CMMC Phase 2 Is Paused. Phase 1 Isn't.

What still applies while CMMC Phase 2 is under review, four things to confirm now, and the questions that show whether your IT providers fit your assessment.

Get the PDF ↓

CMMC Phase 2 Is Paused. Phase 1 Isn't. cover

What You’ll Learn

CMMC Phase 2, which would have required third-party Level 2 certification from November 10, 2026, was suspended in July for a review. It wasn’t repealed: the program rule and the Phase 1 self-assessment requirements still apply, and so do the DFARS clauses already in your contracts. This checklist shows where things stand as of November 2026, the four things to confirm now, and the questions that tell you whether your managed service and cloud providers fit inside your assessment. Adapted from Telarus. Status update, provider questions and checklist by ITBroker.com. Informational, not legal advice.

Where CMMC stands as of November 2026, and what's still required by contract
Four things to confirm now: your score, your SPRS posting, your SSP and POA&M, and flow-down
Why no tool is "CMMC compliant," and why your providers are inside your assessment
Five questions to ask every MSP and cloud provider that touches CUI or FCI
A one-page readiness checklist