Training & Education

CMMC Phase 2 and CMMC Level 2 refer to two different parts of the Cybersecurity Maturity Model Certification program. Phase 2 is an implementation stage, while Level 2 is a cybersecurity assessment level for organizations that handle Controlled Unclassified Information. Here is what defense contractors need to understand—especially following the 2026 suspension of Phase 2.

The CMMC Phase 2 pause has created confusion across the Defense Industrial Base. Join CUI Supply on July 29 for a free public webinar that separates fact from fiction, addresses common misconceptions, and helps contractors understand what they should be watching next.

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.