What changed with the DFARS clauses in February 2026?

The February 2026 deviations introduced DFARS Part 240. DFARS 252.204-7021 addresses applicable CMMC requirements; DFARS 252.240-7997 separately addresses government Medium or High NIST SP 800-171 assessments. Check the clauses, amendments, and modifications applicable to your contract.

When does CMMC Phase 3 start and what does it add?

The Department suspended pending and future CMMC implementation milestones in July 2026 while it reviews the program. The prior schedule placed Phase 3 on November 10, 2027, but contractors should wait for official guidance before relying on that date or predicting what a revised rollout will require.

Are prime contractors enforcing CMMC beyond DoD requirements?

Yes. Lockheed Martin requires suppliers to document CMMC status in SPRS to maintain the supplier relationship, Boeing has tied contract awards to certification for suppliers handling FCI or CUI, and RTX embeds CMMC declarations in its supplier registration and will not issue purchase orders to unconfirmed CUI handlers.

What should a Level 1 contractor do before affirming in SPRS?

Complete the 15-practice self-assessment honestly, marking each practice Met or Not Met; Level 1 has no partial-credit state. Close every gap before affirming, since Level 1 has no POA&M path or conditional status. Then submit through the PIEE portal with a senior official's affirmation, and repeat annually.

How many contractors have completed C3PAO assessments so far?

The February 2026 Cyber AB Town Hall reported about 1,042 completed assessments against a much larger estimated Level 2 population. That was important capacity context for the original rollout, but the planned November 2026 Phase II transition is now suspended.

CMMC 2026 Deadline: Phase II Pause Update

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC 2026 Deadline: Phase II Pause UpdateCMMC Phase I remains active and Phase II remains suspended after the review window. Check the current official status and contractor action checklist.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.