Last updated: October 26, 2026
A defense contractor can state its current CMMC level, the date of its latest assessment, and the standard it was assessed against, because each is a checkable fact. Phase 1 self-assessments have applied since November 10, 2025. On July 13, 2026, the Department of War (formerly the Department of Defense) suspended Phase 2, the third-party assessment step due November 10, 2026, so public claims should name who performed each assessment.
Key takeaways
- CMMC Phase 1 self-assessment requirements remain in effect, and Phase 2 third-party assessments are suspended with no restart date.
- Any public CMMC statement should match the contractor's record in the Supplier Performance Risk System (SPRS).
- A cyber incident affecting covered defense information must be reported to the Department of War within 72 hours of discovery, so the communications plan has to be ready first.
In this guide
- Where each CMMC phase stands
- Using CMMC status in PR messaging
- What happens when a claim is wrong
- Communicating a cyber incident
- Measuring whether messaging works
- Frequently asked questions
Where Does Each CMMC Phase Stand Today?
Phase 1 of the Cybersecurity Maturity Model Certification program is in effect, and Phases 2 through 4 are suspended. The Department of War announced the suspension on July 13, 2026, and said Phase 1 self-assessment requirements stay in place, according to the War Department's announcement.
| Phase | Original start | What it requires | Status |
|---|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 and Level 2 self-assessments in applicable solicitations, with posting in SPRS | In effect |
| Phase 2 | November 10, 2026 | Third-party Level 2 certification for contracts involving controlled unclassified information | Suspended |
| Phase 3 | November 2027 | Level 3 assessments by the Defense Industrial Base Cybersecurity Assessment Center | Suspended |
| Phase 4 | After Phase 3 | Full implementation across applicable contracts | Suspended |
The suspension moved from policy toward binding rule in September. Washington Technology reported on September 9, 2026, that a September 3 memo from John Tenaglia, DoD's principal director for defense pricing, contracting and acquisition policy, directed contracting officers to remove third-party assessment requirements from contracts under a class deviation.
A CMMC Reform Task Force was given 60 days from July 13 to review the program. Industry trackers reported that its report reached the Department of War CIO around September 11 and had not been published as of mid-October. Until the Department publishes it, no restart date exists.
Does a Contractor's CMMC Status Belong in Its PR Messaging?
Yes, a contractor's CMMC status belongs in its PR messaging when the statement is specific and matches the SPRS record. A reporter or contracting officer can verify a level and a date, but nobody can verify a general promise.
For example, "our Level 2 self-assessment was posted in SPRS in March 2026" can be checked. "We take cybersecurity seriously" cannot. The same discipline applies to the suspension: a contractor should not describe a third-party certification as pending or required when the requirement is suspended, and should not describe voluntary certification work as a mandate.
Messaging should also name the technical baseline. NIST Special Publication 800-171 supplies the security requirements behind Level 2, and the Phase 1 Level 2 self-assessment is measured against it, according to law firm summaries of the Department's rollout.
What Happens When a Self-Assessment Claim Turns Out to Be Wrong?
A wrong self-assessment claim can lead to False Claims Act liability, and a public statement repeating it adds to the record. Washington Technology reported that in June 2026 the Justice Department settled with the Alabama contractor Logzone for roughly $500,000 after a Defense Department audit found the company's near-perfect self-assessment score was wildly inaccurate.
The practical rule for communications teams is that no CMMC sentence goes live until the person who signs the annual affirmation has read it. That person is a named senior official, and the affirmation is submitted alongside the score in SPRS.
Spokespeople should also avoid rounding up. A contractor that has completed part of its remediation plan should say so, with the date, instead of describing itself as compliant.
How Should PR Teams Communicate a Cyber Incident?
PR teams should communicate a cyber incident by describing operational impact and response steps, not technical mechanism, and only after the contractor's reporting duty is met. DFARS 252.204-7012 requires a contractor to report an incident affecting covered defense information within 72 hours of discovery, through the DoD's DIBNet portal.
That deadline shapes the communications plan. Holding statements, approval chains, and spokesperson names have to exist before an incident, because the first 72 hours are consumed by investigation and reporting. The clause text is available in the DFARS clause library.
Practice makes the plan usable, so rehearse these steps in a tabletop exercise before an incident happens, and correct any false claims promptly afterward.
- Name the person who approves external statements during an incident.
- Draft a holding statement that mentions impact and response only.
- Confirm with counsel which details the contract bars from release.
- Route every media call to one spokesperson until the report is filed.
How Can a Contractor Measure Whether CMMC Messaging Works?
A contractor can measure CMMC messaging by tracking checkable outcomes: accurate coverage of its status, questions from contracting officers and primes, and contract award and renewal rates. Counting media mentions alone shows reach but not whether buyers believe the claim.
Our guide to measuring PR effectiveness explains how to set a baseline before changing the message. For firms building a wider cybersecurity communications program, our cybersecurity PR services page outlines the scope, and our defense PR page covers the sector more broadly.
Check the Department of War's announcements before each update to a CMMC statement, because the program's rules have shifted repeatedly since July.
Frequently asked questions
What is CMMC and why does it matter for defense PR?
CMMC, the Cybersecurity Maturity Model Certification, is the Department of War program that checks whether defense contractors protect federal contract information and controlled unclassified information. It matters for PR because a contractor's level, assessment date, and assessor are checkable facts, unlike a general claim of strong cybersecurity.
Is CMMC Phase 2 still suspended?
Yes, as of the most recent reporting found for this update in mid-October 2026. The Department of War suspended Phase 2 on July 13, 2026, and no restart date has been announced. Phase 1 self-assessment requirements remain in effect.
What NIST standard sits behind CMMC Level 2?
NIST Special Publication 800-171 sets the security requirements that Level 2 assessments measure. Contractors can cite it directly when describing their security measures to media or government audiences.
How fast must a contractor report a cyber incident?
DFARS 252.204-7012 defines rapid reporting as within 72 hours of discovery of a cyber incident affecting covered defense information. The report goes through the DIBNet portal.
Can a contractor still announce a CMMC certification?
Yes, if the announcement is accurate, names the assessor and the date, and matches the SPRS record. Contractors should not imply that the suspended third-party step is currently required. This guide describes communications practice and is not legal advice.
