CMMC Phase II suspension
How to Sustain CMMC Level 2 Requirements Between Self-Assessments
In the summer of 2026, the Department of War (DoW) suspended Phase II of the Cybersecurity Maturity Model Certification (CMMC) program and established a CMMC Reform Task Force. During the suspension, Level 2 self-assessment is the applicable government assessment path. Contractors should confirm their specific contractual requirements.
The suspension does not eliminate existing contractual obligations to protect Controlled Unclassified Information (CUI), however. Organizations are still expected to meet their CMMC Level 2 requirements through sustained cybersecurity practices and accurate self-assessments.
Where things stand during the suspension
Suspended
Phase II rollout
The planned November 2026 rollout of C3PAO assessments is paused.
Applicable path
Level 2 self-assessment
Self-assess every three years and enter results in SPRS.
Still required
CUI protection
Existing contractual obligations to protect CUI remain in effect.
Which CMMC Level 2 Requirements Changed and Which Did Not?
Before the suspension, some Level 2 contracts allowed self-assessment, while others would have required assessment by a CMMC Third-Party Assessment Organization (C3PAO) under the planned November 2026 Phase II rollout. During the suspension, contractors subject to Level 2 (Self) requirements must self-assess every three years and enter their results into the Supplier Performance Risk System (SPRS).
Changed
- Planned November 2026 Phase II rollout of C3PAO assessments
- Existing third-party assessment requirements, removed before the next option is exercised or scheduled administrative modification
Still in effect
- Contractual obligations to protect Controlled Unclassified Information (CUI)
- The 110 security requirements in NIST SP 800-171 Revision 2
- Level 2 self-assessment every three years, with results entered in SPRS
- Affirmations following the assessment and annually thereafter
The key distinction is that the assessment rollout has changed, but applicable cybersecurity requirements remain. According to active CMMC Level 2 requirements, you must continue to protect sensitive information, maintain appropriate security controls and meet your contractual obligations.
What Do CMMC Level 2 Requirements Include During the Suspension?
CMMC Level 2 requirements address the protection of CUI through the 110 security requirements outlined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2. These requirements cover areas such as access control, configuration management, audit and accountability, identification and authentication and system and communications protection.
110
Security requirements in NIST SP 800-171 Revision 2
Requirement areas include
Access controlConfiguration managementAudit and accountabilityIdentification and authenticationSystem and communications protection
Acquisition guidance
Dated September 3, 2026
Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, implements the suspension in acquisition guidance and directs contracting officers to remove or revise affected CMMC requirements in solicitations and contracts. The suspension’s implementing guidance calls for existing third-party assessment requirements to be removed before the next option is exercised or scheduled administrative modification. Contractors should confirm with their contracting officer when the applicable modification will take effect.
Organizations pursuing Level 2 status must still assess the systems within their defined CMMC assessment scope against the applicable requirements. A complete assessment involves more than answering questions on a checklist, though. Contractors need a current System Security Plan (SSP) describing their systems, security controls and implementation approach. This includes evaluating the evidence supporting each requirement, identifying deficiencies and calculating an assessment score according to the CMMC scoring methodology.
The Level 2 self-assessment, step by step
- Confirm the assessment scopeIdentify the systems within your defined CMMC assessment scope.
- Keep the SSP currentDescribe systems, security controls and implementation approach.
- Evaluate the evidenceReview the evidence supporting each requirement.
- Identify deficienciesRecord gaps against the applicable requirements.
- Calculate the scoreApply the CMMC scoring methodology.
- Enter results in SPRSRecord the assessment and the required affirmation.
Results must then be entered into the SPRS, the official DoW repository for storing and retrieving supplier and product performance information. While Level 2 assessments are conducted every three years, affirmations are required following the assessment and annually thereafter. Because contractual assessment and status requirements may differ, you should verify your requirements against both your contract and current DoW guidance.
The Level 2 self-assessment cycle
Assessment year
Level 2 self-assessment
Results entered in SPRS, followed by an affirmation
Year 1
Annual affirmation
Affirm continuous compliance
Year 2
Annual affirmation
Affirm continuous compliance
Year 3
Next self-assessment
The three-year cycle begins again
Configuration evidence that stays current
Keep hardened configurations aligned between assessments
ConfigOS automates configuration implementation, remediation and continuous monitoring to support CMMC readiness.
Where Self-Assessments Are Hardest to Sustain
The most challenging part of a CMMC self-assessment is maintaining your documented security posture between assessments. A system may meet a configuration requirement when evaluated, but subsequent software updates, administrative changes or inconsistent settings can introduce vulnerabilities or cause the system to drift from its approved baseline.
Each can move a system away from its approved baseline.
Configuration-related requirements demand particular attention. You need to demonstrate security settings are implemented consistently and remain effective across the systems in scope. That includes validating configurations, correcting deviations and retaining evidence that reflects actual operating conditions.
The same principle applies to the SSP and assessment results. Documentation that no longer reflects the production environment undermines the value of the assessment.
Annual affirmation
Equally important, annual affirmations are a formal representation of continuous compliance, not simply an administrative renewal. You should have reliable evidence supporting your affirmation before submitting it in SPRS.
Why Sustained Readiness Is the Right Plan
The DoW’s suspension reflects an interest in reducing unnecessary administrative burdens, while preserving effective cybersecurity. The suspension does not remove the need to maintain required safeguards between assessments.
A sustainable readiness program helps you meet existing obligations while preparing for potential changes. It includes maintaining accurate system inventories, reviewing security controls regularly, tracking remediation and monitoring changes that could affect compliance.
What a sustainable readiness program maintains
Even if CMMC’s third-party assessment requirements return in a modified form, the underlying technical work will remain. Cybersecurity Awareness Month is a timely reminder that compliance depends on what organizations do every day, not just what they document before an assessment.
How Automation Supports CMMC Readiness
SteelCloud’s ConfigOS platform provides unified, customizable automation for security configuration implementation, remediation, validation and continuous monitoring. It helps you apply approved security settings consistently, identify configuration drift and generate repeatable technical evidence to support compliance efforts. It can help lean security teams sustain their NIST SP 800-171 implementation over time.
ConfigOS supports
Technical configuration readiness
- Configuration implementation
- Remediation
- Validation
- Continuous monitoring
- Repeatable technical evidence
Also part of CMMC Level 2
Program-level safeguards
- Policies and procedures
- Access controls
- Personnel practices
- Other required safeguards
Hardened configuration implementation is only one part of CMMC Level 2, however. Policies, procedures, access controls, personnel practices and other safeguards must also be addressed. While ConfigOS supports the technical configuration aspects of readiness, it does not independently establish compliance or guarantee a particular CMMC status.
As the CMMC program evolves, contractors that maintain accurate assessments and continuously validate security controls will be better positioned to respond. To see how SteelCloud’s unified automation can support your CMMC readiness, regardless of how assessments might change, schedule a ConfigOS demo for your team.
CMMC readiness beyond the assessment
Sustain the Configurations Behind Your Affirmation
ConfigOS helps contractors sustain hardened configurations that support CMMC readiness, however future assessment requirements take shape.
FAQ
Are CMMC Level 2 requirements still in place during the Phase II suspension?
Applicable CMMC requirements and existing contractual cybersecurity obligations remain in effect. The suspension pauses the Phase II transition and associated certification requirements. Contractors should review their contracts and current DoW guidance to determine which assessment and status requirements apply to their systems.
Does CMMC Level 2 still require a CMMC Third-Party Assessment Organization (C3PAO) assessment?
The Phase II suspension pauses the planned rollout of C3PAO assessments. Level 2 self-assessment is the applicable government assessment path during the suspension. Contractors should verify their specific contractual requirements and confirm the modification status of any existing third-party assessment requirements.
Why should we maintain continuous compliance when self-assessments are only required every three years?
Required safeguards must remain in place between assessments. Keeping security controls effective and supporting evidence current helps organizations protect CUI and support accurate annual affirmations of continuous compliance.
How often must a CMMC Level 2 self-assessment be performed?
Under the established framework, a Level 2 self-assessment is required every three years, with an affirmation of continuous compliance following the assessment and annually thereafter. Organizations should consult current program guidance and applicable contract terms for any changes.
What is SPRS, and what is recorded there?
The Supplier Performance Risk System is a government system used to record CMMC self-assessment results and required affirmations. Level 2 self-assessment records include information such as the assessment scope, status date, applicable identifiers and overall assessment score.
The Dopamine of Passing the Audit
Prev post
Featured Resources