The date defense contractors had circled for CMMC Phase II is no longer the operative date. On July 13, 2026, the government suspended Phase II immediately and began a 60-day program review. The November 10, 2026 start that had been written into the phased rollout is therefore historical context, not a current deadline. No replacement date has been announced.
This article explains the status change. For the operational case against pausing readiness work, read CMMC Phase II Is Suspended: Why Contractors Should Not Wait.
The current status in one paragraph
The official announcement suspended Phase II while the Department reviews the program for 60 days. The implementation memorandum directs contracting officers to remove Level 2 C3PAO and Level 3 DIBCAC status requirements associated with Phase II from affected solicitations and contracts during the pause. Phase I continues, so Level 1 Self and Level 2 Self may still be designated. Existing NIST SP 800-171 Revision 2 and DFARS 252.204-7012 obligations remain enforceable.
Why November 10, 2026 used to matter
CMMC is built from two related rules. The program rule at 32 CFR Part 170 defines levels, assessment types, scoring, affirmations, and the conditions for a Plan of Action and Milestones. The acquisition rule brings a required CMMC status into solicitations and contracts through DFARS.
The acquisition rollout began with Phase I on November 10, 2025. Phase II had been scheduled to begin one year later and expand the use of Level 2 certification assessments by C3PAOs, with contracting-officer discretion under the rule. The July 13 action interrupted that schedule before Phase II began.
That history still matters when reading old guidance, contracts, and board materials. It does not support saying that November 10, 2026 remains the deadline today.
Suspended is not the same as extended
An extension moves a deadline to a later date. A suspension pauses the requirement without necessarily naming what comes next. The announcement opened a 60-day review but did not promise that Phase II would begin when those 60 days end, nor did it publish a replacement date.
The careful statement is: Phase II is suspended pending review, and contractors should monitor the official CMMC program page and their acquisition documents for the next instruction. Any more specific timeline is speculation until the government publishes it.
What contracting officers are changing
During the suspension, the implementation memo limits CMMC designations to Phase I assessment types: Level 1 Self and Level 2 Self. It directs contracting officers to remove Level 2 C3PAO and Level 3 DIBCAC status requirements that entered affected solicitations or contracts through the planned Phase II path.
That does not mean every contract is identical. Contractors should review each solicitation, modification, and flow-down on its own terms and ask the contracting officer when the designation is unclear. A press release is not a substitute for the language governing an award.
What remains in force
Phase I remains. So do the underlying duties to protect CUI. The Department expressly said it will continue enforcing existing cybersecurity requirements, including DFARS 252.204-7012 and the NIST SP 800-171 Revision 2 baseline.
Level 2 still maps to the 110 requirements of NIST SP 800-171 Revision 2. Teams preparing at assessment-objective depth work through the 320 determination statements in NIST SP 800-171A, attach evidence to the environment in scope, and reconcile that evidence with the System Security Plan. An honest SPRS baseline remains useful under Phase I and gives leadership a much better planning signal than an assumed certification date.
What to watch after the review
The review could change timing, rollout mechanics, acquisition language, program administration, or the mix of contracts that require each assessment type. Those are possibilities, not announced outcomes. Watch primary government sources for a dated decision, an implementation memo, or a rule change; then update contract plans from the text that actually applies.
In the meantime, avoid two opposite errors. Do not rush a C3PAO engagement because an old November deadline remains in a project plan. Do not freeze the readiness program as though CUI protection and Phase I disappeared. Scope the boundary, calculate the score, close durable control gaps, and build an evidence history that remains useful under either self-assessment or certification.
Where Valty fits, honestly
Valty is not a C3PAO and does not certify contractors. It supports readiness by mapping source-linked evidence to NIST SP 800-171A objectives, calculating an indicative SPRS view, tracking gaps, and assembling OSCAL assessment artifacts. Those outputs can help a contractor prepare and stay honest about missing evidence; they are not an authorization, a government submission, or legal advice. See the CMMC readiness overview and the federal and regulatory capability for the full workflow.
If you want the same spine as a labeled artifact, inspect the sample proof. If you want Valty on one company, apply as a design partner. The offer is a capacity-capped, one-company sprint, not a self-serve production rollout.
