CMMC in 2026: Phase I In Force, Phase II Suspended — What Changes
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
The FedRAMP 20x Class A pipeline opened August 3, 2026 — the civilian on-ramp the rest of this series is built around. But many of the software companies eyeing that on-ramp also sell, or want to sell, into Department of War (DoW) programs. On that side the framework that governs everything is CMMC, and in 2026 the single most common way to get CMMC wrong is to describe its status imprecisely.
This piece exists to get one distinction exactly right — because in federal compliance, precision is itself a trust signal, and this is the distinction a knowledgeable buyer will use to decide whether you actually track the regime or just talk about it.
The distinction the whole piece rests on
As of 2026:
| Regulatory item | Status |
|---|---|
| CMMC Phase I | In force |
| CMMC Phase II | Suspended — not cancelled (memo 26-P-1023, announced 2026-07-13) |
| DFARS 252.204-7012 | In force |
State each of those the way it reads and never the near-miss version. “Phase II was cancelled” is wrong. “Phase I is suspended” is wrong. Either error tells a contracting officer — or a competitor — that your compliance posture is approximate, which is the opposite of the impression a federal seller wants to leave.
Suspended is not cancelled — and the difference is your plan
A suspension is a pause, not a repeal. A company that reads “Phase II suspended” as “Phase II gone” makes two expensive mistakes at once: it stops building toward a certification that a resumption will require, and it signals to anyone paying attention that it isn’t tracking the regime closely.
The correct posture is to treat Phase II as deferred, not deleted: keep the program warm, keep evidence current, and be ready to move when it resumes. Meanwhile the obligations already in force — Phase I and DFARS 252.204-7012 — continue unchanged. Nothing about the suspension relaxes what is already required today.
Two calendars, one company
For an ISV whose path touches both civilian and DoW work, 2026 is running two compliance calendars at the same time:
- The civilian FedRAMP 20x calendar — Class A opened 2026-08-03, Class B & C opened 2026-08-31. This is the on-ramp the companion pieces in this series cover; see also the FedRAMP 20x timeline for SaaS and the FedRAMP 20x Class A pipeline.
- The DoW CMMC / DFARS calendar — governed by the Phase I / Phase II status above, on its own timeline.
The reason to hold both in view: the underlying readiness work overlaps even when the standards don’t. A functioning control environment, current evidence, and a legible verified-vs-self-attested posture help you on either side. But the standards are distinct and the calendars are distinct, and a seller has to track them as two separate clocks — not collapse them into one.
Keeping the distinction legible without overclaiming
GovExpress renders a company’s compliance posture as a verified-vs-self-attested overlay on every vendor you search in the app, and the Compliance Posture category of the Federal Readiness Score reflects it. For CMMC content specifically, that framing carries an honesty line worth stating out loud:
GovExpress has no visibility into government-only scoring systems. It does not read, mirror, or represent a company’s government-side score. The posture it renders is built from its own verified/self-attested overlay and public federal data — not from privileged access to any government scoring system. A vendor that implies it can see inside a buyer’s government records is exactly the kind of overclaim this series is built to avoid.
Get the distinction right, and the rest follows
The companies that come through FedRAMP 20x with credibility are the ones whose every compliance statement survives a second read by someone who knows the regime. On the DoW side in 2026, that comes down to three facts said precisely: Phase I in force, Phase II suspended — not cancelled — and DFARS 252.204-7012 in force. Say them that way, plan as though Phase II will return, and keep the civilian and DoW calendars as two clocks rather than one.
See where your compliance posture actually stands — verified vs. self-attested — before a contracting officer does.
Staying current on both calendars and keeping your Phase II program warm positions you ahead of each resumption.
Related reading
Frequently Asked Questions
Is CMMC Phase II cancelled?
No. Phase II is suspended — not cancelled — per memo 26-P-1023, announced 2026-07-13. A suspension is a pause, not a repeal; the correct posture is to treat Phase II as deferred and keep your program ready for when it resumes.
Is DFARS 252.204-7012 still required?
Yes. DFARS 252.204-7012 remains in force. Nothing about the Phase II suspension relaxes what is already required today.
The CMMC brief
What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.