Is CMMC Level 1 Still Required While Phase 2 Is Suspended?

Short Answer

The July 13, 2026 suspension stopped the move to Phase 2 of CMMC. It did not remove Level 1. Program managers may still put CMMC Level 1 (Self) or Level 2 (Self) in a solicitation, and the DoW CIO CMMC page states that all Phase I self-assessment requirements remain in place. When a solicitation calls for Level 1, a current self-assessment and affirmation in SPRS are still needed before award. FAR 52.204-21, which appears as 52.240-93 under the FAR overhaul deviation, applies on its own terms either way.

Why the Confusion Exists

On July 13, 2026, the Department of War suspended the transition to Phase 2 of CMMC, which had been scheduled for November 10, 2026. News that CMMC was paused is easy to read as meaning nothing is required now. The suspension is narrower than that.

The memoranda use broad words. Attachment 1 to the implementing memorandum says the upcoming November 2026 transition to Phase 2 of CMMC implementation is suspended. The same attachment then says program managers may still require Level 1 and Level 2 self-assessments.

A second date adds to it. DFARS 204.7504 mentions November 9, 2028 and November 10, 2028, which can read like a new deadline. Those dates came from the DFARS rule published on September 10, 2025 and effective November 10, 2025, before the suspension.

What the Current Authority Says

The CMMC rule phases the program in under 32 CFR 170.3(e). Phase 1 begins on the effective date of the DFARS CMMC rule, and in Phase 1 DoD intends to include Level 1 (Self) or Level 2 (Self) as a condition of award. Phase 2 begins one calendar year after Phase 1. The DoW CIO CMMC FAQs date the start of CMMC requirements in procurements to November 10, 2025 (A-A1).

The memorandum of the Department of War Chief Information Officer dated July 13, 2026 suspends the November 2026 transition to Phase 2 and directs that program managers and requiring activities only include the need for CMMC Level 1 or Level 2 self-assessments. The implementing memorandum from the Under Secretary of War for Acquisition and Sustainment, issued the same day, states in its Attachment 1 that the allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self), and that Level 2 (C3PAO) and Level 3 (DIBCAC) may not be designated during the suspension.

Attachment 1 describes Level 1 as a self-assessment requirement tied to the basic safeguarding requirements for FCI in FAR 52.204-21. It calls that clause the mandatory minimum safeguarding requirements for federal contractors or subcontractors that have FCI residing in or transiting through their information systems.

The DoW CIO CMMC page says the Phase II requirements, originally scheduled for November 10, 2026, were suspended, and that "All Phase I self-assessment requirements remain firmly in place." The DoW CIO CMMC FAQs of July 2026 say the Department suspended the transition to Phase 2 (A-A1) and suspended implementation in the first phase to review the program (D-A1).

The codified rules have not been amended. In the eCFR text current to September 30, 2026, 32 CFR Part 170 still rests on the final rule published October 15, 2024 (89 FR 83214), and DFARS subpart 204.75 on the rule published September 10, 2025 (90 FR 43574). Under DFARS 204.7504(a)(1), the CMMC clause is used until November 9, 2028 when the program office or requiring activity determines that a specific CMMC level is required. Under (a)(2), from November 10, 2028 it is used when the contractor will process, store, or transmit FCI or CUI on its information systems in performance of the contract. The same two dates appear in DFARS 240.371-5, issued under DoD class deviation 2026-O0025 and signed December 18, 2025.

Both memoranda say further guidance will follow the Department's review. Neither sets a date for the suspension to end.

What This Means

Read each solicitation. If it includes DFARS 252.204-7025 and 252.204-7021 at Level 1, you need a current Level 1 self-assessment and a current affirmation in SPRS before award. The suspension did not change that.

A solicitation without a CMMC clause has no CMMC level to meet. FAR 52.204-21, or 52.240-93 under the FAR overhaul deviation, still applies wherever it appears in the contract.

The 2028 dates in DFARS 204.7504 are not a new deadline created by the suspension. Because the program is under review, check the DoW CIO CMMC page and the eCFR for changes before relying on any date.