CMMC Phase Two Is Still Suspended. Here’s What A&D Manufacturers Need to Know Now

CMMC Phase II is still suspended as of September 2026. The July 13 action stopped the planned November 10 rollout of Level 2 third-party C3PAO assessments, but it did not suspend Phase I self-assessments or the underlying cybersecurity obligations that apply through DoW contracts.

The 60-day reform-review window has now ended. The Department’s public CMMC pages still show implementation paused in Phase I, with Level 1 and Level 2 self-assessments in use and NIST SP 800-171 Rev. 2 enforced through self-assessments and select government-led assessments.

For an aerospace or defense manufacturer, the practical question is no longer whether to race toward a November C3PAO date. It is whether the systems that process, store, or transmit FCI or CUI can support the self-assessment, evidence, access controls, and documentation required by the contracts you hold today.

Key Takeaways

• Phase II remains suspended. The November 10, 2026 expansion of Level 2 C3PAO assessment requirements did not take effect on schedule, and DoW’s current public guidance still says CMMC implementation is paused in Phase I.
• Phase I did not disappear. For applicable solicitations and contracts, DoW can still require CMMC Level 1 (Self) or Level 2 (Self) status.
• DFARS 252.204-7012 still applies where it is in the contract. DoW says the suspension does not eliminate the requirement to protect covered defense information in accordance with that clause.
• Level 2 self-assessment still means the full 110 NIST SP 800-171 Rev. 2 requirements, a triennial self-assessment, annual affirmation, and—when permitted—a 180-day window to close eligible POA&M items.
• The pause changes the verification path, not the evidence problem. If CUI touches ERP, PLM, file storage, email, integrations, or support workflows, the assessment boundary and the controls around those systems still have to be defensible.
• The next policy step is not public yet. Contractors should separate what is enforceable now from what might change later and avoid building a compliance roadmap around speculation.

Is CMMC Phase Two Still Suspended as of September 2026?

Yes. DoW announced the immediate suspension of CMMC Phase II on July 13, 2026. Phase II had been scheduled to begin on November 10, 2026 and would have expanded the use of Level 2 certification assessments performed by C3PAOs.

DoW’s current CMMC page states that implementation remains paused in Phase I and that all Phase I self-assessment requirements remain in place. The same page says the Department will enforce NIST SP 800-171 Rev. 2 during the pause through self-assessments and select government-led assessments.

The original 60-day review period has passed, so language such as “the task force is due to report within 60 days” is now stale. Until DoW publishes a revised framework or new implementation direction, the useful planning baseline is the policy that is public today: Phase I self-assessment continues; Phase II third-party expansion remains suspended.

What Changed and What Did Not

What Phase I Requires for Applicable Contracts

Phase I is not one universal requirement for every defense supplier. The required CMMC level is tied to the information involved and the requirement written into the solicitation or contract. During the suspension, DoW says program offices may use Level 1 (Self) or Level 2 (Self).

For Level 2 (Self), DoW’s current guidance lists 110 NIST SP 800-171 Rev. 2 security requirements. The organization performs the self-assessment every three years, records the result in SPRS, and submits an affirmation after the assessment and annually thereafter.

A conditional Level 2 (Self) status is limited to 180 days. Eligible unmet requirements may be carried on a POA&M only under the limits in 32 CFR 170.21, and they must be closed within that window to reach final status.

The current DFARS clause also defines Final Level 2 (Self) status as valid for three years, with an affirmation of continuous compliance no older than one year.

The Suspension Did Not Remove DFARS 252.204-7012

For covered contractor information systems, DFARS 252.204-7012 continues to require the security controls incorporated by the clause, cyber-incident reporting, and flowdown where the clause applies. DoW’s CMMC guidance explicitly says the Phase II suspension does not eliminate that obligation.

Acquisition.gov’s current clause text states that covered contractor information systems are subject to the applicable NIST SP 800-171 security requirements and also contains requirements for cyber-incident reporting and subcontract flowdown.

That distinction is important for ERP planning. CMMC is the assessment framework; DFARS 252.204-7012 is one of the contractual sources of the safeguarding obligation. Pausing one assessment phase did not erase the contract clause.

Why DoW Paused the Third-Party Rollout

The public rationale centered on small-business cost, assessor capacity, and access to the defense industrial base. GAO reported in March 2026 that DoW relies on about 200,000 private companies and had not fully addressed the risk that the private assessment ecosystem might not have enough capacity to support implementation.

GAO reported that The Cyber AB had authorized 92 C3PAOs as of December 2025. SBA later said more than 120,000 DIB small businesses would have needed to seek compliance under the planned Phase II rollout through a system supported by about 100 approved assessors.

SBA’s July 2026 analysis estimated total compliance costs of about $593,800 for small firms requiring third-party certification and about $388,600 for firms eligible for self-assessment. Those are SBA estimates and should not be conflated with the narrower assessment-and-affirmation cost assumptions in the 2024 final rule.

For comparison, the 2024 CMMC final rule estimated a three-year cost of $37,196 for a Level 2 self-assessment and affirmation for a small entity, and $104,670 for a Level 2 C3PAO certification assessment and affirmations. Those figures assume the underlying NIST SP 800-171 controls are already implemented, so they are not an estimate of the full cost of becoming compliant from scratch.

What the Pause Means for Your ERP and CUI Boundary

For an A&D manufacturer, the compliance question is not “Is our ERP CMMC certified?” CMMC status applies to the contractor information system in scope, not to a software product by itself.

If CUI moves through ERP, PLM, quality, file storage, integrations, support tools, or administrative workflows, those components may affect the assessment boundary. The control evidence has to match the environment that actually processes, stores, or transmits the information.

This is where a pause can be useful operationally. Instead of optimizing for an assessment date that is no longer on the calendar, teams can test whether access control, account lifecycle, logging, configuration, incident response, media handling, data flows, and supporting documentation agree with the SSP and with what employees actually do.

What Aerospace and Defense Manufacturers Should Do Now

The useful work during the suspension is the work that remains valuable under any future assessment model: know which requirements are in your contracts, keep the self-assessment honest, and make the system boundary and evidence defensible.

• Check the contract before the roadmap. Confirm which DFARS and CMMC clauses, levels, and status requirements actually apply to each active award and solicitation.
• Validate the Level 2 self-assessment where it applies. Test the 110 NIST SP 800-171 Rev. 2 requirements against evidence, not against policy language alone.
• Keep SPRS and affirmations current. A current status is not just a score; it includes the required affirmation of continuous compliance.
• Close eligible POA&M items inside the allowed window. Conditional Level 2 status does not create an open-ended remediation period.
• Map CUI through the manufacturing stack. Document where CUI enters, where it is stored, which integrations move it, who can access it, and where it leaves the environment.
• Preserve evidence as controls change. Access reviews, configuration changes, logging, incident-response tests, and security decisions should be traceable to the SSP and operating environment.
• Treat the next CMMC announcement as a policy update, not a reason to restart from zero. The controls and evidence required by current contracts still need to work before any revised Phase II model arrives.

What Happens Next?

The 60-day review window has ended, but DoW has not replaced its public suspension guidance with a new Phase II implementation date. That means contractors should distinguish two timelines: the obligations in force now and the policy decisions that have not yet been published.

What is enforceable now is documented: Phase I continues, applicable Level 1 and Level 2 self-assessments remain in use, and the Department says it will continue enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments during the pause.

What is not yet settled publicly is how third-party verification will return, narrow, or otherwise change. Planning around one assumed outcome would turn an article about current compliance into a forecast. The better editorial line is to update the roadmap when DoW publishes the next formal direction.

Where WM Synergy Fits

WM Synergy’s role is not to certify a manufacturer as CMMC compliant. The useful ERP work is narrower: help the team understand where controlled information touches the manufacturing system, whether the environment supports the required controls, and whether audit evidence can be produced without manual reconstruction.

For manufacturers reviewing that system boundary, see WM Synergy’s Aerospace & Defense ERP and ERP lifecycle and operational-improvement services. The conversation should start with the contract, CUI flow, and current control gaps before it starts with software features.

If you want to map the ERP and CUI boundary against your current requirements, Schedule Your 30-Minute ERP Strategy Call.

Frequently Asked Questions