Clarion Street

The CMMC Suspension Is a Memo, Not a Rule

·10 min read

On July 13, 2026, the Department of War (DoW, formerly DoD) suspended CMMC Phase 2 with two memoranda issued under case number 26-P-1023, one from the CIO and one from the undersecretary for acquisition and sustainment. There was no Federal Register notice. 32 C.F.R. Part 170 is unchanged. No DFARS class deviation had been published when this post went up. On September 3, 2026, Class Deviation 2026-O0025 Revision 3 issued, carrying the suspension language forward in DFARS Part 240. The CMMC Program rule and DFARS 252.204-7021 are in force exactly as they were written.

That is the whole story, and it is a strange one. When a regulator wants to change what contractors must do, it runs a rulemaking. It publishes a proposal, takes comment, and amends the Code of Federal Regulations. The process is slow and public because it is meant to be hard to reverse. A memorandum is neither. It changes how the department uses its discretion, and it can be changed back the same way. “A memo can be reversed just as fast,” as Alex Major of McCarter & English put it.

What moved on July 13 was the department’s discretion to designate higher CMMC levels. Program managers may now designate only Level 1 (Self) or Level 2 (Self). They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC). Solicitations that already name a higher level have to be amended “as soon as practicable,” and existing contracts have to be modified to strip the C3PAO or DIBCAC requirement before the next option exercise or administrative modification. No waivers during the review.

None of that touches the obligations underneath. NIST SP 800-171 Rev 2 is the interim baseline. DFARS 252.204-7012, with its 72-hour incident reporting, is still in effect. The SPRS-score condition and the access-for-assessment obligation are still in force too, carried for new awards by 252.240-7997 in place of 252.204-7020, with 252.204-7019 dropped from new contracts. The old numbers are not repealed; they still sit in the eCFR text and govern awards that predate the Part 240 overhaul. Phase 1, the self-assessment phase, is a codified condition of award under DFARS 204.7503(b), and it never paused. I wrote about what stays live and where the False Claims Act risk now sits in the earlier post on this suspension, so I will not repeat it here.

CMMC has now been paused twice in about five years. It was paused in 2021 for a review that produced the streamlined three-level CMMC 2.0. In March 2025 the administration’s deregulatory agenda cited the CMMC rule as a “costly Biden Administration regulation” with a $42.26 billion impact. Six months later the rule was finalized without significant changes, which appeared to settle that CMMC was here to stay. Then it was suspended again, months before Phase 2 was due to kick in. Wiley Rein’s alert reads this most clearly: the pause “reflects a concrete step away from the status quo” and “previews at least the possibility of changes to the existing cybersecurity requirements beyond CMMC.”

For a contractor planning a multi-year enclave build, that history is the point. A certification path that has changed course twice is not a stable planning assumption. You cannot treat the target as fixed and plan against it, because the target can move in either direction, fast. That is the difference between “compliance limbo” and a predictability problem. One is a fog that clears. The other is a target that keeps moving.

Plan against the codified text

The practical consequence of memo-not-a-rule is that contracts, not headlines, still control. Major’s client alert makes the case in three lines worth keeping together. A class deviation has since issued (2026-O0025 Revision 3, September 3), but a deviation is not a rule and does not amend 32 C.F.R. Part 170. Until a DFARS rule or an amendment to 32 C.F.R. Section 170.3(e) issues, plan against the text as written. Some program offices require C3PAO assessments ahead of the November deadline, so a higher designation can still appear where you would not expect it. And until a modification issues, the clause in your contract is your contract: DFARS 204.7503(c) still bars option exercise unless your required CMMC status is current in SPRS.

The fix for all three is the same and it is boring. Request the modification in writing. Do not treat the memo as self-executing relief.

What a memo means for the build

Three of the things contractors should do with this pause follow directly from its form, and none of them is obvious from the headline.

First, do not dismantle anything. A reformed requirement could return within months, and government-led assessments continue in the interim. Unwinding and rebuilding a CUI enclave costs more than maintaining one. Wiley’s line is blunter: “it is too soon to call these efforts off. CMMC 2.0 is not off the table yet.”

Second, a completed certification still has value, and it may even be the safest place to stand. The Cyber AB’s May 2026 town hall counted 1,391 Final Level 2 certificates issued as of May, and nothing invalidates them. DFARS 252.204-7021(d)(1)(i) requires the stated level “or higher,” so a Level 2 (C3PAO) status satisfies any lesser designation during the suspension. It also remains a differentiator with primes and in M&A diligence.

Third, the paper trail you already created survives the pause and it is discoverable. Starting a C3PAO assessment triggered government notification, and gap assessments documented deficiencies in writing. Those records did not evaporate on July 13. Remediate on a defensible timeline rather than shelving the report. This is the uncomfortable one, because a gap assessment that sat in a drawer looked harmless when certification was coming. It looks different now that the verification mechanism is gone and the review is open.

Two things the memo does not touch

There are two separate tracks still moving, and contractors with a foot in either one get no reprieve from a CMMC Phase 2 pause.

The first is the governmentwide CUI rule. In June 2026 the FAR Council proposed rules that would extend CUI safeguarding and incident reporting requirements to all CUI handled under all federal contracts, folded into a broader FAR overhaul. Wiley’s point is that if that rule goes through, a reduction in CMMC scope “may not offer much relief,” because the requirements just arrive from a different direction. Major is more direct: mixed defense and civilian contractors get nothing from this pause.

The second is the baseline itself. The department tied interim enforcement to NIST SP 800-171 Revision 2, not the Revision 3 published in 2024. Major reads that as breathing room on a Revision 3 transition. I read it the same way, with one caution. Breathing room on a transition is not the same as a transition that will not happen. Budget for Rev 3 while you keep building to Rev 2.

The thing to watch

The CMMC Reform Task Force reports to the CIO with recommendations due roughly mid-September. As of this writing the report has not dropped, so anything said about its contents is a forecast, not a fact. The reason to watch it closely is the same reason the memo matters. If the task force produces a real rulemaking, the program gets a stable legal form again and the predictability problem shrinks. If it produces another memorandum, the target just moved again.

Two things that are not forecast have landed since the memo, and both are worth reading before the report does. On July 13, the same day as the pause, the CIO published “Brilliant at the Basics,” a voluntary pair of Top-10 lists for IT and operational technology. It has no rule, clause, or certification behind it, but several items sit above what NIST SP 800-171 Rev 2 asks for: phishing-resistant MFA, a continuously validated asset inventory, immutable backups, secure AI adoption, and strict IT/OT segmentation. The Cyber AB’s August town hall filled in the reform-recommendations side: shrink C3PAO assessment teams from three to two, allow continuous monitoring and delta assessments, commercialize background checks, and reconsider whether Level 1 earns its cost. The organization’s own position, stated plainly, is that third-party certification is “fundamental and must be retained” and that self-attestation “has not been effective.” None of this changes what is in force. It does tell you which way the review is looking, and the direction is not toward a lower technical bar.

ComplianceHub.Wiki, which sells compliance workbooks and runs sponsored content, published a decision framework last month timed to the report. Treat it as decision support rather than reporting. It lists four plausible outcomes. Phase 2 resumes on a delayed timeline. Certification narrows to a smaller population. Self-assessment plus a senior-executive attestation replaces certification for most, which would raise individual accountability while lowering assessment cost. Or the maturity model itself gets restructured. What does not make the list is the outcome some contractors are quietly hoping for: removal of the underlying requirements. Those sit in DFARS, NIST 800-171, and the contracts, not in the CMMC rule, so a task force recommendation cannot delete them.

You cannot predict which one lands, so do not plan around a prediction. Decide now which moves you would make under each of the four, and do the work that keeps its value under all of them. That work is most of the work: implement NIST SP 800-171 for real, make the SPRS score defensible against the evidence behind it, finish CUI scoping, close POA&M items instead of carrying them, keep the evidence file current by requirement, and keep DFARS 7012 flow-down current. That evidence discipline is the argument I made in the compliance automation gap post. A contractor that waits for the report and then decides will spend the month after it lands re-litigating strategy. A competitor that pre-decided will act in days.

One more corner of that discipline gets skipped in a hurry, and ArentFox Schiff flagged it in a late-August alert. CMMC sets the rules for how to protect data, but not what data must be protected, who is authorized to access it, or how to obtain government approvals for it. A contractor’s access-control policies have to respect that line, or the policy itself manufactures a compliance problem the pause cannot fix. The firm’s example is a blanket rule that non-U.S. persons need an export license before touching CUI. When the CUI in question is not export-controlled, that license cannot be obtained, so the policy creates a deviation the company trips over every time it follows its own rules. Kevin Pinkney and Megan Barnhill frame the fix as a review: make sure the policy describes how controlled data is protected without inventing approval requirements, especially third-party ones, that do not otherwise exist.

The substantive obligation was never the moving part. NIST 800-171, DFARS 7012, the SPRS scores, and the annual affirmations did not pause. What paused, and what can now be reversed as fast as it was paused, is the certification path on top of them. That split, between the obligation that was always live and the verification that is now optional, is what contractors should price into their planning. The 800-171 baseline never moved, so plan against it. The certification path moved twice, so do not treat it as fixed.

Sources

  1. Wiley Rein LLP — DOD Pauses CMMC 2.0 Implementation: A Big Deal with Little Immediate Impact (July 17, 2026)
  2. McCarter & English, Alex Major — Government Contracts Law: DoD Suspends CMMC Phase 2 (July 2026)
  3. Federal News Network — Pentagon suspends CMMC phase two requirements, launches review (July 13, 2026)
  4. Department of War — DoW Suspends CMMC Phase II Requirements (press release)
  5. DoD Memo 26-P-1023 — Implementing Suspension of CMMC Phase II (procedures)
  6. DoD CIO Memo 26-P-1023 — CMMC Reform Memo (Davies)
  7. ComplianceHub.Wiki — CMMC Reform Task Force Reports ~13 Sept: Four Outcomes (Aug 22, 2026)
  8. ArentFox Schiff — Do Not Fall Into a Trap: Review Your CMMC Policies Now (Kevin Pinkney, Megan Barnhill, Aug 27, 2026)
  9. CMMC.com — Brilliant at the Basics Isn’t Basic: What the DoW CIO’s Top 10 Lists Signal About CMMC Reform (Aug 18, 2026)
  10. CMMC.com — August 2026 Cyber AB Town Hall Recap: RFI Results, the Cyber AB’s Reform Recommendations (Aug 26, 2026)
  11. DFARS Class Deviation 2026-O0025 Revision 3 — Deviation Memo (September 3, 2026)