CMMC Phase 2 Is Suspended and Now It’s Binding. What Arizona Contractors Should Do.

This story has moved twice and most of the coverage is still describing the first move.

July 13, 2026. The Department of War suspended CMMC Phase 2. The November 10 certification deadline was cancelled, Phases 3 and 4 frozen, and a reform task force launched. That was policy.

September 3, 2026. DFARS Class Deviation 2026-O0025, Revision 3, made it binding regulation. Mandatory third party assessment is suspended through November 2028. Levels 1 and 2 can be satisfied by self assessment. A self attested Conditional status lasts 180 days before converting to Final, which is valid for three years. Contracting officers are instructed to remove third party assessment requirements from contracts.

That second step is the one that matters, and it is the one most firms have not registered.

What did not change

DFARS 252.204-7012 is untouched. All 110 NIST SP 800-171 controls remain fully in force. You still post an SPRS score. The Defense Contract Management Agency retains the right to assess any covered system at any time, and its finding overrides whatever you posted.

So the requirement to be secure did not move. Only the requirement to have someone else confirm it.

What to do with the next two years

Do not stop. The most expensive interpretation of this news is that compliance work can wait until 2028. Two years passes quickly and the work has not shrunk.

Fix your SPRS score now, while nothing is urgent. This is the best window you will get. No deadline, no queue for assessors, no rush pricing.

Understand where enforcement actually sits. It moved to the False Claims Act. Recoveries in cybersecurity cases have more than tripled in each of the last two years, and the cases are typically brought by employees reporting inflated scores. A suspended assessment does nothing about that.

Expect your prime to keep asking. Their audit right comes from your subcontract and never depended on CMMC.

One thing still unresolved

The reform task force finished collecting industry feedback around mid September. Its recommendations are expected to reach contractors in early October. The Department has signalled it wants to move away from point in time assessments toward something more continuous. If that lands, the shape of this changes again, and we will write about it when there is something real to describe rather than speculation.