What you’ll learn in this article…
- CMMC Phase 2 is suspended, but NIST SP 800-171 self-assessment continues.
- The Task Force report due September 11, 2026 remains unpublished.
- Employers now favor NIST and DFARS fluency over Level 2 certification prep.
On July 13, 2026, the Department of War suspended CMMC Phase 2, scheduled to start November 10, 2026. That suspension did not remove underlying cybersecurity requirements: contractors still self-assess to NIST SP 800-171 Rev. 2, maintain SPRS status, and follow DFARS 252.204-7012.
The pause matters for two audiences: defense contractors deciding what remains enforceable during the review, and cyber students and people making a cybersecurity career change deciding which skills to learn while the assessment market shifts. A September 2026 Inside Government Contracts update framed the task force's review as balancing compliance burden reduction with audit-ready security across the Defense Industrial Base.
CMMC Reform Task Force: Where Things Stand in October 2026
Confirmed Timeline and Dates
The CMMC Reform Task Force was created by the Department of War's July 13, 2026 memorandum, the same action that suspended Phase 2, which was originally scheduled to start November 10, 2026. The Task Force convened in early September 2026 to review more than 1,100 responses to the Department's Request for Information on reducing compliance burdens. Its report was due to DoW Chief Information Officer Kirsten Davies on September 11, 2026.1 These dates are documented by the Department of War's public CMMC page and Inside Government Contracts' September 21, 2026 update.
What Is Still Unknown
As of October 17, 2026, the Task Force report has not been made public.1 DoW's cmmc certification page still notes the July 13 suspension and that Phase 1 self-assessment remains in place, but it does not announce a report release date. Inside Government Contracts reports that the report was not public as of September 21, and no later public release has been confirmed by mid-October. At the Billington Cybersecurity Summit on September 9, CIO Davies said more than half of the comments supported the Phase 2 suspension, and that third-party assessors raised questions about how DoW would confirm compliance. Yet the contents of the final recommendations, whether Davies formally received a completed report on September 11, and what policy changes might follow all remain unknown. For now, treat the report itself as pending, not published.
What the Phase 2 Suspension Actually Means
What would CMMC Phase 2 actually have required, and does the suspension remove the November 10, 2026 deadline?
Before the July 13, 2026 Department of War memorandum, Phase 2 was scheduled to begin November 10, 2026. Contractors handling Controlled Unclassified Information (CUI) on eligible DoW contracts would have needed a third-party C3PAO assessment and a resulting CMMC Level 2 certification through CMMC certification services as a condition of award. The memorandum suspended that start immediately. It also placed Phases 3 and 4 on hold pending further notice and created the CMMC Reform Task Force for a 60-day top-to-bottom review of the entire program.
The accompanying Request for Information asked industry for input on several areas that shaped the review: - Assessment scope - Cloud and managed service providers - Supply chain implementation - Operational technology and other specialized environments.2
The certification deadline is paused, but the security requirements are not. Contractors still owe self-assessment against NIST SP 800-171 Rev. 2, current SPRS status and affirmation, and DFARS 252.204-7012 compliance. Phase 1 self-assessment requirements remain in place during the suspension. In other words, the suspension changes when certification becomes a contract condition; it does not remove the obligation to protect CUI now. That means new entrants should keep building NIST 800-171 and DFARS fluency, a core part of skills-based cybersecurity hiring, rather than waiting for the next certification milestone.
What Contractors Still Have to Do During the Pause
Even with the Phase 2 pause, contractors still face enforceable cybersecurity obligations. The requirements below remain in effect, and the paused piece is the mandate to obtain a CMMC Level 2 third-party certification as a condition of award.
| Obligation | Where It Comes From | Still Enforced During the Pause? | What Contractors Should Do Now |
|---|---|---|---|
| DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting) | Standard DoD contract clause, reaffirmed by the DoW CIO July 2026 suspension memorandum. | Yes. The clause continues to apply during the suspension. | Continue protecting covered defense information and comply with cloud security, cyber incident reporting, and media preservation obligations. |
| NIST SP 800-171 Rev. 2 self-assessment (CMMC Level 1 Self or Level 2 Self) | DoW CIO memorandum directing enforcement through self-assessments during the pause; Phase I requirements. | Yes. All Phase I self-assessment requirements remain in place. | Perform the applicable Level 1 (Self) or Level 2 (Self) assessment, maintain assessment information, and keep results current. |
| SPRS current status and self-assessment affirmation | DFARS 252.204-7019 and DFARS 252.204-7020, as applied to CMMC self-assessment results. | Yes. Contractors must maintain current CMMC status and submit an annual affirmation of continuous compliance. | Enter current self-assessment results in SPRS, keep status current during contract performance, and submit the annual affirmation signed by a senior executive. |
| DoW-led assessments (selected government review) | DoW CIO July 2026 memorandum permitting select government-led assessments while prohibiting new C3PAO or DIBCAC assessment requirements. | Select government-led assessments may still occur; new procurement requirements may include only Level 1 Self or Level 2 Self. | Maintain evidence of NIST SP 800-171 Rev. 2 implementation and accurate self-assessment information; do not assume the pause eliminates government review. |
Will Phase 2 Be Eliminated? What the RFI Signals
No outcome is confirmed yet. The CMMC Reform Task Force's report was due to the Department of War's Chief Information Officer on September 11, 2026, and has not been made public as of this writing.
What the RFI evidence shows
The task force convened in early September to consider more than 1,100 comments from the Request for Information, according to DefenseScoop's Pentagon Pores Over Heaps of Industry Feedback on CMMC Reform. At the Billington Cybersecurity Summit on September 9, DoW CIO Kirsten Davies said, "More than 50% of the respondents were in favor of us putting this on hold and seeking some level of reform." She also described CMMC as hitting small-to-medium businesses "really, really hard and inappropriately hard." Separately, third-party assessor concerns centered on how DoW would confirm compliance with federal cyber requirements after the suspension.
Three plausible paths
- Eliminated: Phase 2's third-party attestation disappears, and Phases 3 and 4 never activate in their original form.
- Delayed: The November 10 start date shifts again1, possibly with revised thresholds or pilots while Phases 3 and 4 remain on hold.
- Redesigned: DoW keeps some third-party validation but narrows scope for small contractors, OT, and cloud or managed service providers, then rebuilds Phases 3 and 4 around that.
Until the report is public, treat the pause as a window to improve self-assessment readiness, not an end to DFARS and NIST security compliance obligations.
Related Articles
How the Pause Reshapes Cyber Hiring
Are CMMC compliance jobs , essentially GRC cybersecurity jobs in the defense industrial base , still in demand after the Phase 2 pause? The short answer is yes, but the center of gravity has shifted. Coverage from Fidelity1, CSIS2, and Inside Defense suggests cybersecurity workforce demand is not evaporating; it is moving away from one-time third-party assessment prep toward persistent hands-on compliance work.
The clearest pressure point is on C3PAOs and certified assessors. Phase 2 would have required third-party assessments for contracts involving controlled unclassified information, and some assessment firms had already reported waitlists of 6 to 12 months. With Phase 2 suspended, those pipelines are uncertain, and industry discussions point to C3PAOs exploring adjacent services such as penetration testing, red teaming, continuous monitoring, and risk scoring. For people aiming at assessor-track roles, that means less predictable near-term demand and a stronger case for keeping broader security skills current.
The underlying compliance obligation continues regardless of the pause. Contractors must implement NIST SP 800-171 Rev. 2 controls, maintain current SPRS affirmations, and meet DFARS 252.204-7012 requirements, including cloud security, cyber incident reporting, and media preservation.3 OT security is also part of the specialized environments DoW asked about in the reform RFI. The honest caveat: no official hiring metric yet confirms how many roles this creates, and the pending Task Force report could change the picture again. But the work itself has not been suspended.
What Related Cyber Roles Pay
These are broad national occupational wages, not CMMC specific titles. The figures come from the U.S. Bureau of Labor Statistics Occupational Employment and Wage Statistics for 2025, so treat them as approximate. They align with the persistent defense adjacent compliance roles discussed above, but they do not reflect CMMC specific pay.
| Occupation | Total Employment | Mean Annual Wage | 25th Percentile | Median Annual Wage | 75th Percentile |
|---|---|---|---|---|---|
| Network and Computer Systems Administrators | 314,340 | $103,680 | $78,010 | $99,130 | $126,640 |
| Computer and Information Systems Managers | 670,570 | $192,160 | $138,060 | $175,140 | $220,730 |
| Information Security Analysts | 190,650 | $132,510 | $97,810 | $129,180 | $163,500 |
