On 13 July 2026 the CMMC Phase II requirements were suspended with immediate effect, two months before they were due to bite. A lot of firms read the headline and quietly closed the compliance folder. That was the wrong conclusion, and for anyone selling business cybersecurity Alexandria VA services it has been the most common conversation of the last few weeks.
Phase I self-assessment requirements remain firmly in place. The program is paused in Phase 1, not withdrawn, and the underlying obligation to protect federal information under existing contract clauses never went anywhere. For an Alexandria business in the federal supply chain, the practical position is close to what it was in June, which is why the cybersecurity work itself has not slowed down.
| Quick Answers
What actually changed in July 2026? Phase II requirements were suspended with immediate effect and a reform task force was established. Phase II had been scheduled for 10 November 2026. What did not change? All Phase I self-assessment requirements. Compliance with NIST SP 800-171 Revision 2 continues to be enforced through self-assessments and select government-led assessments. What should a contractor do this quarter? Confirm which level applies, complete or refresh the self-assessment, and make sure the affirmation is current in the Supplier Performance Risk System. Most Alexandria firms can do all three inside a fortnight. |
What the Suspension Did and Did Not Do
The distinction between a paused phase and a cancelled program is doing a lot of work here, and it is where most of the misreading among Alexandria contractors has happened.
What is still required of an Alexandria contractor?
- Phase I self-assessment requirements remain firmly in place
- Implementation is paused in Phase 1, having begun on 10 November 2025
- Compliance with NIST SP 800-171 Revision 2 is still enforced, through self-assessments and select government-led assessments
- The obligation to protect information under DFARS clause 252.204-7012 was not eliminated
- Protection requirements still flow down to Alexandria subcontractors holding the same information
- A reform task force is reviewing the program, so the shape of Phase II may change rather than disappear
Every one of those points is stated on the official CMMC program information, which is worth reading directly rather than through a vendor summary. Alexandria sits close enough to the contracting community that misinformation travels fast here.
The Two Levels, and What Each One Costs You in Effort
Which level applies, and what does it involve?
| Requirement | Level 1 (Self) | Level 2 (Self) |
| Information protected | Federal Contract Information | Controlled Unclassified Information |
| Source of requirements | 15 in FAR clause 52.204-21 | 110 in NIST SP 800-171 Revision 2 |
| Assessment frequency | Annual self-assessment | Self-assessment every three years |
| Affirmation | Annually, entered into SPRS | After assessment and annually thereafter |
| Plans of Action and Milestones | Not permitted | Permitted, closed within 180 days |
| Status validity | Annual cycle | Three years from the status date |
The row that catches businesses out is the one about Plans of Action and Milestones. At Level 1 there is no partial credit: the 15 requirements are either met or they are not, and an assessment lapses if the annual affirmation is missed. Several Alexandria firms have discovered that a lapsed affirmation, not a failed control, is what pulled them out of contention.
The Controls Worth Implementing Whether or Not You Hold Federal Data
Most businesses in Alexandria are not in the federal supply chain, and the certification means nothing to them. The controls behind it still do, because insurers and enterprise customers ask about the same short list.
Where should a business without a federal contract start?
- Multi-factor authentication on email, remote access and anything holding customer data
- An accurate inventory of hardware and software, so nothing unpatched sits unnoticed
- Automatic updates for operating systems and third party software
- Email and web browser security settings configured against spoofed messages
- Backups that are monitored and, more importantly, restored as a test
- A written incident response plan naming who calls whom, before it is needed
Those map onto the CISA Cyber Essentials elements, which organize readiness around Yourself, Your Staff, Your Systems, Your Surroundings, Your Data and Your Crisis Response, and which CISA describes as consistent with the NIST Cybersecurity Framework. An Alexandria business owner searching for a cybersecurity company near me usually wants the first four items on that list rather than a certification, and a decent network security company Alexandria VA engagement should start there rather than with a compliance sales deck. Searches for network security near me spike after an incident, which is the worst moment to be choosing.
Why This Sits Close to Home at CMIT Solutions of Alexandria
Compliance advice is only as good as the operating experience behind it, and in an Alexandria market this close to the federal buyer that gap shows quickly.
Who does this work locally?
The Alexandria practice is led by president Bahar Shad, who holds a Master of Science in Computer Science from Virginia Tech, is AWS Cloud Practitioner and PMP certified, and spent over twenty years in senior engineering leadership roles at large Northern Virginia organizations, where she led cloud modernization and cybersecurity programs. Systems are monitored around the clock, and the Alexandria team is locally owned and operated rather than routed through a national queue.
Behind that sits a network of more than 900 technology practitioners built over twenty five years, with recognition including ConnectWise Partner of the Year and more than a decade on the Entrepreneur Franchise 500 list. If you want the compliance angle specifically, the data compliance offering is documented separately, and the earlier piece on seven warning signs your Alexandria business needs stronger cybersecurity is the better starting point if you are not sure whether you have a problem yet.
Find Out Which Level Applies Before Someone Asks
If you hold Federal Contract Information or Controlled Unclassified Information, the useful next step is a short scoping conversation: which level applies, what the current self-assessment says, and whether the affirmation in SPRS is live. Tell us what contracts you work under and we will tell you plainly where you stand. If you hold no federal data, we will say so and talk about the six controls instead. That conversation is free either way, and it is one we have with Alexandria businesses most weeks.
CMIT Solutions of Alexandria | 211 N Union St, Suite 100, Alexandria, VA 22314 | (571) 341-7712 | directions and business details | company news and local updates
Call CMIT Solutions of Alexandria today to scope your cybersecurity and compliance position.
Quick Summary
CMMC Phase II requirements were suspended with immediate effect on 13 July 2026, having been scheduled for 10 November 2026, and a reform task force was established. Phase I self-assessment requirements remain firmly in place and implementation is paused in Phase 1 rather than withdrawn, with compliance against NIST SP 800-171 Revision 2 still enforced through self-assessments and select government-led assessments. Level 1 covers Federal Contract Information against the 15 requirements in FAR clause 52.204-21, needs an annual self-assessment and annual affirmation into the Supplier Performance Risk System, and permits no Plans of Action and Milestones. Level 2 covers Controlled Unclassified Information against the 110 requirements in NIST SP 800-171 Revision 2, is self-assessed every three years with annual affirmation, and permits Plans of Action and Milestones closed within 180 days. Businesses holding no federal data should still implement multi-factor authentication, asset inventory, automatic updates, email and browser protections, tested backups and a written incident response plan.
Key Takeaways
- CMMC was not cancelled: Phase II was suspended on 13 July 2026 and a reform task force set up
- All Phase I self-assessment requirements remain firmly in place
- NIST SP 800-171 Revision 2 compliance is still enforced under existing contract clauses
- Level 1 means 15 requirements, an annual self-assessment and no Plans of Action and Milestones
- Level 2 means 110 requirements, a three yearly self-assessment and annual affirmation
- Protection requirements flow down to subcontractors holding the same information
- A lapsed annual affirmation can disqualify a bid as surely as a failed control
Frequently Asked Questions
1. Was CMMC cancelled in July 2026?
No. Phase II requirements were suspended with immediate effect on 13 July 2026, having been scheduled for 10 November 2026, and a reform task force was set up. Phase I self-assessment requirements remain firmly in place, and implementation is paused in Phase 1 rather than withdrawn.
2. What does CMMC Level 1 require?
Level 1 covers basic safeguarding of Federal Contract Information and rests on the 15 security requirements in FAR clause 52.204-21. It needs an annual self-assessment and an annual affirmation of compliance, with results entered into the Supplier Performance Risk System. Plans of Action and Milestones are not permitted at Level 1.
3. What does CMMC Level 2 require?
Level 2 covers broader protection of Controlled Unclassified Information against the 110 security requirements in NIST SP 800-171 Revision 2, required by DFARS clause 252.204-7012. The self-assessment runs every three years with an annual affirmation, and a status is valid for three years. Plans of Action and Milestones are permitted and must be closed within 180 days.
4. We are a subcontractor, not a prime. Does this apply to us?
It can. The program sets out protection requirements for information that flows down to subcontractors, so a business two steps from the contracting officer can still be in scope. The trigger is whether you hold Federal Contract Information or Controlled Unclassified Information, not your position in the chain.
5. If we hold no federal data at all, is any of this relevant?
The certification is not, but the controls are. NIST SP 800-171 Revision 2 and the CISA Cyber Essentials elements are a sound baseline for any business, and insurers and enterprise customers increasingly ask for evidence of the same practices whether or not a federal contract is involved.
