DIBBS INTELLIGENCE

CMMC Phase 2 is suspended. What a DLA supplier still owes.

Published August 26, 2026 · Updated October 16, 2026

Prefer to start with your award record? Get your free award review.

The Department of War suspended CMMC Phase 2 assessment requirements on 13 July 2026, and the suspension is easy to read as "the cybersecurity rules are off." They are not. DIBBSFlow reviewed the suspension memo coverage and the underlying DFARS clauses on 26 August 2026: what stopped is the third-party certification assessment that was due to start appearing in contracts on 10 November 2026. What continues, unchanged, is every self-assessment, every SPRS score, and every safeguarding obligation you already had. If you sell on DIBBS, the practical answer is that your obligations today are the same as your obligations in June.

What actually changed on 13 July?

The Department of War suspended Phase 2 of the CMMC implementation timeline and stood up a CMMC Reform Task Force to run a 60-day review, taking industry feedback through a public request for information. Reporting on the decision points to cost data from the Small Business Administration showing that compliance expense was pushing smaller companies out of the defense industrial base, which is the same pressure DLA suppliers have been describing for two years.

The task force's 60-day review reached its deadline on 11 September 2026. As of 16 October 2026, its report had not been made public, and Class Deviation 2026-O0025 Revision 3, signed 3 September 2026, keeps the suspension in force: contracting officers are to remove or revise the Phase 2 requirements in new and existing solicitations and contracts, while requiring activities may keep Level 1 and Level 2 self-assessments. A contract that still carries a Phase 2 requirement should expect an amendment or modification; the self-assessment, SPRS and DFARS 252.204-7012 obligations are the part the deviation leaves in place.

What is suspended?

One thing: the certification assessment performed by somebody other than you.

Level 2 certification assessments by a C3PAO are suspended.
Level 3 assessments by DIBCAC are suspended.
The phase-in of those requirements into new contracts, scheduled to begin 10 November 2026, is on hold.

If you were budgeting for a third-party assessment this autumn to stay eligible for work, that specific spend is paused. That is the whole of the relief.

What still applies?

This is the part being misread, so it is worth being plain. Phase 1 is not suspended. The clauses already in your contracts are not suspended.

DFARS 252.204-7012. You remain contractually obligated to safeguard covered defense information, to implement NIST SP 800-171 as adequate security, to report cyber incidents to DIBNet within 72 hours, and to flow the clause down to your subcontractors.
DFARS 252.204-7019 and 252.204-7020. Self-assessment, posting your score in SPRS, and providing the government access for its own assessment all continue. 7019 still conditions award on having a current assessment score in SPRS.
Level 1 self-assessment and annual affirmation for federal contract information. Still required.
Level 2 self-assessment and annual affirmation for controlled unclassified information. Still required. It is the third-party verification of that self-assessment that stopped, not the self-assessment.

The accuracy expectation on your SPRS score and your annual affirmation is exactly what it was before 13 July. An affirmation is a statement to the government. In June 2026 the Department of Justice announced a $507,144 False Claims Act settlement with a defense contractor over alleged non-compliance with NIST SP 800-171 on Navy contracts [4]. A pause on somebody checking your work is not a pause on the work being true.

Which level applies to a DIBBS supplier?

A company holding a DLA contract handles federal contract information whenever it receives information provided by or generated for the government under the contract and not intended for public release. Purchase orders, delivery schedules and shipping instructions can qualify. Whether Level 1 applies turns on the clauses in your contract and the information you handle, not on being a DIBBS supplier: if the clause is in the contract and you handle that information, Level 1 is the minimum.

The line that catches machine shops and distributors is the next one up. Controlled unclassified information arrives with technical data: the drawings, specifications, and technical data packages you pull to quote a part. If you are requesting drawings through cFolders or TDMT, or holding export-controlled technical data, you are handling a category that carries the higher obligation. A supplier that thinks of itself as Level 1 may be storing Level 2 material in a shared drive, because that is where the drawings landed.

Worth separating two things that get conflated in the same conversation: JCP certification governs your access to export-controlled technical data, and CMMC governs how you protect information once you have it. They are different regimes with different gates. Passing one says nothing about the other.

What should you do before the task force reports?

Nothing dramatic, and nothing you can safely skip.

Check whether your SPRS score is current. If award eligibility depends on it and it has lapsed, that is a live problem today and has nothing to do with the suspension.
Find out where technical data actually lives in your business. Not where policy says it lives. Drawings pulled for a quote three years ago are still somewhere.
Do not cancel remediation work you had already scoped. The requirement did not go away and the review may narrow it rather than remove it. Work already done is not wasted.
Do reconsider the timing of a third-party assessment if that was booked purely for the 10 November date. That date is no longer live.

What has happened since the review deadline?

The review's deadline passed in September and its report had not been made public as of 16 October 2026. What is in force is the 3 September deviation, which carries the pause forward and tells contracting officers to amend active solicitations and modify existing contracts before the next option is exercised. What the report may recommend when it appears (narrowing which contracts carry the requirement, changing the assessment mechanism, adjusting thresholds for smaller suppliers, or restarting the phase-in on a later schedule) is not known. Keep your self-assessment honest and your score current; those obligations are the ones the deviation leaves in place.

Where DIBBSFlow fits, and does not

DIBBSFlow is not CMMC certified, does not assess or certify anyone, and does not provide legal or compliance advice. This page is a plain-language summary of public sources, written because DLA suppliers kept asking and the honest answers were scattered across law-firm alerts. For a determination about your own contracts, your contracting officer and your counsel are the right and only authorities.

What DIBBSFlow does is separate: showing you which DIBBS work fits your business, what the recorded market around it looks like, and where you stand in it.

See DIBBSFlow's DIBBS bidding software for the product line, and DIBBSFlow pricing to compare plans.

Frequently asked questions

Is CMMC cancelled?

No. The Department of War suspended Phase 2 assessment requirements on 13 July 2026 pending a 60-day review. Phase 1 self-assessment obligations, SPRS scores, annual affirmations, and DFARS 252.204-7012 all remain in effect.

Do I still need a Level 1 self-assessment?

Yes. Level 1 self-assessment and annual affirmation for federal contract information were not suspended. A DLA contract that carries the clause and sends you purchase orders, delivery schedules or shipping instructions means you handle federal contract information.

Do I still need to keep my SPRS score current?

Yes. DFARS 252.204-7019 and 252.204-7020 are unaffected, and 7019 still conditions award on a current assessment score in SPRS. A lapsed score can cost you eligibility regardless of the suspension.

What was actually suspended?

Third-party certification assessments: Level 2 assessments by a C3PAO and Level 3 assessments by DIBCAC, plus the phase-in of those requirements into contracts that had been scheduled to begin 10 November 2026.

Does a DIBBS machine shop handle controlled unclassified information?

It can, through technical data. Drawings, specifications and technical data packages pulled through cFolders or TDMT can carry that category. Where the drawings are stored is the question to answer first.

When will we know what happens next?

The review reached its deadline on 11 September 2026; as of 16 October 2026 its report had not been made public. The 3 September deviation is the direction in force; the self-assessment, SPRS and DFARS 252.204-7012 obligations it leaves in place have not changed. This page is rechecked against the Department CIO's program page; the date of the last check is in the Sources.

Sources

Primary documents accessed 16 October 2026; secondary reading accessed 26 August 2026. This page summarizes public reporting and the cited DFARS clauses. It is not legal advice.

Get your free award review

Start with one five-character CAGE code. DIBBSFlow will confirm what the review will cover, the available source context, and the next step before analysis begins.

Get your free award review