Insights/CMMC in November 2026
Insights

CMMC in November 2026: Where Phase 2 Stands and What Primes Are Asking For

Updated:

Short answer: as of early November 2026, CMMC Phase 2 is still suspended and no restart date has been announced. Phase 1 still applies in full: Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Rev 2. If a prime asks about your cybersecurity this month, those are the things it can check.

Where Phase 2 stands

On July 13, 2026, the Department of War (DoW, formerly DoD) suspended the move to CMMC Phase 2. Under the suspension, new requirements may only call for Level 1 (Self) or Level 2 (Self). We covered the details in what the Phase 2 suspension means.

Three things have happened since then:

  • September 3, 2026: a binding class deviation. The DoW issued a class deviation that tells contracting officers how to carry the suspension into solicitations and contracts. It is binding on them, so the suspension now sits in the acquisition process itself.
  • The 60-day review. The CMMC Reform Task Force set up on July 13 ran a 60-day review of the program. As of early November 2026, its report has not been made public, and no date has been announced for Phase 2 to restart.
  • September 9, 2026: what industry told the DoW. Speaking at the Billington Cybersecurity Summit, DoW CIO Kirsten Davies said the department received more than 1,100 comments on its request for information about CMMC, and that more than half of them supported the suspension.

Nothing official says when Phase 2 will return, or in what form. Plan around the rules that apply today.

What still applies under Phase 1

  • Level 1 (Self): a self-assessment every year, with the results posted in SPRS. See CMMC Level 1.
  • Level 2 (Self): a self-assessment against NIST SP 800-171 Rev 2 every three years, with your score in SPRS. See CMMC Level 2.
  • Annual affirmations: an affirming official confirms compliance in SPRS every year. Our guide to the SPRS annual affirmation explains who signs and when.
  • DFARS 252.204-7012: still in effect, and it still points to NIST SP 800-171 Rev 2. The DoW may also carry out select government-led assessments.

What primes are asking for

Primes flow down the rules that apply, and today those are the Phase 1 rules. We are not quoting any prime here; these are the questions Phase 1 lets a prime ask:

  • Is your SPRS score posted, and is it current?
  • Does your work need Level 1 (Self) or Level 2 (Self)?
  • Who is your affirming official, and when is your next annual affirmation due?
  • Are your System Security Plan and POA&M for NIST SP 800-171 Rev 2 accurate and up to date?

Ask your primes the same question in return: what will they flow down to subcontractors while the review continues? Get the answer in writing.

What to do this month

  1. Check your SPRS entry: score, dates and affirming official.
  2. Keep your NIST SP 800-171 Rev 2 work moving. Government-led assessments can still happen.
  3. Read every new solicitation and contract modification for CMMC language.
  4. Ask your primes, in writing, what they will flow down.
  5. Watch for the task force report and any new DoW guidance. We will update this note each month.

How Galaxy can help

Galaxy Consulting is a service-disabled veteran-owned small business and a Cyber-AB Registered Provider Organization (RPO) with a Registered Practitioner on our team. We advise and help you prepare: gap assessments against NIST SP 800-171 Rev 2, System Security Plan and POA&M documentation, and SPRS self-assessment support. We do not conduct official assessments.

Book a short discovery call to talk through where your SPRS score stands.

General information, not legal advice. Sources: DoW press release and DoW CIO memo of July 13, 2026; the DoW class deviation of September 3, 2026; DoW CIO Kirsten Davies at the Billington Cybersecurity Summit, September 9, 2026; the DoW CIO CMMC page, checked early November 2026.