CMMC Phase 2: Current Policy and Contractor Readiness
CMMC Phase II was suspended under the Department’s current policy, so the original rollout date should not be treated as a universal contractor deadline. Existing safeguarding and reporting duties still depend on the actual contract. Confirm the required assessment status, applicable clauses, and current instructions before purchasing an assessment or promising certification.
Key Takeaways
- •Separate current policy from the original rollout schedule.
- •Read the clauses and amendments in the actual solicitation or contract.
- •Keep the system boundary and remediation status accurate.
For implementation support, review vCISO support for government contractors and CMMC certification timing. Confirm scope and operating responsibilities before choosing an engagement.
Is the original Phase II deadline still the right planning date?
No. The official CMMC policy page reports the suspension announced in July 2026. Distinguish that policy from the original phased implementation in the CMMC Program final rule.
The original rule explains a progression from self-assessments toward additional third-party assessment requirements. It is useful for understanding the program’s structure, but it does not make every earlier schedule statement a current award condition. Ask the contracting officer to identify the requirements in the solicitation and any applicable amendments.
Which obligations should contractors continue addressing?
Continue addressing the safeguarding, assessment, reporting, and flow-down duties actually included in the contract. A pause in a rollout milestone is not permission to misrepresent implemented controls.
DFARS 252.204-7012 addresses covered defense information, safeguarding, and cyber incident reporting. Identify the information you receive or create, where it flows, and the service providers that can access it. Record the contractual basis for your system boundary.
| Decision | Evidence to keep |
|---|---|
| Which information is in scope? | Contract language, agency designation, authorized CUI categories |
| Which systems handle it? | Inventory and data-flow diagram |
| Which assessment status is required? | Solicitation, amendments, clauses, written clarification |
| Which controls operate? | System security plan and reviewable evidence |
| Which gaps remain? | Accurate remediation ownership and status |
What should be ready before a C3PAO engagement?
A defensible scope, accurate system security plan, implemented controls, and accessible evidence should precede scheduling. Verify the organization’s current directory role and standing in the Cyber AB Marketplace, then discuss assessment scope, conflicts, team availability, and terms.
Use the C3PAO selection guide for the diligence questions. Do not buy an assessment solely because an old deadline appears in a blog or sales presentation.
How should you maintain the readiness plan while policy changes?
Keep the underlying control work moving while updating the source of each external deadline. Track current policy, written contract requirements, remediation, and assessment scheduling as separate items.
Assign one owner to review official updates and communicate changes to procurement, engineering, and leadership. Keep dated evidence of the decision, including what changed and why. That provides a usable plan even when an implementation schedule changes.
Frequently Asked Questions
Does the Phase II suspension remove all security obligations?
Should we schedule an assessment using an old deadline?
Where should we check an assessor?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
