Compliance policy status
The dates that actually drive Defense Industrial Base decisions right now — what is in effect, what is proposed, what is suspended, and what is still pending. Built from officially published sources only.
Policy is moving faster than most compliance plans can absorb. This page exists so you can check the state of play in one place, then go read the primary source. It records only officially published items — direction that has been reported but not published belongs in a conversation with your contracting officer, not in a plan. Always verify against your own solicitation, contract, and flowdowns.
POLICY-CMMC-SUSPENSION in 40 seconds
The problem, the plain-words meaning, three key moves, and what “done” looks like.
- EFFECTIVE
CMMC Program Rule established
32 CFR Part 170 established the CMMC Program architecture — the levels, assessment types, scoping rules, POA&M limits, scoring, and affirmation requirements. This rule has not been repealed.
- EFFECTIVE
CMMC acquisition rule effective — Phase I begins
The acquisition rule took effect and Phase I implementation began. Requiring activities began including Level 1 and Level 2 self-assessment requirements in solicitations where FCI or CUI is anticipated.
- PROPOSED
Government-wide FAR CUI rule proposed
The FAR Council published a revised government-wide CUI proposal within the broader FAR overhaul (91 FR 37550). It would extend a common CUI method across executive-agency acquisitions and points at NIST SP 800-171 Revision 3. It is a proposed rule, not an operative clause.
- SUSPENDED
CMMC Phase II transition suspended
The Department suspended the Phase II transition during a 60-day program review. Level 2 (C3PAO) and Level 3 (DIBCAC) requirements may not be designated; affected solicitations and contracts are to be amended or modified. November 10, 2026 is no longer an operative transition date.
- COMMENT DEADLINE
Comments closed on the FAR overhaul / CUI proposed rule
The public comment period for the June 2026 proposed rule closed. No final-rule date has been announced.
- RFI DEADLINE
CMMC program-review request for information closes
Industry feedback to the CMMC reform task force is being collected through a public request for information. This is the formal channel for contractors to put cost, capacity, and implementation evidence in front of the review.
- REVIEW ENDS
60-day program review concludes
Approximately sixty days from the July 13 suspension. Further CMMC guidance was promised after the review; treat the end of the review as the point to re-read direction, not as an automatic restart date.
- PENDING
Revised phase schedule — not yet published
No replacement phase schedule has been published. Any specific future certification date you hear before official guidance is issued should be treated as rumor, not planning input.
This is an independent summary of public rulemaking and program status for orientation. It does not establish compliance, interpret your contract, or substitute for counsel. Clause applicability must be verified against the solicitation, contract, order, and flowdowns.
Brief your leadership in ten minutes
The same analysis as an editable PowerPoint deck — what changed, what did not, the numbers that still govern, the three layers, the four gates, and a 30-day action list. Speaker notes included on every slide. Use it internally, with your board, or with your supply chain.