CMMC Changed in 2026. Here Is What Contractors Should Check Now.

If a contractor’s planning calendar still has “CMMC Phase II: November 10, 2026” marked as an approaching milestone, it needs a fresh review. On July 13, 2026, the Department of War announced the suspension of Phase II. The Chief Information Officer’s current CMMC page also states that Phase I self-assessment requirements remain in place. Read the current official CMMC notice.

For Coastal Virginia companies working in the defense supply chain, the useful response is to check the requirements attached to their actual work. A schedule change is a reason to revisit assumptions, spending and evidence—not to stop protecting information.

What the official guidance says

The implementation memorandum directs use of Level 1 or Level 2 self-assessment requirements during the suspension and retains DFARS 252.204-7012 safeguarding and cyber-incident-reporting requirements. It also directs changes to affected solicitations and contracts through the responsible officials. The memorandum distinguishes protection of Federal Contract Information from requirements associated with Controlled Unclassified Information. Read the implementation memorandum.

This article reflects the official materials reviewed September 30, 2026. Check the CIO page for subsequent guidance, then check the solicitation, amendments and contract documents governing your work. A news summary cannot establish the requirements of an individual procurement.

Start with the documents you actually have

Create a short list of active contracts, upcoming options, solicitations and subcontract requests that mention CMMC or related cybersecurity requirements. Record the document date, applicable clauses, named assessment requirement and the person responsible for resolving questions.

If an older document and the new guidance appear inconsistent, ask the contracting officer or the responsible prime-contractor contact about the applicable amendment or modification. Keep that answer with the procurement record. Do not treat a headline as though it has rewritten a signed document.

Know where the information goes

A useful internal review begins with a simple workflow: where information arrives, who can access it, where it is stored and how it is shared. Include the outside providers and systems involved in the work. The person running operations and the person administering technology may each know parts of the picture that the other does not.

For example, reviewing the main server alone may miss files routinely exchanged through email or a supplier portal. Map the actual working process before deciding what a service provider’s assessment or support package needs to cover.

This is an organizational step, not a substitute for an assessment. Its value is making the next technical conversation specific.

Keep evidence connected to responsibility

Maintain a list of the controls and records applicable to your work, the person responsible for each and the date of the last review. Where an outside provider performs a task, identify what that provider supplies and what your company must still do.

A service invoice or a product license does not, on its own, show that a requirement has been met. Ask for an explanation of the scope, evidence and remaining customer responsibilities. Make sure the person signing an affirmation has a reliable basis for the statement being made.

Revisit purchases with better questions

The changed timetable may affect the purpose or timing of a proposed service. Before committing to a package, ask the provider to separate work needed for current obligations from preparation tied to a future policy decision.

• Which current contract or solicitation requirement is this work intended to address?
• What systems and information are included in the proposed scope?
• What evidence and deliverables will our company receive?
• Which tasks remain our responsibility after the engagement?
• How will the scope change if official guidance changes again?

These questions help an owner compare proposals without assuming that every certification-related purchase is equally urgent. They also help prevent work from falling between the business, its technology provider and its contracting team.

A practical next meeting

Bring operations, technology and contracting responsibilities into one conversation. Review the document list, information workflow, unresolved questions and next actions. Give each action an owner and a date. Escalate contract interpretation to the responsible contracting official or qualified counsel, and technical scope questions to an appropriately qualified cybersecurity professional.

Continue with CVA’s shipbuilding supplier guide and opportunity review checklist. The immediate goal is a current, documented understanding of the work you are pursuing and the information you must protect.