CMMC Phase 1
In forceIn force
New DoD solicitations require CMMC Level 1 or Level 2 self-assessments at award, with annual affirmations recorded in SPRS.
Updated whenever DoD announces anything, and reviewed against primary sources even when nothing changes — so a quiet month still tells you something.
Last reviewed
In force
New DoD solicitations require CMMC Level 1 or Level 2 self-assessments at award, with annual affirmations recorded in SPRS.
Under review
DoD suspended the Phase 2 rollout — which would have required C3PAO third-party certification in many awards — and opened a program review. A Reform Task Force report is expected around mid-September 2026.
Active
Safeguarding covered defense information under NIST SP 800-171, plus incident reporting. Unaffected by the Phase 2 suspension.
Required
DFARS 252.204-7019/7020 require a current self-assessment score in SPRS. Primes can and do check it.
72 hours
Cyber incidents affecting covered defense information must be reported to DoD within 72 hours of discovery.
Required
An affirming official must confirm continued compliance each year. Inaccurate affirmations carry False Claims Act exposure.
We separate what is legally binding from what is guidance, our interpretation, or our own recommendation. If a line does not say Legal requirement, do not treat it as one.
Self-assessment and affirmation requirements begin appearing in DoD solicitations.
DoD pauses the third-party certification rollout and opens a program review.
Comment window for the program review closes.
Reform Task Force expected to report. Timing and content are not guaranteed.
Keep going. Nothing that was required of you stopped being required. The suspension changed how compliance may eventually be verified, not what you have to do.
Worth restarting. Your DFARS obligations never paused, your SPRS score is still visible to primes, and affirmation exposure is unchanged.
The Task Force report may adjust timelines or assessment mechanics. It is unlikely to remove the underlying NIST SP 800-171 obligation, which predates CMMC entirely.
Secondary analysis, cited because it is well sourced. The controlling documents are the CFR, DFARS and your own contract.
We update this page and tell clients directly whenever the program state changes.