Aprio

United States – October 28, 2026 -- The Pentagon's suspension of CMMC Phase II third-party assessment requirements has made contractors' own self-attestations the main compliance record, raising their exposure under the False Claims Act (FCA). Mandatory C3PAO certifications remain on hold following the Department of War's class deviation, but Phase I self-attestation is still fully active.

Phase I obligations and prime contractor requirements remain in force

Contractors must still self-attest compliance with NIST SP 800-171 Rev. 2 wherever DFARS 252.204-7012 applies. The 110 controls in that standard remain the legal baseline for any organization that processes or stores controlled unclassified information (CUI).