Plenty of advice is still counting down to a deadline that was suspended
Search for CMMC today and you'll still find pages telling you to book a third-party assessment before November 10, 2026. On July 13, 2026, the Department of War suspended that requirement and started a review. That's good news for your budget, but it isn't permission to stop.
The older rules in your contracts still apply, and a score you post can still be challenged. This program is under active review, so check the latest clause in your own contract before you spend money.
What stopped and what didn't
| Item | Status |
|---|---|
| Level 2 third-party (C3PAO) assessment as a default on November 10, 2026 | Suspended |
| Level 3 assessments by the government | Suspended |
| Level 2 (C3PAO) or Level 3 language already in a contract | Being removed by contract changes |
| Level 1 (Self) and Level 2 (Self), with SPRS scores and annual affirmations | Still in place |
| DFARS 252.204-7012: NIST SP 800-171, 72-hour incident reporting, cloud rules | Still in place |
| FAR 52.204-21: 15 basic safeguards for federal contract information | Still in place |
Three things to do this month
- ///Ask each prime in writing what you'll handle
Confirm whether you'll receive CUI or only federal contract information, and which CMMC level they now require. Keep the reply.
- ///Get the DoD medium assurance certificate now
You need it to report a cyber incident at all, and the 72-hour clock in DFARS 252.204-7012 was never suspended.
- ///Score yourself honestly before you post anything
A low, accurate score is a to-do list. A high, false one can become a False Claims Act problem.
A suspended deadline changes nothing about who wants your data. Small suppliers often hold the same drawings as the prime, behind far less security. We'd look for you first, whatever the assessment calendar says.
What's in the full PDF
- ///A table showing how your level follows from what you handle and what the prime requires
- ///How to shrink what's in scope, and the Microsoft 365 cloud question
- ///The scoring rules that matter, with a fillable score tracker
- ///A 72-hour incident checklist and a week-by-week 60-day plan