What the memo actually says.
On July 13, 2026, the Department of War suspended the CMMC Phase II requirements that were scheduled to take effect November 10, 2026, along with pending and future CMMC implementation milestones, and launched a 60-day comprehensive review of the program under a CMMC Reform Task Force.
- For the duration of the review, program managers may designate only Level 1 (Self) and Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) designations are not permitted, and no waivers will be granted.
- Solicitations that already carry C3PAO or DIBCAC requirements are being amended; existing contracts get modified at the next option exercise or scheduled administrative modification.
- Level 2 (Self) requires a minimum SPRS score of 88 out of 110.
- The Task Force report is due on or about September 13, 2026. Expect further guidance then — including whether and how third-party assessment returns.
What did not change.
Every safeguarding obligation survives the suspension intact. DFARS 252.204-7012 still applies. NIST SP 800-171 Rev 2 implementation is still mandatory. Your SPRS score still has to be current, and the annual affirmation — signed by a named Affirming Official — remains in force. In the department's own words: the standards are not being relaxed.
Read that affirmation requirement carefully. A self-assessment score submitted to SPRS and affirmed by an executive is a representation to the government. Overstated scores have already produced False Claims Act settlements in the DIB. The suspension of third-party assessment does not reduce that exposure — it concentrates it on the accuracy of your own self-assessment.
The assessor is now you.
Under Phase II as originally scheduled, a C3PAO would have examined your evidence and graded your implementation. During the review period, that scrutiny doesn't disappear — it moves. Primes flowing down requirements, contracting officers evaluating SPRS scores, and DOJ enforcing signed affirmations all look at the same question: can you show your work?
That makes the quality of your evidence the whole game. A score of 88 backed by collected, timestamped, hashed artifacts is a defensible representation. The same score backed by a spreadsheet somebody updated the night before submission is a liability with a signature on it.
What to do during the review.
- Keep implementing 800-171. The requirement never paused, and the Task Force could restore third-party assessment with little runway.
- Get your SPRS score above 88 — honestly. The floor is now a condition of Level 2 designation, not a nice-to-have.
- Make your affirmation defensible. Evidence collected continuously beats evidence assembled annually, every time someone asks how you got your number.
- Don't abandon C3PAO prep. If you were mid-engagement, the work transfers directly to the self-assessment tier — and positions you first in line if certification returns in September.
FORCE's position.
FORCE was built for exactly this posture: automated evidence collection across your cloud and identity stack, findings and attestations tied to every 800-171 control, an SPRS package generated from the live evidence chain, and an assessment view that shows where you stand against the 88/110 floor. Self-assessment first, C3PAO-ready when the era resumes. See how FORCE handles CMMC Level 2 →
We'll update this page when the Task Force reports in September.