What changed with the DFARS clauses in February 2026?

Under the February 1, 2026 class deviations, DFARS 252.204-7019 was deleted and 252.204-7020 was renumbered to 252.240-7997 with Basic self-assessment references removed. Assessment obligations now run through CMMC under DFARS 252.204-7021. The CFR keeps the old numbers until formal rulemaking, so expect to see both during the transition.

When does CMMC Phase 3 start and what does it add?

The Department suspended pending and future CMMC implementation milestones in July 2026 while it reviews the program. The prior schedule placed Phase 3 on November 10, 2027, but contractors should wait for official guidance before relying on that date or predicting what a revised rollout will require.

Are prime contractors enforcing CMMC beyond DoD requirements?

Yes. Lockheed Martin requires suppliers to document CMMC status in SPRS to maintain the supplier relationship, Boeing has tied contract awards to certification for suppliers handling FCI or CUI, and RTX embeds CMMC declarations in its supplier registration and will not issue purchase orders to unconfirmed CUI handlers.

What should a Level 1 contractor do before affirming in SPRS?

Complete the 15-practice self-assessment honestly, marking each practice Met or Not Met; Level 1 has no partial-credit state. Close every gap before affirming, since Level 1 has no POA&M path or conditional status. Then submit through the PIEE portal with a senior official's affirmation, and repeat annually.

How many contractors have completed C3PAO assessments so far?

The February 2026 Cyber AB Town Hall reported about 1,042 completed assessments against a much larger estimated Level 2 population. That was important capacity context for the original rollout, but the planned November 2026 Phase II transition is now suspended.

CMMC 2026 Deadline: Phase II Pause Update

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC 2026 Deadline: Phase II Pause UpdateCMMC Phase I remains active, but the planned November 2026 Phase II transition is suspended. See the July 2026 update and contractor action checklist.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.