Short answer: CMMC Phase II is on hold, but the Department of War says "All Phase I self-assessment requirements remain firmly in place," and your primes may still ask you to prove you are ready. (DoW)
What changed on July 13
On July 13, 2026, the Department of War suspended the CMMC Phase II requirements that were due to start on November 10, 2026. It also started a 60-day study of the program, run by a CMMC Reform Task Force that was to report to the DoW CIO. (DoW Office of Industrial Base Growth)
The SBA welcomed the move as relief for small firms. (SBA)
As of September 25, the task force's recommendations had not been made public. (Vigilant)
What this means for a small shop
- Your primes may not have paused. Secureframe reports that primes were already asking suppliers to prove Level 2 readiness, and that existing supplier deadlines "may still be in place." (Secureframe) Ask your prime in writing what they expect.
- A plan is not a control. Under the official scoring method, a plan of action for a missing requirement earns no points. The one exception is a temporary deficiency with an adequate plan of action. (DoD Assessment Methodology v1.2.1)
- Check your own contract. What your contract requires is set by the clauses in it, not by news coverage, including this post.
How the SPRS score works
The scoring starts at 110. For each of the 110 requirements you have not met, you subtract its value: 5, 3 or 1 points. The score can go below zero. (DoD Assessment Methodology v1.2.1)
A worked example. Say a 12-person machine shop has everything in place except:
| Gap | Requirement | Points off |
|---|---|---|
| No MFA for any user | 3.5.3 | 5 |
| Encryption on, but not FIPS-validated | 3.13.11 (partial) | 3 |
| No audit logs kept | 3.3.1 | 5 |
| External connections not controlled | 3.1.20 | 1 |
That shop scores 110 − 14 = 96. Turning on MFA for every user is worth 5 points; MFA for only remote and privileged users still costs 3. (DoD Assessment Methodology v1.2.1)
Check your own number
Our free SPRS Score Estimator walks the 110 requirements in your browser. Nothing you tick leaves your browser unless you choose to email yourself a result. It shows your estimated score, the points you lose by family, and what it takes to close the gap.
What to do this month
- Re-run your self-assessment and confirm the date of the score in SPRS.
- Keep your system security plan current; the methodology requires one, and without it the assessment can't be completed.
- Ask each prime, in writing, whether its supplier requirements changed after July 13.
- Watch for the task force's findings before you buy a third-party assessment, unless your prime or contract already requires one.
When will we know more?
As of September 25, no task force report had been released. (Vigilant) When we checked on October 19, Secureframe's tracker still listed the report as unreleased. (Secureframe) Peak InfoSec (last updated August 20) had named mid-October 2026 as the earliest it expected anything formal, with "a substantial chance" of nothing until late 2026 or early 2027. (Peak InfoSec) Plan as if the current rules hold.
This post is general information, not legal advice. Check the clauses in your contract and talk to your counsel or your local APEX Accelerator.
Last verified: 2026-10-19.