No: the July 2026 suspension changes that planning assumption. The official CMMC page says Phase II was suspended on 13 July 2026, while Phase I self-assessment requirements remain in place. The SBA’s Office of Advocacy separately documented the suspension and reform review. (dodcio.defense.gov)
What should defence suppliers and service providers do now?
Recommended action: separate the programme-level implementation pause from the obligations in each solicitation, contract and subcontract. Have the contracting owner verify the actual current requirements and any amendments.
For the GRC programme:
- Preserve existing self-assessment evidence and remediation records.
- Link obligations to the relevant contract, entity and system boundary.
- Mark suspended milestones as suspended—not completed or deleted.
- Keep proposed future requirements separate from applicable requirements.
- Revisit assessment-related services expenditure against the revised programme status.
Contracting test for a platform supplier: ask what happens if an external standard or programme date changes after implementation begins. Require pricing and acceptance terms that distinguish reusable control work from abandoned, date-specific configuration.
No replacement Phase II launch date was verified in the official material reviewed. Do not substitute a speculative restart date in the compliance calendar.
Sources cited on this page
- dodcio.defense.gov ↗dodcio.defense.gov