CMMC Deadlines Just Shifted: What North Carolina Defense Contractors Should Do in 2026
Quick answer: The CMMC deadline for 2026 didn’t disappear. It moved. In July 2026, the Department of War paused the shift to third-party (C3PAO) certification, and DFARS Class Deviation 2026-O0025, Revision 3, made that pause official on September 3, 2026. You still owe all 110 NIST SP 800-171 controls, a current SPRS score, and an annual affirmation, and CMMC clauses become automatic on November 10, 2028.
Updated October 2026
What changed with CMMC in 2026?
CMMC changed twice this year. On July 13, 2026, a Department of War CIO memo suspended Phase 2, the step that would have required C3PAO certification for most Level 2 contracts. On September 3, 2026, Revision 3 of the class deviation wrote that pause into DFARS Part 240, the rules contracting officers follow.
The pause removed the assessor, not the requirement. Level 1 and Level 2 can now be met through self-assessment, but your obligation to protect CUI hasn’t changed.
What is the CMMC deadline for 2026 and beyond?
| Date | What happens |
| December 16, 2024 | CMMC Program rule (32 CFR Part 170) takes effect |
| November 10, 2025 | DFARS CMMC clause takes effect (Phase 1) |
| July 13, 2026 | Phase 2 transition to C3PAO certification paused |
| September 3, 2026 | Class Deviation 2026-O0025, Revision 3, codifies the pause |
| Now until November 9, 2028 | CMMC clause added case by case when a program office requires a level |
| November 10, 2028 | CMMC clause automatic on contracts involving FCI or CUI |
What did not change?
- DFARS 252.204-7012 and NIST SP 800-171. All 110 controls still apply to covered defense information.
- SPRS checks. Contracting officers must confirm a current CMMC status in SPRS before award, option exercise and extensions, and they will hold those actions if your status has lapsed.
- DoD assessments. DoD can still run Medium and High NIST SP 800-171 assessments, and DCMA results take priority over your own score.
- 32 CFR Part 170. The CMMC Program rule was not rescinded.
- False Claims Act exposure. A self-attested score is a statement the government relies on. Civil penalties run $14,308 to $28,619 per claim, as adjusted July 2025.
Why does self-assessment raise the stakes?
With no third-party assessor, the affirming official’s signature is now the only verification. If your SPRS score overstates your controls, that gap is a potential false claim, not just a failed audit. In short, the pause shifted the risk of a weak assessment from the assessor to your leadership.
What should North Carolina defense contractors do before the next CMMC deadline?
- Review live contracts. Flag any contract or bid with C3PAO language. Revision 3 says these must be modified before the next option period or at the next administrative modification.
- Map your CUI. Document where CUI is stored, processed and sent, including cloud and email.
- Score against all 110 controls. Use the DoD Assessment Methodology so your SPRS number holds up under a DCMA review.
- Update your SSP and POA&M. Your System Security Plan and Plan of Action and Milestones are the evidence behind your affirmation.
- Close the riskiest gaps first. Prioritize MFA, logging, access control and incident response.
- Check your subcontractors. Flow-down obligations are unchanged. Subs handling FCI or CUI must meet the matching level.
Frequently asked questions
No. It paused third-party certification and allows self-assessment for Level 1 and Level 2. The CMMC Program rule and DFARS 7012 remain in effect.
No. Program offices can still add CMMC requirements case by case, and SPRS status is checked before awards and option exercises. November 10, 2028 is when clauses become automatic.
No. Self-assessment, SPRS scores, and annual affirmations still apply. Stopping now raises False Claims Act risk.
Have it reviewed now. Revision 3 directs contracting officers to remove or revise that language at the next option or administrative modification.
Yes. Primes must flow down requirements, and any sub that handles FCI or CUI must meet the level tied to that data.
Get audit-ready while assessments are paused
The pause gives you time to get your score right before assessors return. Tego is a Raleigh-based IT and compliance partner and a prime contractor on the North Carolina Statewide IT Contract. Start with a CMMC Discovery Assessment, or see our full security, audit, and compliance services.
Sources: DFARS Revision 3 explained (Kiteworks) · DoD CIO CMMC · NIST SP 800-171