CMMC 2.0 Level II is Temporarily Suspended. Cybersecurity Compliance is Not.

What the CMMC Phase II Suspension Means for Defense Contractors and Their Customers

The Department of War (DoW), formerly the Department of Defense, has temporarily suspended the planned Phase II rollout of the Cybersecurity Maturity Model Certification (CMMC) program, including the transition that would have made third-party C3PAO Level 2 assessments mandatory beginning November 10, 2026.

For companies in the Defense Industrial Base, however, the announcement should not be interpreted as a suspension of cybersecurity requirements.

The government has suspended the third-party verification requirement. It has not suspended the underlying obligation to protect Controlled Unclassified Information (CUI).

What Changed With CMMC 2.0?

On July 13, 2026, the Department announced the immediate suspension of CMMC Phase II requirements and established a 60-day CMMC Reform Task Force to review the program and reduce its cost and administrative burden.

During the review, the transition to Phase II and pending or future CMMC implementation milestones have been suspended. Cybersecurity requirements will continue to be enforced through self-assessments and select government-led assessments.

What Hasn't Changed?

The underlying cybersecurity obligations remain. When incorporated into an applicable contract, DFARS 252.204-7012 continues to require defense contractors and subcontractors to safeguard covered defense information and implement applicable NIST SP 800-171 security requirements.

• Phase I self-assessment requirements remain in effect.

• Contractors must maintain accurate assessment information and, where required, report assessment scores through SPRS.

• Companies are still encouraged to continue assessing and working toward certification.

• Delaying third-party verification is not permission to delay cybersecurity.

San Francisco Circuits achieved final CMMC 2.0 Level 2 status on May 8, 2026, following an independent C3PAO assessment. The suspension doesn't change the work we've completed, the controls we've implemented, or the value of independently validated cybersecurity for our customers.

For buyers of mission-critical boards, cybersecurity should be at the forefront of vendor requirements. There is a meaningful distinction between relying primarily on a supplier's self-assessment and working with one that has already completed an independent C3PAO Level 2 assessment.

The CMMC timeline may change. Our commitment to protecting our customers' information won't.

Read more about the CMMC 2.0 Level II suspension and what it means for cybersecurity compliance here