What changed
DoD suspended Phase II implementation on July 13, 2026. During the suspension, the program may require Level 1 (Self) or Level 2 (Self), but it may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) as a solicitation or contract condition.
The regulatory text remains in place, and DoD can issue new implementation guidance before later phases resume. Phase I obligations continue during the pause.
What did not change
For Level 2, the underlying security baseline remains the 110 requirements in NIST SP 800-171 Rev. 2. Results for Level 2 (Self) are entered in the Supplier Performance Risk System, known as SPRS.
The suspension changes which CMMC status DoD may require during the pause. It does not erase the need to protect controlled unclassified information or maintain supportable security evidence.
What contractors should do now
Keep the system security plan, plans of action and milestones, policies, technical evidence, and SPRS record tied to the environment that handles federal contract information or controlled unclassified information.
- Confirm which contracts and systems fall within the CMMC scope.
- Review the 110 NIST SP 800-171 Rev. 2 requirements against current evidence.
- Resolve gaps that would weaken a Level 2 (Self) result or the supporting SPRS record.
- Track official DoD guidance before relying on a later-phase date.
How Z7 supports readiness
Z7 provides a CMMC Readiness add-on and NIST SP 800-171 preparation support. Z7 is CMMC Level 2 aligned; readiness work prepares your organization and evidence but does not replace an assessment authority when one is required.
Official sources
Read the DoD CMMC Program overview, the Phase II suspension implementation memo, and 32 CFR part 170. Check these primary sources for guidance issued after this page's October 9, 2026 update.