R1-10 · backs slide 2, 9, 34
R1-10 CMMC status memo
Supports slide 2, 9, 34.
The first draft of this pitch leaned on a date: CMMC Phase 2 starting 10 Nov 2026. That date is gone. Here’s what moved and what didn’t.
What happened
On 13 Jul 2026, a DoD CIO memo suspended CMMC Phase 2 third-party assessments, and the 10 Nov 2026 start, “until further notice”. It set up a 60-day CMMC Reform Task Force review and opened a request for information (DoDCIOReformingCMMCforDIB001, closed 14 Aug 2026).
What didn’t move
| Obligation | Status, Oct 2026 |
|---|---|
| CMMC Phase 1 self-assessments | In force |
| NIST SP 800-171, required by DFARS 252.204-7012 | In force |
| CMMC Phase 2 third-party (C3PAO) assessments | Suspended since 13 Jul 2026 |
| DISA STIGs | Published continuously |
The deadline is gone. The work isn’t.
What it changed for us
- I stopped selling against a date. Slides 2 and 9 lean on buying behaviour instead (R1-09).
- None of the three growth drivers on slide 34 is a regulatory date. If Phase 2 comes back, it’s upside, not the base case.
- The CMMC content on STIGViewer carries a status note: it’s useful for planning, and it doesn’t read as a current contractual mandate at Phase 2. STIGViewer maps and plans compliance. It never attests to it.
Not yet evidenced: the GAO decision of 21 Sep 2026. The slide 9 footer cites it at pp. 32 to 33. The PDF was rate-limited when I tried to read it, so its number and wording aren’t in this pack yet. The suspension itself is confirmed by the three sources below.
Sources
- Federal News Network, “Pentagon suspends CMMC phase two requirements, launches review of program”, Jul 2026: federalnewsnetwork.com/cybersecurity/2026/07/pentagon-suspends-cmmc-phase-two-requirements-launches-review-of-program/
- Greenberg Traurig, “DoD suspends CMMC deadlines and seeks to reassess requirements”, Jul 2026: gtlaw.com/en/insights/2026/7/dod-suspends-cmmc-deadlines-and-seeks-to-reassess-requirements
- DLA Piper, “Department of War suspends CMMC Phase 2 assessment requirements: top points”, Aug 2026: dlapiper.com/en/insights/publications/2026/08/department-of-war-suspends-cmmc-phase-2-assessment-requirements-top-points
- STIGViewer CMMC ingest notes, 16 Jul 2026 (
Taskade/STIGViewer/11 – Project Knowledge/2026-07-16-cmmc2-ingest-sources.md): the catalog status note. - STIGViewer post brief “Relief or Robbed?”, 14 Jul 2026: the memo and the RFI.