Protecting American BusinessesCMMC for small defense suppliersBook a call
MenuClose
What CMMC isWhy it is hereWhat to doIn-kind grantsWork with usPrivacy
Book a call+1 571 410-3066

02 / WHY IT IS HERE

Four dates on the nameplate, and what each one changed.

CMMC was discussed for years before it bound anyone. This page gives the dates the rules took effect, the clause numbers that carry them, what was suspended in July 2026, and the one thing a prime cannot do for you.

Two rules, one clause.

  1. December 16, 2024The program rule, 32 CFR Part 170, took effect. It defines the levels, the assessments, the scoring and the four phases.
  2. November 10, 2025The contracting rule took effect and the clause DFARS 252.204-7021 began appearing in new solicitations and contracts. Phase 1 started that day: Level 1 and Level 2 self-assessments as a condition of award.
  3. July 13, 2026The Department paused the rollout of the program and suspended the Phase 2 transition pending a review. Nothing in Phase 1 was withdrawn.
  4. Planned November 10, 2026, November 10, 2027, November 10, 2028Phases 2, 3 and 4, each one year after the last, as written in 32 CFR 170.3. Phase 2 is the one on hold.

What was suspended in July 2026, and what was not.

Suspended

The Phase 2 transition that would have put third-party Level 2 certification into contracts from November 10, 2026. New Level 2 certification and Level 3 designations by requiring activities during the review. Waivers, which are not granted while the review runs.

Not suspended

NIST SP 800-171 Rev 2 as the baseline. DFARS 252.204-7012, including the 72-hour incident reporting. The Level 1 and Level 2 self-assessments. Posting your score in SPRS. The annual affirmation by a senior official. The Department said it will enforce the baseline through self-assessments and select government-led assessments.

What this means at a bench: the assessor who would have checked your work before the government saw it is on hold. Your own signature is now the whole assurance. That raises the weight of an honest score. It does not lower the bar.

Four clause numbers, and what each one asks of you.

DFARS 252.204-7012
Safeguard covered defense information to NIST SP 800-171, report a cyber incident to the Department within 72 hours, and preserve the evidence. In contracts since 2017.
DFARS 252.204-7019
Have a current NIST SP 800-171 assessment score in SPRS, not more than three years old, before award.
DFARS 252.204-7020
Give the government access to assess you, and flow the requirement down to subcontractors who handle covered defense information.
DFARS 252.204-7021
Hold the CMMC level the contract names, and affirm it. The clause that puts CMMC in your contract.

Your prime cannot carry this for you.

A prime flows the clause down to every subcontractor that will handle FCI or CUI on the contract. The prime is responsible for its supply chain, so it will ask for your level, your SPRS score and your affirmation before it places the order, and it may drop a supplier that cannot answer. The prime's certification covers the prime's systems. Your systems are yours.

If you wait.

CMMC was paused once before, in 2021. Many suppliers read that as permission to wait, and when the program came back they were years behind a baseline that had never gone away. The July 2026 review does not change the requirements in your contract today. The next purchase order is where a supplier finds out whether it is still on the list.