Five weeks on, nothing has been published. The Task Force's recommendations reached the DoW CIO around September 11. There is no public report, no new CIO memo and no Phase 2 restart date. The September 3 class deviation (Revision 3) is still the operative instruction: contracting officers pull C3PAO requirements from solicitations, Level 1 and Level 2 self-assessments may be required anywhere, and NIST SP 800-171 Rev 2 under DFARS 252.204-7012 stays the baseline.
One misread to avoid: part of the market has taken that deviation to mean CMMC is delayed to 2028. It is not. It is a suspension with no date attached, and the CIO and the Under Secretary have both declined to rule out narrowing or ending the program.
What to do with that: the same thing as in August. Everything below about the outcomes and the play still holds, and the honest self-assessment you post to SPRS is what primes check in the meantime.
Update, September 12, 2026. The Task Force's 60-day clock ran out on September 11. Its recommendations went to the Department of War CIO, Kirsten Davies, and it is her call whether and when they are published; nothing is public yet, and reporting points to late September or October. Two things did happen while we waited. On September 3 the Department reissued the class deviation behind the suspension (DFARS Class Deviation 2026-O0025, Revision 3), which directs contracting officers to remove third-party CMMC requirements from solicitations and contracts, permits Level 1 and Level 2 self-assessments everywhere, and keeps NIST SP 800-171 Rev 2 as the baseline under DFARS 252.204-7012. And the CIO's office said the request for information drew more than 1,100 responses running past 10,000 pages, with a majority supporting the pause, and that during the pause the Department enforces through self-assessments and select government-led assessments. Everything below about the outcomes and the play still holds. Sources: Nextgov, DefenseScoop, the deviation memo.
When the Department of War suspended CMMC Phase 2 on July 13, it started a clock: a newly formed CMMC Reform Task Force was given 60 days to review the program and deliver recommendations to the Department's Chief Information Officer. That clock runs out in roughly the second week of September 2026. The public comment window has already closed: industry responses to the Department's request for information were due August 14.
So what happens next, and what should a small contractor do between now and then? Here is an honest look at the possibilities, and the one strategy that wins under all of them.
What the report is, and isn't
The Task Force delivers recommendations, not policy. The Department then decides what to adopt, and rule changes of any size take time to implement. So don't expect a switch to flip in September. Expect a direction: a signal of whether third-party certification returns largely as designed, returns in a narrower or slower form, or stays parked while the Department leans on self-assessment for longer.
We've seen this movie before. The original CMMC program was paused for review in 2021 and came back streamlined as CMMC 2.0. Five levels became three, and most third-party assessment requirements were narrowed, not abandoned. A pause for reform has historically been exactly that: a pause, followed by a leaner version of the same idea.
The three plausible outcomes
| Outcome | What it would look like | What it means for you |
|---|---|---|
| Phase 2 resumes, adjusted | Third-party certification returns with a new timeline, possibly narrower scope or phased tiers to relieve assessor capacity. | The companies that kept working during the pause are first in line and audit-ready. Everyone else is back on a deadline treadmill, possibly a shorter one. |
| A longer self-attestation era | The Department extends its current interim posture: SPRS self-assessment as the primary mechanism, backed by government-led (DIBCAC) spot assessments. | Your self-reported score and the records behind it become the whole ballgame, and False Claims Act exposure for overstated scores grows, because self-attestation is the control. |
| Structural redesign | A bigger rethink: different tiers, different verification models, expanded small-business accommodations. | New rules take longest to write. The interim regime of honest SPRS scores under existing DFARS clauses runs even longer. |
Notice what all three outcomes share. In every scenario, NIST SP 800-171 stays required by DFARS 252.204-7012, a current self-assessment score in SPRS stays a condition of award under 7019, and the honesty of that score is enforceable under the False Claims Act. There is no outcome where the work you do now is wasted.
What primes are doing while the government decides
One thing the suspension did not touch: what your prime contractor requires of you. DFARS 252.204-7012 obligates primes to flow cybersecurity requirements down to subcontractors handling Covered Defense Information, and many primes wrote C3PAO certification or evidence of 800-171 implementation into their own subcontract terms and supplier scorecards. Nothing requires them to relax that, and a defensible answer to "how do you manage supply-chain risk" is worth more to a prime now, not less. If your revenue runs through subcontracts, the requirements that bind you this fall may be set in Falls Church or Fort Worth, not the Pentagon.
The play between now and the report
- Get your SPRS score current and honest. If your posted score reflects where you planned to be rather than where you are, fix that first. It is the number the government checks today, and the number a False Claims Act case would be built on.
- Keep your SSP current. A System Security Plan is required by the clauses already in your contracts, and it is the first document any reviewer (prime, DIBCAC, or future assessor) asks for. A stale SSP is the fastest credibility loss available.
- Put dates on your POA&M. An undated remediation plan reads as a wish list. A dated one reads as a program.
- Collect evidence for what you've marked implemented. Under self-attestation, an "implemented" with nothing behind it is an assertion. Screenshots, configuration exports, and policy documents turn assertions into records.
- Don't buy anything you can't explain. If the report changes assessment requirements, the tools and consulting scoped to the old regime may need rework. The fundamentals above are regime-proof; exotic commitments made this month may not be.
Walk into September with your numbers already straight
CMMC Map walks you through all 110 NIST 800-171 requirements in plain English, calculates your DoD-weighted SPRS score as you go, and generates the SSP and POA&M behind it. The full assessment is free. No card, no trial clock.
Start your free assessmentWhat we'll be watching for
- Scope: does third-party assessment come back for everyone handling CUI, or a narrower slice of the defense industrial base?
- Timeline: a restarted phase-in date, and how much runway it gives companies that paused.
- Self-assessment's role: whether the interim SPRS-first posture is formalized into the program's structure, which would make documentation quality the deciding factor for most small contractors.
- Small-business accommodations: the cost and assessor-capacity complaints that triggered the review point toward relief measures; the shape of that relief will define the market for years.
When the report lands, we'll publish a plain-English breakdown of what changed and what it means for small contractors, the same day we can read it.
The pause did not pause self-assessment
See where you stand in 20 minutes. The free SPRS calculator scores all 110 controls with the DoD weights, no signup, and nothing leaves your browser.
Score all 110 controls free Or take the 2-minute readiness check