DLA·CMMC and cyber
Back to DLA Watch

DLA sets no C3PAO requirement before Nov 2027

DLA's FAQ, dated 2026-09-14 on the page and opened 2026-10-21, repeats that on 2026-07-13 the Department announced "the immediate suspension" of Phase II requirements "originally scheduled for November 10, 2026," and says of itself: "This FAQ article is a living document that will be frequently updated." On the deadline question it answers: "DLA may start implementing CMMC Level 2 (C3PAO) in contracts on about November 10, 2027. DLA will not include CMMC Level 2 (C3PAO) in manual solicitations and contracts before November 10, 2027. DLA may include CMMC Level 2 (C3PAO) in automated solicitations and contracts on November 10, 2028." It says "companies with a self-assessment score of 88 to 109 will be given a CMMC L2 conditional self-assessment status," which "will cause the Contracting Officer to complete a risk assessment and obtain concurrence from higher level officials." On dealers: "Being only a dealer/distributor is NOT an exception to this requirement," and the dealer or distributor "will need to" satisfy it.

Key dateNovember 10, 2027milestone
StatusFinal
ConfidenceConfirmed

What changed

DLA's FAQ, dated 2026-09-14 on the page and opened 2026-10-21, repeats that on 2026-07-13 the Department announced "the immediate suspension" of Phase II requirements "originally scheduled for November 10, 2026," and says of itself: "This FAQ article is a living document that will be frequently updated." On the deadline question it answers: "DLA may start implementing CMMC Level 2 (C3PAO) in contracts on about November 10, 2027. DLA will not include CMMC Level 2 (C3PAO) in manual solicitations and contracts before November 10, 2027. DLA may include CMMC Level 2 (C3PAO) in automated solicitations and contracts on November 10, 2028." It says "companies with a self-assessment score of 88 to 109 will be given a CMMC L2 conditional self-assessment status," which "will cause the Contracting Officer to complete a risk assessment and obtain concurrence from higher level officials." On dealers: "Being only a dealer/distributor is NOT an exception to this requirement," and the dealer or distributor "will need to" satisfy it.

What it means for a DIBBS supplier

DIBBSFlow's reading

DIBBSFlow's reading, from the source above, checked 2026-10-21.

for automated solicitations the earliest date DLA names for a C3PAO requirement is 2028-11-10, and its word is "may"; for manual solicitations DLA says it "may start" on about 2027-11-10 and "will not" before then. A conditional self-assessment score of 88 to 109 adds a risk assessment and higher-level concurrence before award, by DLA's description. Dealers and distributors are inside the requirement. The FAQ says it will be updated; this item is tied to the page's date.

Source:DLA Office of Small Business Programs, CMMC Frequently Asked Questions and Answers, dated 2026-09-14 (opened 2026-10-21)· Confirmed onOctober 21, 2026

Change log

  • 2026-10-21: added to the watch; source opened 2026-10-21.
  • 2026-10-21: held, Codex returned FIX; gate run 2026-10-21.
  • 2026-10-21: capture extended to every passage the item rests on and body rewritten to the capture; status restored from Held.
  • 2026-10-21: title shortened to a plain headline (Tony's review of the live cards); facts that left the title stay in What changed.

A public log of rule and deadline changes. DIBBSFlow alerts on your NSNs and CAGEs are a separate product.

<script type="application/ld+json">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What changed?", "acceptedAnswer": {"@type": "Answer", "text": "DLA's FAQ, dated 2026-09-14 on the page and opened 2026-10-21, repeats that on 2026-07-13 the Department announced \"the immediate suspension\" of Phase II requirements \"originally scheduled for November 10, 2026,\" and says of itself: \"This FAQ article is a living document that will be frequently updated.\" On the deadline question it answers: \"DLA may start implementing CMMC Level 2 (C3PAO) in contracts on about November 10, 2027. DLA will not include CMMC Level 2 (C3PAO) in manual solicitations and contracts before November 10, 2027. DLA may include CMMC Level 2 (C3PAO) in automated solicitations and contracts on November 10, 2028.\" It says \"companies with a self-assessment score of 88 to 109 will be given a CMMC L2 conditional self-assessment status,\" which \"will cause the Contracting Officer to complete a risk assessment and obtain concurrence from higher level officials.\" On dealers: \"Being only a dealer/distributor is NOT an exception to this requirement,\" and the dealer or distributor \"will need to\" satisfy it."}}, {"@type": "Question", "name": "What should a DIBBS supplier check?", "acceptedAnswer": {"@type": "Answer", "text": "DIBBSFlow's reading, from the source above, checked 2026-10-21. for automated solicitations the earliest date DLA names for a C3PAO requirement is 2028-11-10, and its word is \"may\"; for manual solicitations DLA says it \"may start\" on about 2027-11-10 and \"will not\" before then. A conditional self-assessment score of 88 to 109 adds a risk assessment and higher-level concurrence before award, by DLA's description. Dealers and distributors are inside the requirement. The FAQ says it will be updated; this item is tied to the page's date."}}]}</script>