Where the rules stand · July 13, 2026
Suspended: CMMC Phase II third-party assessments, plus all later phases and pending milestones.
In force: NIST SP 800-171 Rev 2, DFARS 252.204-7012, Phase 1 self-assessments, and the annual SPRS affirmation — signed by a named affirming official.
You sign the SPRS affirmation alone now. What are you signing on the basis of?
DoD suspended the third-party CMMC assessment on July 13, 2026 — and kept the standard. NIST 800-171 compliance is still the requirement, and your annual affirmation of it is now a claim you make and defend without an assessor's co-signature. This self-assessment shows you where that claim is strongest and weakest, across twelve control areas.