The rules keep moving. Most of what gets written about them is either a sales pitch or a wall of acronyms. This is the version for a business owner who just needs to know what applies to their contracts, and when that changes.
The headline everyone saw
In July 2026 the Department of War suspended Phase 2 of the CMMC rollout, the stage that would have required a third-party assessor for certain Level 2 contracts. A task force is now reviewing the whole program. That part is real. The part nobody put in the headline is everything that didn't get suspended.
The fuller picture
The simplest way to think about it: the government stepped back, and your primes didn't. A prime contractor sets supplier requirements for their own risk reasons, and nothing in the suspension memo tells them to drop anything. Several have already told their suppliers to confirm requirements with their buyer before cancelling or rescheduling anything.
If you handle controlled information for a defense contract, you're still expected to assess yourself against the 110 requirements of NIST SP 800-171, calculate a score, and enter it into the government's system. Then a named person at your company affirms that score is accurate. That affirmation carries real legal weight, because a false one is a False Claims Act problem, not a paperwork slip.
A lot of shops are going to read the headline and conclude CMMC is over. It isn't. The requirement to know where you stand and to have a defensible score on file is untouched, and the program has already changed direction more than once. Treating a pause as a finish line is how a supplier ends up scrambling when the next update lands.
That's the whole reason this page exists. When something actually changes, I write up what it means for a normal shop, without the sales pitch, and send it to the people on the list below.
Last reviewed July 2026. The task force is expected to report around mid-September 2026, which is the next point where this could shift.
How we got here
The list
No newsletter cadence for the sake of it. When something in the CMMC world actually moves in a way that affects a small supplier, you get a short, plain-English note on what it means and what, if anything, you should do about it. That's the whole deal.
For defense suppliers and the people who run them. This list is only about CMMC, so if that's not your world, no need to sign up.
Quick answers
No. The self-assessment, the SPRS score, and the annual affirmation are all still required, and your prime's requirements are separate from the government's timeline. The suspension changed the third-party assessment step, not the obligation to know where you stand.
If your contract requires it, yes. That requirement was part of Phase 1 and was not suspended. A current score still has to be on file for you to be eligible for award.
Not really. Primes set their own supplier requirements, and the suspension doesn't override those. Several primes have specifically told suppliers to keep going and to confirm with their buyer before changing anything. If your prime is asking, that's the requirement that matters to you.
The task force reviewing the program is expected to report around the middle of September 2026. That's the next point where the requirements could meaningfully change. If they do, I'll send a note explaining what it means. That's what the list above is for.
A gap assessment tells you your current score and exactly what's missing, which you need regardless of what happens with the phased rollout. The self-assessment obligation didn't go away, so knowing where you actually stand is still the first practical step. If that's where you are, the gap assessment page covers it.