The audit is paused. What you affirm is not.
CMMC Phase II is suspended — but self-assessment, the SPRS affirmation, and False Claims Act liability are all still in force.
On 13 July 2026 the Department of War suspended CMMC Phase II — the third-party (C3PAO) Level 2 and DIBCAC Level 3 assessments that were to begin 10 November 2026. It is real, and it is hardened: the suspension now rides a binding DFARS class deviation (2026-O0025, Rev 3, 3 Sep 2026), not just a policy memo.
It is easy to read that as “CMMC went away.” It did not. Still firmly in force:
- DFARS 252.204-7012 — the duty to safeguard covered defense information.
- NIST SP 800-171 Rev 2 — enforced through DIB self-assessments and select government-led reviews.
- Level 1 and Level 2 self-assessment and the SPRS affirmation.
- False Claims Act liability for a false or inflated self-assessment score.
What changed is the verifier, not the obligation. Under a C3PAO regime a third party validated your posture. Under self-attestation, the contractor personally signs the score and carries the liability — and nobody catches an inflated number until a DoJ or DIBCAC review does, later. Evidence and score accuracy matter more now, not less.
The audit is paused. What you affirm is not.