CMMC Final Rule Timeline: Phases 1–4 and Phase II Suspension

Planned Phased Schedule (32 CFR 170.3(e) Architecture)

Current Suspension (as of September 2026)

DoW announced immediate suspension of CMMC Phase II requirements (originally scheduled to take effect 10 Nov 2026) and held later milestones in abeyance pending programme review. During suspension, Program Managers / requiring activities may designate only:

• CMMC Level 1 (Self) — 15 FAR 52.204-21 basic safeguarding requirements
• CMMC Level 2 (Self) — 110 NIST SP 800-171 Rev 2 requirements

They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) during the suspension period. Existing contract language may still need modification per DoW direction — involve contracts counsel.

What Remains Fully On

• Self-assessments and affirmations when designated
• SPRS posting of assessment results / scores
• DFARS 252.204-7012 safeguarding and 72-hour cyber incident reporting
• Underlying NIST SP 800-171 Rev 2 obligations where 7012 applies

How CyberSilo Helps

• Keep Self-assessment evidence continuous so status does not lapse at option exercise
• Stay C3PAO-ready without assuming a date certain for Phase II restart

Frequently Asked Questions

When did Phase 1 start?

Phase 1 begins on the later of the 32 CFR and 48 CFR effective dates; the DFARS CMMC rule is commonly cited as 10 November 2025.

What did DoW suspend?

Phase II (planned Level 2 C3PAO emphasis around 10 Nov 2026) and later milestones. During suspension only Level 1 (Self) or Level 2 (Self) may be designated.

Can programmes still require NIST 800-171?

Yes. DFARS 252.204-7012 safeguarding and self-assessment obligations were not erased by the Phase II suspension.

Related CMMC Resources

CMMC hub · Assessment process · SPRS · Level 3 · CSA