CMMC Compliance CheckCMMC status: where the rollout stands
Last checked on 1 October 2026. This page is updated when the position changes; the date above is the date of the last check.
In effect
- The CMMC Program rule, 32 CFR Part 170, CMMC Program (eCFR), in force since December 2024.
- Phase 1, since 10 November 2025: contracts can require Level 1 (Self) or Level 2 (Self), with results in SPRS and annual affirmations.
- DFARS 252.204-7012 and NIST SP 800-171 Rev 2 for CUI, which applied before CMMC and still apply.
Suspended
- Phase 2: on 13 July 2026 the Department issued a memorandum suspending Phase 2, which was to start on 10 November 2026 and require C3PAO Level 2 certification for many CUI contracts.
- A CMMC Reform Task Force review followed; its report was due to the DoD CIO on 11 September 2026 and had not been published when we checked (Covington, CMMC Reform Task Force updates, September 2026).
- No new Phase 2 date has been announced.
What it means for you
Self-assessment requirements still apply where a contract includes them, and the NIST SP 800-171 requirements have applied to CUI since well before CMMC. Contractors who were preparing for a C3PAO assessment lose nothing by continuing: the requirements, the scoring method and the POA&M rules in 32 CFR Part 170 have not changed.