01 — COMPLIANCE POSTURE BRIEF

CMMC after the suspension: what software vendorsstill owe

On 13 July 2026, the Phase 2 requirement for mandatory certification by an authorized third-party assessment organization was suspended by DoD CIO Memo 26-P-1023. As of 2026-11-04, no rule in the Federal Register has set a replacement date.

Two readings of that are common and both are wrong. It is not the end of CMMC, and it is not permission to stop. What was suspended is one step — who confirms your posture. What was not suspended is the posture itself: DFARS 252.204-7012 still obliges adequate security by reference to NIST SP 800-171, the separate self-assessment requirement is still in force, and the 72-hour cyber incident reporting obligation is untouched.

The practical consequence is narrower and more awkward than either reading. You have lost the date you were planning against and kept every obligation you were planning to meet. An applicable Department of War solicitation can still specify a certified assessment on its own terms, and a prime can still flow the requirement down by contract, so the gate moved from a calendar to the document in front of you — which is harder to see coming, not easier.

What is inside

What the 13 July 2026 suspension actually paused — and the much larger set of obligations it left standing.
Level 1 or Level 2: the data question that decides which one you are in.
Where the 110 requirements actually consume engineering time, and the one that is not a requirement at all.
Scoping — the architectural decision that sets the price of everything downstream.
Why conditional status is narrower than vendors read it as.
A five-step sequence ordered by your pipeline, now that there is no government date to work back from.

Where it comes from

Drawn from the public federal record — DoD CIO Memo 26-P-1023, the Federal Register, the Department of War's own CMMC program materials, the current clause text on acquisition.gov, and fedramp.gov for the baselines the external cloud service requirement points at. Six pages. No vendor pitch, and no company's self-attested compliance claim presented as a verified fact.

GovExpress is a diagnostic. We are not an assessor, a C3PAO, a 3PAO, or a certification body, and nothing in the brief certifies anything. It is informational and is not legal advice.

02 — COMMON QUESTIONS

Is there a CMMC certification deadline?

Not at present. The Phase 2 requirement for mandatory certification by an authorized third-party assessment organization was suspended on 13 July 2026 by DoD CIO Memo 26-P-1023, and as of 2026-11-04 no rule in the Federal Register has set a replacement date. NIST SP 800-171 obligations under DFARS 252.204-7012 continue to apply, the separate self-assessment requirement is still in force, and an applicable Department of War solicitation can still specify a certified assessment on its own terms.

Does this apply if we are only a subcontractor?

CMMC requirements flow down. A prime carrying a Level 2 obligation is required to pass the applicable requirement to subcontractors handling the same information, which is why the requirement usually arrives as a supply-chain questionnaire rather than as a solicitation.