Short answer: if you're a Level 1 shop, nothing about your obligation changed. The July 13 suspension paused third-party certification for Level 2 and Level 3. Your annual self-assessment, your SPRS affirmation, and the 15 requirements in your contract are all exactly where they were on July 12.
If you saw a headline that read like CMMC got cancelled and you've been quietly hoping you could stop thinking about this, here's the ninety seconds that'll save you a bad surprise.
What actually got suspended
On July 13, 2026, the Department of Defense (the Department's 2026 memoranda are issued under the Department of War name) announced an immediate suspension of the transition to CMMC Phase 2, which had been set to start November 10, 2026. The memo, signed by CIO Kirsten Davies, also froze all pending and future CMMC implementation milestones until further notice. A CMMC Reform Task Force is running a 60-day review and reports back on or about September 13, 2026.
Concretely, what stopped:
- Third-party (C3PAO) certification at Level 2 as a condition of award. That's the Phase 2 milestone that got pulled.
- DIBCAC assessments at Level 3.
- Phases 3 and 4, which would have widened the net through roughly 2028.
- Existing solicitations and contracts that already carry Level 2 C3PAO or Level 3 requirements. Contracting officers were directed to amend solicitations as soon as practicable, and to strip the requirement from existing contracts before the next option period or during the next scheduled administrative modification.
Every item on that list is about somebody else coming to inspect you. None of it is about Level 1.
What didn't change
Phase 1 has been live since November 10, 2025, and it stayed live. DoD programs can keep writing CMMC self-assessment requirements into contracts, and they are.
Still in force for a Level 1 shop:
- The 15 requirements of FAR 52.204-21, unchanged.
- The annual Level 1 self-assessment.
- The SPRS entry and the affirmation by a senior official, which is a legally binding statement.
- Pass/fail scoring. All 15 met, no partial credit, no POA&Ms at Level 1.
DFARS 252.204-7012 and the NIST SP 800-171 obligations that sit under Level 2 are also untouched, if you're in that territory.
The part that trips people up
The 15 requirements aren't a CMMC invention, and that's the detail worth internalizing.
FAR 52.204-21 is a Federal Acquisition Regulation clause. The final rule published May 16, 2016, and the clause took effect June 15, 2016 - nine years before CMMC Phase 1 started. It's been mandatory in solicitations and contracts involving Federal Contract Information that whole time, with flowdown to subcontractors at any tier.
CMMC didn't create the 15 requirements. It added the requirement that you assess yourself against them and put the result in SPRS. The July 13 memo touched the CMMC program's assessment machinery. It didn't touch the FAR clause sitting in your contract, and a program review can't - that's a different rule, made by a different process.
So even in the scenario where the Reform Task Force comes back in September and rebuilds CMMC from scratch, the 15 things are still contract terms. You still have to do them.
Want to know which ones you'd miss today? The free 5-question check takes about three minutes and doesn't need an email to see your grade.
The suspension's own logic points at self-assessment
Read why the Department paused it and the picture gets clearer.
Davies cited SBA figures suggesting the future phases could cost small and mid-sized businesses more than $7 billion a year, with individual compliance bills approaching $600,000 - while more than 100,000 companies in the defense industrial base would need assessments from roughly 100 approved assessment organizations. Her summary: the math just simply doesn't math. A March 2026 GAO report had already warned the requirements could push small businesses out of the base entirely. The SBA publicly backed the pause.
Every one of those numbers is about the cost of hiring an outside assessor. The task force's stated charge is to lower barriers for small and non-traditional businesses and replace third-party compliance models with something scalable.
Level 1 has never had a third-party assessor. It's a self-assessment you run and attest to. Whatever the task force builds, self-assessment is the model it's building toward, not away from.
What to do this week
If you handle FCI and you're bidding or renewing DoD work, the plan is what it was last month: know your gaps, close them, get a defensible entry into SPRS, keep the evidence.
The one thing that did change is timing pressure from your prime. Primes have spent a year telling suppliers to get their posture in order, and the ones who built supplier requirements around CMMC status aren't unwinding that on a 60-day review. Your prime's letter is a contract question between you and them, and the Pentagon's announcement isn't a party to it.
If compliance cost has been the barrier for your shop, the Department posted a request for information alongside the suspension. It's asking companies about cost drivers, administrative burden, and which NIST 800-171 controls actually reduce risk. That's a real window to tell them what this looks like from a 12-person shop, and it closes when the task force reports.
For the full breakdown - contract by contract, plus what each likely task force outcome would mean for Level 1 - read what the CMMC pause means for a small shop.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. The rules didn't change, and neither did your prime.
Take the free 5-question checkSources: Department of War CIO memo of July 13, 2026; Federal News Network, July 2026; Crowell & Moring and WilmerHale client alerts, July 2026; FAR 52.204-21 final rule, 81 Fed. Reg. 30439 (May 16, 2016).