CMMC Phase 2 is paused: what still applies to your Level 1 contract

If you hold a Department of War (DoD) contract and read the news this summer, you may have come away thinking CMMC is on hold. That is only half right. In July 2026 the Department suspended Phase 2 of the CMMC rollout, the phase that would have started requiring third-party (C3PAO) assessments for many Level 2 contracts in November 2026 (Latham & Watkins summary).

Phase 1 was not suspended. If your contracts involve Federal Contract Information (FCI), and most do, your obligations are the same today as they were before the announcement. This post walks through what still applies and what to do about it.

What was paused, and what was not

CMMC is rolling out in phases under the program rule (32 CFR part 170) and the contract clause DFARS 252.204-7021.

• Phase 1 began on November 10, 2025. Solicitations can require Level 1 (Self) or Level 2 (Self) as a condition of award. This phase is still in effect.
• Phase 2 was scheduled for November 10, 2026, and would have added Level 2 (C3PAO) certification requirements. This is the phase that was suspended.

So the paused part is the one that mostly affects companies handling Controlled Unclassified Information (CUI). If your company only handles FCI, which is information the government gives you or you produce for it under a contract and that is not meant for public release, your requirement was always Level 1, and Level 1 has not changed.

What still applies to a Level 1 contractor

1. The 15 safeguarding requirements in FAR 52.204-21

Level 1 is built on the 15 basic safeguarding requirements in FAR 52.204-21. That clause has been in federal contracts since 2016, well before CMMC, and nothing about the Phase 2 suspension touches it. In plain terms, the requirements cover:

• Who can get in: limit system access to authorized users, to the right processes and devices, and to the transactions each user is allowed to perform.
• Outside systems: verify and limit connections to systems you don't control, such as personal devices or outside cloud accounts.
• What is public: control what FCI is posted on publicly accessible systems.
• Who people are: identify and authenticate users and devices before allowing access.
• Old media: sanitize or destroy media containing FCI before disposal or reuse.
• Physical access: limit physical access to systems and equipment, escort visitors, keep access logs and control physical access devices such as keys and badges.
• Network edges: monitor and protect communications at your external boundaries, and separate publicly accessible systems from your internal network.
• Keeping systems healthy: fix flaws promptly, protect against malicious code, keep that protection updated and run scans of systems and files.

For a small shop, most of these come down to everyday habits: individual logins instead of shared ones, a firewall, automatic updates, antivirus that actually runs, a locked door and a visitor log.

2. The annual self-assessment

Under Phase 1, a Level 1 contractor performs a self-assessment against those 15 requirements and enters the result in the Supplier Performance Risk System (SPRS). Level 1 is pass or fail: every requirement must be met. Unlike Level 2, a plan of action (POA&M) cannot be used to close a gap later. The assessment is repeated every year.

3. The annual affirmation

Each year, a senior company official affirms in SPRS that the company meets and continues to meet the requirements. This is the step that deserves the most attention. The affirmation is a statement to the federal government, signed by a real person at your company. If it is not accurate, the company can face liability under the False Claims Act, and the suspension of Phase 2 does not change that.

Why "wait and see" is risky

There are three practical reasons not to treat the Phase 2 pause as a break.

1. Contracts don't wait. A solicitation that requires Level 1 (Self) can arrive at any time, and a current SPRS entry is a condition of award, not something you can fix after you win.
2. Primes are asking now. Many prime contractors ask their subcontractors to confirm CMMC status before issuing a purchase order, whatever phase the rollout is in.
3. The rules for Level 2 may still change. The Department has been reviewing the program with a focus on the burden for small businesses. Whatever comes out of that review, Level 1 is the floor, and getting it right now puts you in a better position for whatever is next.

A simple plan for the next 30 days

1. Confirm what you handle. Look at your contracts and the information that flows through them. If it is FCI and not CUI, Level 1 is your target.
2. Walk through the 15 requirements. For each one, write down what you do today and where the evidence is: a screenshot, a policy or a log.
3. Fix the gaps. Most fixes for small companies are low-cost: turn on automatic updates, remove shared accounts, start a visitor log, document how you dispose of old drives.
4. Enter your self-assessment in SPRS and have the right official affirm it. Keep your evidence together so you can support the affirmation if anyone asks.
5. Put the next one on the calendar. The affirmation is annual. Pick a date and repeat the review.

Where Fix&Affirm fits

We built Fix&Affirm for exactly this job. It walks through the 15 Level 1 requirements in plain English, shows how to fix each gap and produces the document pack behind your SPRS affirmation. The assessment is free, so you can see where you stand before spending anything.

Start your free Level 1 assessment

This article is general information, not legal advice. Check your own contracts and the current rules before you affirm.