--- title: "CMMC Phase 2 Third-Party Assessments Are Suspended: Here's What Actually Changed" description: DoD has suspended CMMC Phase 2 third-party assessments, but not Phase 1 or your compliance obligations. Here's what actually changed. image: https://www.dragnetsecure.com/hubfs/Dragnet%20CMMC%20graphic.png --- [![Dragnet.LOGO.white-1](https://www.dragnetsecure.com/hs-fs/hubfs/Dragnet.LOGO.white-1.webp?width=2000&height=467&name=Dragnet.LOGO.white-1.webp "Dragnet.LOGO.white-1")](https://www.dragnetsecure.com/) [![Dragnet.LOGO.fullcolor](https://www.dragnetsecure.com/hs-fs/hubfs/Dragnet.LOGO.fullcolor.png?width=4688&height=1094&name=Dragnet.LOGO.fullcolor.png "Dragnet.LOGO.fullcolor")](https://www.dragnetsecure.com/) - [ABOUT](https://www.dragnetsecure.com/about-dragnet) - [SERVICES](https://www.dragnetsecure.com/services) - [GAP & RISK ASSESSMENTS](https://www.dragnetsecure.com/gap-risk-assessments) - [CMMC PROGRAM MANAGEMENT](https://www.dragnetsecure.com/cmmc-program-management) - [PENETRATION TESTING](https://www.dragnetsecure.com/penetration-testing) - [WRITTEN INFORMATION SECURITY PLANS](https://www.dragnetsecure.com/wisp) - [POLICY & PROCEDURE WRITING](https://www.dragnetsecure.com/policy-procedure) - [INDUSTRIES](https://www.dragnetsecure.com/industries) - DEFENSE CONTRACTORS & SUBCONTRACTORS - HEALTHCARE - STATE & LOCAL GOVERNMENT - FDA & PHARMACEUTICALS - MANUFACTURING - FOOD, UTILITIES, AND ENERGY - [BLOG](https://www.dragnetsecure.com/blog) - [CONTACT](https://www.dragnetsecure.com/contact-dragnet-cyber) More results [Book a Call](https://share.hsforms.com/1ftPOyOuaRH2piPrgBX02tgdidkt) [Book a Call](https://share.hsforms.com/1qMCUPd-zRf-ti2apD-peHAdidkt) [Book a Call](https://share.hsforms.com/1ftPOyOuaRH2piPrgBX02tgdidkt) - [ABOUT](https://www.dragnetsecure.com/about-dragnet) - [SERVICES](https://www.dragnetsecure.com/services) - [GAP & RISK ASSESSMENTS](https://www.dragnetsecure.com/gap-risk-assessments) - [CMMC PROGRAM MANAGEMENT](https://www.dragnetsecure.com/cmmc-program-management) - [PENETRATION TESTING](https://www.dragnetsecure.com/penetration-testing) - [WRITTEN INFORMATION SECURITY PLANS](https://www.dragnetsecure.com/wisp) - [POLICY & PROCEDURE WRITING](https://www.dragnetsecure.com/policy-procedure) - [INDUSTRIES](https://www.dragnetsecure.com/industries) - DEFENSE CONTRACTORS & SUBCONTRACTORS - HEALTHCARE - STATE & LOCAL GOVERNMENT - FDA & PHARMACEUTICALS - MANUFACTURING - FOOD, UTILITIES, AND ENERGY - [BLOG](https://www.dragnetsecure.com/blog) - [CONTACT](https://www.dragnetsecure.com/contact-dragnet-cyber) [Book a Call](https://share.hsforms.com/1qMCUPd-zRf-ti2apD-peHAdidkt) [Compliance](https://www.dragnetsecure.com/blog/tag/compliance)[CMMC](https://www.dragnetsecure.com/blog/tag/cmmc) # CMMC Phase 2 Third-Party Assessments Are Suspended: Here's What Actually Changed [![Stacy Aitken, CEO](https://www.dragnetsecure.com/hs-fs/hubfs/Dragnet%20-%20Stacy%20Aitken%20CEO.jpg?width=40&height=40&name=Dragnet%20-%20Stacy%20Aitken%20CEO.jpg)](https://www.dragnetsecure.com/blog/author/stacy-aitken-ceo) by [Stacy Aitken, CEO](https://www.dragnetsecure.com/blog/author/stacy-aitken-ceo) 3 min read Jul 15, 2026 *Here Is Why You Should Keep Your Compliance Roadmap On Track* On July 13, 2026, the [Department of War's Office of the Chief Information Officer](https://dodcio.defense.gov/CMMC/) announced the immediate suspension of Phase 2 third-party assessment requirements under the Cybersecurity Maturity Model Certification (CMMC) program. If you're a defense contractor or subcontractor, that headline probably raised your pulse. Before you shelve your compliance roadmap, here's what the announcement actually says, and why it changes less than you might think. ## **What Was Actually Suspended** The announcement is narrower than the word "suspension" might suggest. It pauses Phase 2 of the CMMC rollout: the requirement for Organizations Seeking Certification (OSCs) handling Controlled Unclassified Information (CUI) to undergo third-party assessments conducted by accredited C3PAOs. That specific certification mechanism is on hold while a newly formed CMMC Reform Task Force reviews the program and delivers recommendations within 60 days. Simultaneously, the department issued a Request for Information (RFI) inviting industry partners to weigh in on how they'll continue supporting cybersecurity while scaling production under the Arsenal of Freedom initiative. In the coming days, officials also plan to launch a "Brilliant at the Basics" campaign, which includes streamlined and practical guidance aimed at reducing cyber risk across both IT and OT environments for small and mid-size businesses. ## **Phase 1 Self-Assessments Remain Firmly in Place** This is the detail that matters most for the majority of the Defense Industrial Base (DIB): Phase 1 self-assessment requirements were explicitly called out as unaffected. If your organization is working toward Level 1 or Level 2 self-assessment, that obligation hasn't moved. The suspension applies specifically to the third-party assessment layer that was set to expand under Phase 2 [![Dragnet.LOGO.fullcolor](https://no-cache.hubspot.com/cta/default/22692413/interactive-181902145952.png)](https://www.dragnetsecure.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLyjjTAETi8SoIOYsaLJGwabW93otE0cLlQ6tuydPfAY%2FCjvi%2BBxubBKLtMCiuqkjfXqCH2bEWUqjQAqH5xHMJ6QQ%2FvCpee90bIvJzgYMHFpW2w%2BzE6S6JMM1nni%2B%2B7KHjCyotarJpCSt%2FWDQZPbdiHGAW%2BVLlgK0TNTAKhhOVpR9NDpH9Uc9hCQNrlVOkEm32TjTzUkcPskw%3D%3D&webInteractiveContentId=181902145952&portalId=22692413) ## **Compliance Isn't Optional, Only the Bureaucracy Is Changing** The department was direct on this point: safeguarding covered defense information "remains a non-negotiable legal requirement." The stated goal of this action is to cut the cost of bureaucratic compliance, not the importance of cybersecurity itself. NIST SP 800-171 obligations and DFARS 252.204-7012 safeguarding, along with incident-reporting requirements, remain in force regardless of where CMMC certification timelines land. Contractors who have already invested in third-party assessment readiness were specifically thanked and reassured that "your investments were not in vain", that work has made their organizations more resilient independent of the certification mechanism. For contractors, that's the key takeaway: this is a pause on one certification pathway, not a rollback of the underlying security expectations that flow down through DoD contracts. ## **What This Means for Your Organization Right Now** Until the Reform Task Force issues its recommendations, treat this as a window rather than an off-ramp. Organizations that continue tightening access controls, documenting policies, and closing gaps against NIST 800-171 will be better positioned no matter what the task force ultimately recommends for the assessment structure. Organizations that pause entirely risk having to restart momentum later and losing ground on the underlying legal safeguarding requirements that were never suspended in the first place. This is also a reasonable moment to revisit your System Security Plan (SSP), confirm your SPRS score reflects your current control environment, and make sure your policies and technical controls are still aligned, all steps that pay off under any future version of the certification framework. ## **Stay Ready for Whatever Comes Next ** The specifics of CMMC's assessment structure may still shift over the next 60 days and beyond. What won't shift is the legal requirement to protect Federal Contract Information and Controlled Unclassified Information. Dragnet is monitoring the CMMC Reform Task Force's progress and the department's RFI response closely, and we'll keep our clients and partners updated as the picture becomes clearer. If you want a clear-eyed read on where your organization actually stands, independent of which certification pathway is active this quarter, our team at Dragnet can walk through your current gap posture and help you prioritize what to work on next. Source: Department of War Office of the CIO announcement, [dodcio.defense.gov/CMMC](http://dodcio.defense.gov/CMMC) [**Schedule a CMMC Discovery Call**](https://share.hsforms.com/1WhKybYdjQ_6Y_kwCkp3VMAdidkt)   Topics: [Compliance](https://www.dragnetsecure.com/blog/tag/compliance) [CMMC](https://www.dragnetsecure.com/blog/tag/cmmc) Share this [Share on X](https://x.com/intent/post?url=https://www.dragnetsecure.com/blog/cmmc-phase-2-third-party-assessments-are-suspended-heres-what-actually-changed&text=CMMC%20Phase%202%20Third-Party%20Assessments%20Are%20Suspended:%20Here's%20What%20Actually%20Changed) [Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https://www.dragnetsecure.com/blog/cmmc-phase-2-third-party-assessments-are-suspended-heres-what-actually-changed&t=CMMC%20Phase%202%20Third-Party%20Assessments%20Are%20Suspended:%20Here's%20What%20Actually%20Changed) [Share on LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https://www.dragnetsecure.com/blog/cmmc-phase-2-third-party-assessments-are-suspended-heres-what-actually-changed&t=CMMC%20Phase%202%20Third-Party%20Assessments%20Are%20Suspended:%20Here's%20What%20Actually%20Changed) Previous story [← Your Policies Are Only as Good as the Controls Behind Them](https://www.dragnetsecure.com/blog/your-policies-are-only-as-good-as-the-controls-behind-them) ## You May Also Like These Related Stories [Policies and Procedure Writing for CMMC Compliance](https://www.dragnetsecure.com/blog/policies-and-procedure-writing-for-cmmc-compliance) ![](https://www.dragnetsecure.com/hubfs/P%26Pblogbanner%20(3).png) [Compliance](https://www.dragnetsecure.com/blog/tag/compliance) ### Policies and Procedure Writing for CMMC Compliance Oct 17, 2024 4 min read [You're a Subcontractor. CMMC Is Now Your Problem Too.](https://www.dragnetsecure.com/blog/youre-a-subcontractor.-cmmc-is-now-your-problem-too) ![](https://www.dragnetsecure.com/hubfs/Dragnet-cyber-compliance-image-main.jpg) [Compliance](https://www.dragnetsecure.com/blog/tag/compliance) ### You're a Subcontractor. CMMC Is Now Your Problem Too. May 13, 2026 4 min read [Your Policies Are Only as Good as the Controls Behind Them](https://www.dragnetsecure.com/blog/your-policies-are-only-as-good-as-the-controls-behind-them) ![your-policies-are-only-as-good-as-the-controls-behind-them-2](https://www.dragnetsecure.com/hs-fs/hubfs/your-policies-are-only-as-good-as-the-controls-behind-them-2.png?width=900&height=600&name=your-policies-are-only-as-good-as-the-controls-behind-them-2.png) [Compliance](https://www.dragnetsecure.com/blog/tag/compliance) ### Your Policies Are Only as Good as the Controls Behind Them Jul 15, 2026 3 min read ### Get Email Notifications [![Dragnet.LOGO.white-1](https://www.dragnetsecure.com/hs-fs/hubfs/Dragnet.LOGO.white-1.webp?width=2000&height=467&name=Dragnet.LOGO.white-1.webp "Dragnet.LOGO.white-1")](https://www.dragnetsecure.com) #### Dragnet is a managed security and compliance partner on a mission to bring award-winning, affordable compliance and cybersecurity to the teams that have to prove it, whatever their size. #### (804) 496-1129 #### [info@dragnetsecure.com](mailto:info@dragnetsecure.com) [ABOUT](https://www.dragnetsecure.com/about-dragnet) [SERVICES](https://www.dragnetsecure.com/services) - [Gap & Risk Assessments](https://www.dragnetsecure.com/gap-risk-assessments) - [CMMC Program Management](https://www.dragnetsecure.com/cmmc-program-management) - [Written Information Security Plans](https://www.dragnetsecure.com/wisp) - [Penetration Testing](https://www.dragnetsecure.com/penetration-testing) - [Policy & Procedure Writing](https://www.dragnetsecure.com/policy-procedure) [INDUSTRIES](https://www.dragnetsecure.com/industries) - Healthcare - Defense Contractors - SMB Defense Subcontractors - State/Local Government - FDA & Pharmaceuticals - Manufacturing - Food, Utilities, and Energy [BLOG](https://www.dragnetsecure.com/blog) [CONTACT](https://www.dragnetsecure.com/contact-dragnet-cyber) [BOOK A MEETING](https://share.hsforms.com/1ftPOyOuaRH2piPrgBX02tgdidkt) [Privacy Policy](https://www.dragnetsecure.com/privacy-policy) Copyright © 2026 Dragnet, Inc. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Stacy Aitken, CEO", "url" : "https://www.dragnetsecure.com/blog/author/stacy-aitken-ceo" }, "dateModified" : "2026-07-15T20:54:16.488Z", "datePublished" : "2026-07-15T20:53:18.000Z", "headline" : "CMMC Phase 2 Third-Party Assessments Are Suspended: Here's What Actually Changed", "image" : [ "https://www.dragnetsecure.com/hubfs/Dragnet%20CMMC%20graphic.png" ], "mainEntityOfPage" : { "@id" : "https://www.dragnetsecure.com/blog/cmmc-phase-2-third-party-assessments-are-suspended-heres-what-actually-changed", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.dragnetsecure.com/hubfs/Dragnet.LOGO.fullcolor-1.webp" }, "name" : "Dragnet, Inc." } } ```