCFR text of 32 CFR 170.3(e) still lists the original four-phase schedule, but the DoW CIO page says implementation is paused in Phase 1. Planning from the eCFR table alone can send a team toward Level 2 certification that a contract no longer requires, or leave it unprepared for a requirement that a program office has reinstated. Confirm the current status with the contracting officer and the DoW CIO page before setting a budget.
Assuming 2028 means nothing is needed sooner
The deviation keeps the clause schedule that applies 252.204-7021 to all contracts handling FCI or CUI from 10 November 2028. Before that date, the clause goes in only when a program office or requiring activity specifies a CMMC level. Waiting for 2028 means that a contract specifying Level 2 (Self) in 2027 finds the organization without a current assessment or SPRS entry. Ask each customer which level its active and planned solicitations specify.
Dropping certification when a program office requires it
The 13 July 2026 suspension stopped Phase II, but requiring activities can still specify a Level 2 assessment in their own solicitations. The organization owns the decision to prepare and must confirm whether a given contract calls for a self-assessment or a C3PAO certification. Cancelling preparation on the strength of the suspension alone can leave a bid without the level it needs once that solicitation is amended.
Missing that FCI-only work falls under Level 1
Contractors that handle only Federal contract information are generally held to Level 1, the 15 safeguarding requirements of FAR 52.204-21, not NIST SP 800-171. Teams that apply Level 2 scope to every system can spend effort on controls that a Level 1 contract does not need, and miss the narrower scope that the contract actually requires. Map each system to the information it stores, processes or transmits, and confirm the level with the contract.
Letting SPRS and affirmations lapse
Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place after the suspension. A missing or expired SPRS entry or affirmation can disqualify a bid even when no certification is required yet. The affirming official must confirm the posting and affirmation are current and that the assessed scope still matches the systems in use. Set a recurring internal review date to check both.
Should a contractor seek a C3PAO assessment before it is required?
The 2024 final rule does not stop a contractor from seeking a Level 2 certification assessment from a C3PAO before its contracts require one. The phase-in schedule sets when the requirement applies, not when an organization may start. The decision is therefore a trade-off between earlier evidence and a clearer baseline on one side and spending on an assessment that no contract currently asks for on the other. An early assessment can show where the 110 requirements of NIST SP 800-171 Rev. 2 stand, which gaps are real, and whether the system security plan and scope match what the environment actually does. Those findings are useful whatever happens to the schedule, because the Department of War has said it will enforce Rev. 2 in the interim.
The cost side is equally concrete. A certification assessment is paid for by the contractor and requires a clean scope, final documents and evidence the assessor can test. If the organization is not ready, it pays for a failed or partial result and then pays again to repeat the work. Before committing, ask the C3PAO for a written scope, the assessment method it will use, what it expects to see in final form, and how a re-evaluation would be priced. Ask a readiness provider or consultant to run an internal mock assessment first, and keep consultant preparation separate from the assessor's own work, since an assessor cannot also have prepared the environment it tests.
Some contractors may hold an existing result. Under 32 CFR 170.20, a Final Level 2 (C3PAO) status, valid three years from the original assessment date, is available to contractors that scored a perfect 110 with no open POA&M on a DCMA DIBCAC High Assessment conducted before 16 December 2024. Eligibility depends on the exact assessment record, scope and date, so confirm it with the assessor and with the DoW CIO guidance before relying on it. If the status applies, the assessor can document how the earlier result carries over. If it does not, the organization should plan a full assessment on the current scope and treat any prior DIBCAC report as evidence of baseline maturity only.
CMMC timeline questions buyers ask
Is CMMC certification required for my contracts right now?
Not automatically. Under the current position, the Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I obligations remain in place: Level 1 or Level 2 self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations. Whether a given solicitation or contract names a level depends on the requiring activity, so check the contract language and ask your contracting officer which level applies. The DoW CIO 'About CMMC' page is the place to confirm current status, because the eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule.
What did the 2026 suspension change for defense contractors?
It paused the step that would have made Level 2 C3PAO certification a routine contract requirement. The Class Deviation 2026-O0025, Revision 3 dated 3 September 2026, lets requiring activities specify Level 1 (Self) or Level 2 (Self) assessments and directs contracting officers to remove or revise affected CMMC requirements in solicitations and existing contracts. It does not remove the baseline. The deviation cites the 13 July 2026 memorandum as requiring NIST SP 800-171 Rev. 2 compliance under DFARS 252.204-7012, which has applied since 31 December 2017. A 60-day review by the CMMC Reform Task Force is also underway, so the requirements may change again. Plan your evidence and System Security Plan now, and treat any certification decision as a business choice until the review concludes.
When does the 2028 CMMC clause date apply to my contracts?
Under the same deviation, DFARS 240.371-5 keeps the original clause schedule. Until 9 November 2028, clause 252.204-7021 enters a contract only when the program office or requiring activity specifies a CMMC level. From 10 November 2028, the clause applies whenever contractor systems will process, store or transmit Federal contract information or CUI, except for contracts solely for commercial off-the-shelf items. The 2028 date is therefore the point where CMMC becomes a default expectation across covered work. Ask your contracting officer whether a clause is already in your award or option, and map the systems that will handle FCI or CUI so you know what the clause would reach.
What work should a readiness partner do before the timeline is clear?
Much of the work does not depend on the date. A readiness partner can help define the systems and people that handle FCI or CUI, document the boundary, map each NIST SP 800-171 Rev. 2 requirement to an owner and a current control, and collect evidence in its final form. These tasks serve both a Level 2 self-assessment and a later certification assessment. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for assessment. It does not issue assessment results or certificates. Those come from an independent C3PAO. Ask for a written scope that separates preparation tasks from assessment decisions.
How much NIST SP 800-171 work should I plan for while the timeline is uncertain?
Plan for the full Level 2 requirement set, since the CMMC Level 2 requirements are identical to NIST SP 800-171 Rev. 2 and total 110 requirements. The main drivers of effort are how many systems and enclaves handle CUI, how much of the environment is already controlled, whether external service providers are involved, and how much documentation exists. Where your scope is small, the work is mostly documentation and configuration. Where it is large, the work includes access control, logging, encryption and vulnerability management across many assets. Ask any partner for an effort estimate tied to a named scope, and ask which parts are one-time and which recur, such as annual affirmation and evidence upkeep.
Can my team run CMMC preparation ourselves?
Often yes for a Level 1 or Level 2 self-assessment, if your engineers and compliance staff can read the NIST SP 800-171A assessment objectives and produce final evidence for each one. The work is demanding because a requirement counts as met only when all applicable objectives are satisfied with evidence in final form, not drafts. Internal teams usually need time for scoping, System Security Plan writing, configuration changes and evidence collection alongside their normal duties. Consider outside help where the environment is complex, where you lack staff who have run a formal assessment, or where you want an independent check before a certification assessment. Keep the roles clear: your organization owns the controls, and only an independent assessor issues a certification.
How DeployOpen plans CMMC work around the schedule
DeployOpen plans CMMC work around the rule dates that apply to your contracts, not around a single deadline. We scope and build the self-hosted systems and evidence your organization needs now, and we keep the work reusable if a requiring activity later specifies a higher level. DeployOpen prepares systems and evidence only; independent assessors issue any reports or certificates.
How we scope
- Written scope confirms which CMMC level your current solicitations and contracts require, based on documents you provide.
- Scope covers the systems, enclaves and external services that handle FCI or CUI, with the boundary agreed before work starts.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work begins.
How we build
- We implement and harden self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- Configuration, logging, access and encryption controls are mapped to the NIST SP 800-171 Rev. 2 requirements your contracts reference.
- Security testing of in-scope applications and infrastructure checks that controls work before any self-assessment is recorded.
How we hand over
- You receive system security documentation, policies and evidence records in the form your assessor or contracting officer will review.
- Runbooks explain how to refresh evidence, update the System Security Plan and track any plan of action items your contracts allow.
- Handover sessions walk your staff through the controls, so your team owns them after the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers when the schedule changes or contracts shift levels.
- We can revisit scope and evidence when the Department of War issues new rules, class deviations or clause dates that affect your work.
- Confirm with your contracting officer, and with an independent assessor where needed, which rule dates apply to your contracts before you commit.
