Program status, as of 13 July 2026
On 13 July 2026 the Department of War announced an immediate suspension of CMMC Phase II requirements. Those requirements were scheduled for 10 November 2026. All Phase I self-assessment requirements remain. The About page states that implementation is paused in Phase 1. It can require only self-assessments at two levels.
The same page states that this pause does not eliminate the safeguarding obligation in DFARS clause 252.204-7012. During the review, the Department will enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. The habit is to re-check dodcio.defense.gov/CMMC/ before a later date is treated as settled. Reform-task-force changes after this review date are unknown until that hub states otherwise.
What category this is
CMMC is the Cybersecurity Maturity Model Certification program. With CMMC, the Department of War verifies that Defense Industrial Base contractors and subcontractors safeguard two types of information. Those types are Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Assessments check implementation. The level flows through the contract.
Official pages use the Department of War (DoW) brand. They still speak to the historical Defense Department program. FISMA is a different lane. That lane is agency information-security management, not this contractor assessment program.
FCI and CUI
FCI, in the FAR 4.1901 theme on the About page, is information not intended for public release. It is provided by or generated for the Government under a contract to develop or deliver a product or service. It excludes information the Government provides to the public and simple transactional information.
CUI, in the 32 CFR 2002.4 theme on the same page, is information the Government creates or possesses. It is also information that an entity creates or possesses for the Government. A law, regulation, or Government-wide policy requires or permits an agency to handle that information with safeguarding or dissemination controls. Categories are on the official registry.
Levels 1 and 2 under the Phase I pause
Level 1 (Self) is basic safeguarding of FCI. It includes the 15 security requirements in FAR clause 52.204-21, an annual self-assessment, and an annual affirmation. Results go in the Supplier Performance Risk System (SPRS). The About page states that a plan of action and milestones is not permitted at Level 1.
Level 2 (Self) is broad protection of CUI. It includes the 110 security requirements in NIST SP 800-171 Revision 2. It also includes a self-assessment every three years and an annual affirmation, again in SPRS. 32 CFR 170.14 states that the Level 2 security requirements are identical to NIST SP 800-171 R2. Plan-of-action rules exist in the program text.
Level 3 remains in the model. Section 170.14 selects enhanced requirements from NIST SP 800-172 (February 2021) for that level. While Phase II is suspended, a solicitation can require only Level 1 (Self) or Level 2 (Self). An SPRS screenshot is not a status that lasts forever.
Not FedRAMP, and not a NIST badge
FedRAMP is a different program. It is a standardized, reusable authorization path for cloud products and services that federal agencies use. A map of a system to NIST SP 800-53 or to the Cybersecurity Framework does not finish CMMC.
CMMC Level 2, in the current program text, aligns to SP 800-171 Revision 2 even though NIST published Revision 3.
Sort the three lanes, then ask contracts
Contractor self-assessment program, cloud product Authorization program, and NIST special publication are three sorts.
At work, the team asks the contracts lead which CMMC level language appears in active solicitations. That question stays private.
CMMC, FedRAMP, and NIST are not one badge
| Phrase people use | Literacy correction |
|---|---|
| We are CMMC, FedRAMP, and NIST compliant, as one blob. | CMMC is the Department of War contractor assessment program for safeguarding Federal Contract Information and CUI. FedRAMP is the federal cloud Authorization program for cloud products and services used by agencies. SP 800-171 is the NIST set of recommended security requirements for CUI in nonfederal systems. Implementation of pieces of a NIST special publication is not program Status and is not a FedRAMP Authorization. |
| 800-171 Rev. 3 is what CMMC Level 2 assesses today. | The CMMC About page and 32 CFR 170.14 frame Level 2 security requirements as NIST SP 800-171 Revision 2. NIST also published SP 800-171 Rev. 3 (Final, 14 May 2024). The edition in a contract or program can lag the latest NIST Final. Revision 2 and Revision 3 are not one edition. |
| CMMC Phase II is mandatory everywhere now. | Phase II requirements were scheduled for 10 November 2026. The Department of War suspended them on 13 July 2026. Phase I self-assessment requirements remain. The habit is to re-open the official CMMC hub before a timeline is treated as current. Later reform-task-force dates are unknown until that page states otherwise. |
Common misconceptions
CMMC is the same as FedRAMP.
CMMC is the contractor assessment program for FCI and CUI. FedRAMP is the federal cloud Authorization program.
If we map to NIST SP 800-53 or the Cybersecurity Framework, CMMC is done.
Those are different maps. CMMC Level 2, in current program text, follows NIST SP 800-171 Revision 2. A framework row is not CMMC Status.
Phase II third-party certification is currently required in all new Department of War contracts.
The Department of War suspended Phase II on 13 July 2026, and Phase I self-assessments still apply.
CMMC Level 2 assesses SP 800-171 Rev. 3.
The About page and 32 CFR 170.14 point Level 2 at NIST SP 800-171 Revision 2. Revision 3 is the current NIST Final. The program did not collapse the two.
An SPRS score screenshot means we are certified forever.
SPRS is where self-assessment results are entered. Level 2 status is time-limited in the program table, and an annual affirmation can lapse. A screenshot is not a permanent Status.
Sort three lanes
| Regime | Lane | What the fact is |
|---|---|---|
| CMMC | Contractor assessment program for FCI and CUI | Under the Phase I pause, Level 1 is FCI and FAR 52.204-21. Level 2 is CUI and SP 800-171 Revision 2. Phase II was suspended on 13 July 2026. |
| FedRAMP | Cloud product Authorization program | A federal path for cloud products and services used by agencies. |
| NIST SP 800-171 | NIST publication for CUI in nonfederal systems | Revision 3 is the 14 May 2024 Final. The publication is not CMMC Status. |
CHECK THE CATEGORY
Which statement separates the CMMC contractor assessment lane, FedRAMP, and NIST SP 800-171 accurately under the current program status?
Glossary and nearby pages
Use the agency page in the sources for the authoritative text.