CMMC Phase 2 transition stays suspended
The DoD CIO attachment dated 2026-07-13 states that "during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments," and that "the cybersecurity requirements outlined in the clause at DFARS 252.204-7012 ... remain in effect." It says "the upcoming November 2026 transition to Phase 2 of CMMC implementation is suspended," that program managers "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period," and that "the allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self)." Under "Immediate Relief on Current Solicitations and Contracts," program managers "must initiate amendments to active solicitations" that included a C3PAO or DIBCAC requirement, contracting officers "must issue a corresponding solicitation amendment as soon as practicable," and existing contracts are to have those requirements removed by modification. Under "Suspension of Waiver Procedures," "no waivers shall be granted during the review." The DoD CIO CMMC page says the suspension was announced 2026-07-13 for requirements "originally scheduled for November 10, 2026" and that "all Phase I self-assessment requirements remain firmly in place."
What changed
The DoD CIO attachment dated 2026-07-13 states that "during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments," and that "the cybersecurity requirements outlined in the clause at DFARS 252.204-7012 ... remain in effect." It says "the upcoming November 2026 transition to Phase 2 of CMMC implementation is suspended," that program managers "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period," and that "the allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self)." Under "Immediate Relief on Current Solicitations and Contracts," program managers "must initiate amendments to active solicitations" that included a C3PAO or DIBCAC requirement, contracting officers "must issue a corresponding solicitation amendment as soon as practicable," and existing contracts are to have those requirements removed by modification. Under "Suspension of Waiver Procedures," "no waivers shall be granted during the review." The DoD CIO CMMC page says the suspension was announced 2026-07-13 for requirements "originally scheduled for November 10, 2026" and that "all Phase I self-assessment requirements remain firmly in place."
What it means for a DIBBS supplier
DIBBSFlow's reading
DIBBSFlow's reading, from the source above, checked 2026-10-21.
a solicitation may still carry a Level 1 (Self) or Level 2 (Self) requirement, and the NIST SP 800-171 Rev 2 duty under DFARS 252.204-7012 is stated as remaining in effect, alongside select Government-led assessments. A solicitation or contract that carried a C3PAO or DIBCAC requirement is to be amended or modified to remove it. If one of yours still shows it, the memo's direction is to the contracting officer; the date to cite is 2026-07-13.
Change log
- 2026-10-21: added to the watch; source opened 2026-10-21.
- 2026-10-21: held, Codex returned FIX; gate run 2026-10-21.
- 2026-10-21: capture extended to every passage the item rests on and body rewritten to the capture; status restored from Held.
- 2026-10-21: title shortened to a plain headline (Tony's review of the live cards); facts that left the title stay in What changed.
A public log of rule and deadline changes. DIBBSFlow alerts on your NSNs and CAGEs are a separate product.
Get the weekly watch
One short email a week with what moved, what is coming up and what it means for a DIBBS supplier. No sales follow-up.