CMMC Phase 2 assessments were the point in the Cybersecurity Maturity Model Certification rollout where many defense contractors would have needed a passing third-party assessment before winning an award, not just a self-attestation. That milestone was scheduled to begin in November 2026. On July 13, 2026, the Department of Defense suspended Phase 2 and stood up a reform task force to review the program. If you sell to the DoD or sit inside a defense supply chain, the pause changes your deadline, but it does not change your obligation to protect Controlled Unclassified Information. This guide explains what Phase 2 was, what the suspension means right now, what it actually costs to prepare, and what small and mid-sized firms should do while the timeline is uncertain.
The 5 Things SMB Contractors Need to Take Away
Before we get into the mechanics, here are the five points that matter most for a 10 to 500 person contractor trying to plan around a moving target:
- Phase 2 was the enforcement step, not a new rulebook. It would have made a Certified Third-Party Assessor Organization (C3PAO) result a condition of award for Level 2 contracts. The underlying controls come from NIST SP 800-171, which has not gone away.
- The DoD paused Phase 2 on July 13, 2026. During the suspension, program offices may only require Level 1 (Self) or Level 2 (Self) assessments. They cannot mandate a Level 2 (C3PAO) or Level 3 result on new requirements.
- Your security duty is still live. Self-assessments, the DFARS 252.204-7012 safeguarding clause, and 800-171 compliance remain enforceable under existing contracts.
- A reform report is due soon. The task force is expected to submit findings around mid-September 2026, roughly 60 days after the suspension, so the program that resumes may look different from the one that paused.
- Readiness is the safe bet. Firms that keep their System Security Plan current and their evidence stable will move fast whenever assessments restart, while firms that stall will face the old scramble again, plus a probable scarcity premium on assessor availability.
Why CMMC Phase 2 Assessments Mattered to the Defense Supply Chain
CMMC Phase 2 assessments mattered because they turned a paperwork promise into a verified result that gated real contract dollars. For years, contractors self-attested to meeting NIST SP 800-171 through a score posted in the Supplier Performance Risk System. The problem was consistency: a self-reported score could reflect intent more than reality. Phase 2 was designed to close that gap by requiring independent validation for the contracts that handle sensitive data.
Under the phased plan, certification requirements would roll in over time rather than all at once. Phase 1 introduced self-assessment obligations. Phase 2 was the step that would have forced many Level 2 contractors to pass a C3PAO assessment to remain eligible. That is why the phrase carried weight across the Defense Industrial Base. A missed Phase 2 deadline did not mean a fine. It meant losing the ability to bid, which for a subcontractor can be the whole business.
The distinction between a rollout phase and a maturity level trips up a lot of teams. “Phase 2” describes when enforcement kicks in. “Level 2” describes how much security a contract demands. You can face a Level 2 requirement during any phase. Keeping those two ideas separate is the first step toward planning correctly, and it is a point we make in nearly every CMMC compliance engagement we run.
What Phase 2 Would Have Required From Level 2 Contractors
Phase 2 would have required most Level 2 contractors to hold a current C3PAO certification before receiving an award. A C3PAO is an accredited outside organization that reviews your environment against the 110 controls in NIST SP 800-171 and submits the result. That certification would typically run on a three-year cycle, with annual affirmations in between.
Some argued the C3PAO model added cost and bottlenecks for smaller vendors, since assessor capacity is finite and small firms often lack a dedicated compliance staff. Others countered that self-attestation had already proven unreliable, and that a third party was the only credible way to verify controls actually worked. Both readings hold weight. The C3PAO step raised the bar for proof, and it also raised the operational lift for the firms least able to absorb it. That tension is part of what the reform review now aims to resolve.
What a Phase 2 Assessment Actually Costs
The number that surprises most small businesses is not the assessor’s invoice, it’s everything around it. Estimates for total first-year Level 2 certification cost for a small business vary widely across sources, typically running from the low tens of thousands into six figures, with the C3PAO assessment fee itself usually representing a third or less of that total. The wide range reflects scope and existing security maturity far more than company size: a firm with a tightly bounded CUI enclave and mature controls sits at the low end, while a firm assessing its entire network from a low starting point sits at the high end.
What consistently drives the number more than the assessor’s fee:
- Scope. How much of your network touches CUI, and how many of the 110 controls you already meet, is the single biggest lever. A contractor that isolates CUI into a tightly bounded enclave shows the assessor a handful of systems and a short evidence trail. A contractor that lets CUI spread across every laptop, shared drive, and email inbox hands the assessor the entire company to evaluate.
- Documentation labor. A defensible System Security Plan maps all 110 controls to how your specific environment implements each one, and a POA&M documents every gap with a dated remediation plan. That is weeks of skilled work, not an afternoon, whether it comes from your staff or an outside partner.
- Recurring monitoring and evidence costs. Certification is a point-in-time confirmation, but the controls behind it run every day. Log storage, monitoring tooling, and the labor to review alerts and collect evidence continue long after the certificate is issued, and reassessment arrives with an annual affirmation requirement.
Budgeting only the assessor’s invoice, and skipping the readiness, remediation, and ongoing monitoring buckets, is the most common reason small firms blow past their CMMC budget.
How Phase 2 Differed From the Self-Assessment Phase
Phase 2 differed from the earlier phase in one word: verification. In the self-assessment phase, you scored your own environment and stood behind that number. In Phase 2, an assessor would validate each control against objective evidence and decide whether you passed.
This distinction matters even now, during the suspension, because a high self-assessment score does not mean you would pass a third-party review. Self-scoring and third-party verification are different bars, and the gap between them is where a lot of small firms get hurt when the requirement eventually returns. An account marked as disabled in a self-score might still authenticate. Logging marked as met might cover the servers but not the workstations where people actually open CUI. The fix is to run your self-assessment as if a stranger will demand proof of every “yes,” because eventually one will.
One view holds that self-assessment is enough for lower-risk work and that verification should be reserved for the most sensitive programs. The opposing view is that CUI is sensitive by definition, so verification should apply broadly. We do not pick a side for you here. What we tell clients is that the evidence discipline is identical either way. Whether a reviewer is you or a C3PAO, the environment still has to demonstrate control in real time, a theme we cover in our breakdown of common CMMC audit failures.
What the July 2026 Suspension Actually Changed
The July 2026 suspension changed the enforcement clock, not the security requirements. On July 13, 2026, the DoD announced it was halting the planned Phase 2 transition and launching a full review through a new reform task force. Reporting framed the decision around implementation costs and readiness concerns across the Defense Industrial Base, with the memorable line that “the math just simply doesn’t math.” The November 2026 milestone is on hold.
During the suspension, procurement rules narrow in a specific way. Program managers and requiring activities may include a need for Level 1 (Self) or Level 2 (Self) assessments in their requirement documents. They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period. In practice, that means a new solicitation should not require you to show up with a third-party certificate right now.
What did not change is more important. Phase 1 self-assessments remain in effect. NIST SP 800-171 compliance is still enforced. The DFARS safeguarding clause still binds contractors to protect covered defense information. A pause on the audit is not a pause on the duty. Treating it as a holiday is how firms end up exposed, both to a breach and to a resumed timeline that arrives faster than expected. If you want the underlying control set in plain terms, our comparison of CMMC and NIST 800-171 lays out where the two overlap and where they diverge.
Why Reading the Pause as a Cancellation Is the Costliest Trap
The suspension is dangerous precisely because it feels like relief, and treating it as a cancellation is the trap that stops every other piece of work. It is fair to argue both sides. The DoD did remove the immediate assessment gate, so a firm that reallocates its compliance budget for a quarter is making a defensible cash-flow call. But the department was explicit that it is still enforcing the underlying security standard during the review, and prime contractors are still flowing down protection requirements to their subs regardless of the assessment schedule.
Hold both of those as true and the answer gets clear. The assessment date is uncertain; the obligation is not. Keep your remediation plan funded at a maintenance level even if you throttle the pace. Keep your System Security Plan current, keep closing plan-of-action items, and keep your self-assessment honest. A firm that maintains a warm program can schedule an assessment on weeks of notice. A firm that goes cold needs six to twelve months to get back to where it was.
Who the Suspension Helps and Who It Hurts
The suspension helps firms that were behind and hurts firms that were ahead, at least in the short term. A subcontractor that had not started its C3PAO preparation just gained breathing room and avoided a near-term disqualification. That is real relief for a small shop with no compliance headcount.
The firms that invested early feel differently. A contractor that spent months and budget preparing for a November assessment now watches the deadline dissolve, and may wonder whether that spend was premature. We would argue it was not. The controls those firms built, access enforcement, logging, boundary protection, do double duty as actual security. They reduce breach risk today regardless of the assessment schedule, which is the point we make in CMMC compliance as governance, not just IT security. The work is not wasted. It just pays off on a different calendar.
Why a Pause Is Not a Cancellation
A pause is not a cancellation because the threat that created CMMC has not receded. Foreign adversaries continue to target the supply chain, and Controlled Unclassified Information remains a prize. The reform task force is reviewing how to implement the program, not whether to protect that data at all.
There is a case that the review could soften requirements meaningfully, and a case that it could resume with tighter, better-funded enforcement. We have seen federal cybersecurity mandates slip before and then return with sharper teeth. Planning your business around cancellation is a gamble on a specific political outcome inside a fixed window. Planning around eventual resumption costs you nothing you would not spend on sound security anyway. That asymmetry is why we advise clients to keep moving.
How SMBs Should Prepare for CMMC Phase 2 Assessments During the Pause
SMBs should prepare for CMMC Phase 2 assessments during the pause by treating readiness as a security project with a compliance byproduct, not the reverse. The suspension removes deadline pressure, which is exactly the condition under which good, unhurried work gets done. Here is how we sequence it for a mid-sized contractor.
First, fix your scope, in both directions. Identify every system, user, and data flow that touches Controlled Unclassified Information, and draw a hard boundary around it. Scoping too broadly means hardening and assessing your whole company, which is where a lot of the six-figure cost estimates come from. Scoping too narrowly is just as dangerous: if an assessor finds CUI living on a laptop or file share you left out of the boundary, it can invalidate the entire engagement. A tight, well-designed enclave, where CUI is confined to a controlled environment separate from your general network, is usually the right target, but only when the compliant path is also the easy path for your users, since enclaves that create friction get worked around. A zero-trust architecture helps make that boundary enforceable rather than aspirational.
Second, keep your System Security Plan and score current. The self-assessment obligation is live, so your posted score should reflect reality, not aspiration.
Third, run a gap assessment against the 110 NIST 800-171 controls and build a real Plan of Action and Milestones for anything short.
Fourth, stand up the enforcement that assessors actually check, not just the policy that describes it. A written policy and an enforced control are not the same thing, and assessors test enforcement, not intent. An access control policy is only as good as whether your identity system actually configures least-privilege in production, and whether MFA is genuinely on for everyone rather than just the people who remembered to set it up. Read a policy, then go verify the setting it describes is live. When those two disagree, the production system is your real score. We walk through the monitoring piece in CMMC logging and continuous monitoring strategies, and the resilience angle in continuous monitoring and incident response for CMMC.
Keep Your Evidence Assessment-Ready, Not Just Your Documents
Keep your evidence assessment-ready by proving controls run continuously, not by stockpiling policy documents. Assessments do not fail because a firm lacks policies. They fail because the environment cannot show the control working under real conditions on the day someone looks. This is also where the ongoing evidence trail matters: an assessor is not only asking whether a control is in place today, but whether it was in place, monitored, and maintained over time. Keep your SSP as a living document that matches your real environment, keep your POA&M as an active worklist with owners and dates, and keep your logs retained long enough to prove the story.
One school of thought says to build the documentation first and let the technical controls follow. The other says to enforce the controls first and let the evidence generate itself. In our experience the second path is sturdier, because a documented policy with no enforcement is the exact gap an assessor is trained to find. A zero-trust posture helps here, since it produces the access and verification logs an assessor wants to see, a connection we detail in how zero trust architecture strengthens CMMC compliance.
Confirm Which Assessment Type Your Contract Actually Requires
Before you budget for anything, confirm whether your contract requires self-assessment or a C3PAO result. Some Level 2 work permits self-assessment, and some mandates a third party, and the difference is set by the type of CUI and the contract language. Guessing wrong means either overspending on an assessment you did not need or, far worse, failing to meet a contractual requirement. If a prime contractor is passing a requirement down to you, ask them in writing which assessment type applies before you plan around either scenario.
Decide Whether to Pursue Certification Early Anyway
Deciding whether to certify early is a business call, not a compliance one. Some contractors will want a C3PAO result in hand the moment assessments resume, so they can bid without delay and even market the certification as a differentiator against slower competitors. That instinct has real weight beyond marketing: there are only around 100 authorized third-party assessors against well over 100,000 contractors who may eventually need one. When demand spikes near a resumed deadline, assessor calendars fill and prices rise, and firms that wait pay a scarcity premium and accept whatever schedule they can get.
The counterargument is timing risk. If the reform review changes the control set or the assessment method, an early certification could target a standard that shifts under you. There is no clean answer during a suspension. What we tell clients is to get to a state of provable readiness now, then hold on the formal C3PAO booking until the resumed rules are published. That way you carry the security benefit immediately and pull the certification trigger only when the target stops moving, ideally booking early once it does rather than joining the rush. If you would rather not weigh that alone, our team and other CMMC compliance consultants can map it to your contract pipeline. For the operational side of a Level 2 review, we also cover preparing for a CMMC Level 2 assessment without operational disruption.
Frequently Asked Questions
Are CMMC Phase 2 assessments happening in 2026?
No, CMMC Phase 2 assessments are not happening on the original 2026 schedule. The DoD suspended the Phase 2 transition on July 13, 2026, and launched a reform review of the program. New requirements may currently call only for Level 1 (Self) or Level 2 (Self) assessments, not a Level 2 C3PAO result.
Does the suspension mean I can stop working on NIST 800-171?
No. The suspension pauses the third-party assessment requirement, not your security duty. NIST SP 800-171 compliance, the self-assessment obligation, and the DFARS safeguarding clause all remain enforceable under existing contracts, so your controls and posted score still need to be accurate.
How much does a CMMC Phase 2 assessment actually cost?
Estimates vary by source and by how the estimate defines “total cost.” Figures for a small business’s first-year spend generally range from the low tens of thousands into six figures, with the C3PAO assessment fee itself typically representing a third or less of the total. Scope and existing security maturity drive the number far more than headcount does. Confirm current figures with a compliance partner before building a firm budget, since these estimates shift as the market and the reform review evolve.
Is a high self-assessment score the same as a passing C3PAO assessment?
No. A self-assessment score reflects how you scored your own environment against the 110 NIST SP 800-171 controls. A C3PAO assessment is an outside party demanding objective evidence for each control, on your live systems, with no benefit of the doubt. Confident self-scores regularly unravel the moment an assessor asks for proof, which is why the evidence discipline should be identical for both.
What is the difference between CMMC Phase 2 and CMMC Level 2?
Phase 2 refers to when enforcement rolls out across the program, while Level 2 refers to how much security a specific contract requires. A contract can carry a Level 2 requirement during any rollout phase. Confusing the two leads teams to plan for the wrong milestone.
When will CMMC Phase 2 assessments resume?
No firm restart date has been set. The reform task force is expected to submit findings and recommendations around mid-September 2026, roughly 60 days after the July 2026 suspension, and the resumed program may differ from the paused one. Watching for that report is the most reliable way to anticipate the next timeline.
Should a small contractor still hire a C3PAO now?
Most small contractors should reach provable readiness now but hold the formal C3PAO booking until the resumed rules are published. This captures the security benefit of the controls immediately while avoiding a certification aimed at a standard the review might change, and it positions you ahead of the scarcity premium that will likely hit assessor calendars once the requirement returns. The exception is a firm whose pipeline demands certification the instant assessments restart.
Talk to Mindcore About Your CMMC Readiness
The CMMC Phase 2 suspension gives defense contractors something rare: time to build compliance the right way instead of the fast way. The firms that use this window to fix their scope, tighten access control, and keep their evidence assessment-ready will be the ones bidding without friction the day the program resumes. The firms that treat the pause as permission to stop will meet the same scramble they just escaped, plus whatever the reform task force adds on top, and a smaller pool of available assessors to book. The security obligations under NIST 800-171 and DFARS never paused, so the protective value of this work is already yours to claim. Our team has guided contractors through 800-171 scoping, gap assessments, and Level 2 readiness across the Defense Industrial Base, and we can meet you wherever you are on that path. Whether you were mid-preparation when the suspension hit or have not yet started, we will help you turn an uncertain deadline into a clear plan. Book a free strategy call and we will map your CMMC readiness to your actual contract pipeline.
