On July 13, 2026, the Department of War suspended the move to Phase 2 of CMMC, the phase that would have made third-party assessments a condition of contract award from November 10, 2026. If you were planning to sit the CMMC Certified Professional (CCP) exam, that raises an obvious question: is the certification still worth earning? This article sets out what the Department's memorandum did and did not change, from the memorandum itself and the documents around it, so you can decide with the facts rather than with the headlines.
The short version: the pause changed how soon third-party assessments will be required, and it paused the work that depends on them. It did not change the rule the exam tests, the exam, the certification or the self-assessments that every contractor handling FCI or CUI still has to do.
What the Department suspended
The memorandum came from the Department's Chief Information Officer, under the subject "Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of Cybersecurity Maturity Model Certification Requirements." It directs three things.
The Phase 2 deadline and the milestones after it. "The upcoming November 2026 deadline to transition to Phase 2 of CMMC implementation is suspended. Additionally, all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice." Program managers and requiring activities "shall only include the need for CMMC Level 1 or Level 2 Self Assessments in procurement request and requirement documents."
A reform task force. "A dedicated CMMC Reform Task Force is to be immediately established to conduct a top-to-bottom 60-day review of the certification program." Its mandate is "to provide recommendations for a reformed cybersecurity and operational resilience framework that prioritizes speed to capability, lowers barriers for small, medium, and non-traditional businesses, and replaces prohibitive, third-party compliance models with scalable, realistic security measures."
An interim posture. "During this suspension, the Department will continue enforcing baseline compliance with NIST SP 800-171 Rev 2 through DIB self-assessments and select government-led assessments."
The memorandum is "effective immediately", and it closes with "Further guidance will be promulgated in the coming months."
A second memorandum of the same date, from the Under Secretary of War for Acquisition and Sustainment, tells program offices how to apply it. They "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period." Where a solicitation already carried one of those requirements, program managers "must initiate amendments to active solicitations", and for existing contracts, contracting officers "are directed to remove them via modification prior to the exercise of the next option period or during the next scheduled administrative modification." The waiver process is suspended too: "no waivers shall be granted during the review of the program."
What it left in place
The same two documents are careful about what continues. The implementing memorandum says the Department "will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments", and that the requirements of DFARS 252.204-7012 "remain in effect." The CIO's memorandum adds that "All other contractual cybersecurity clauses in contracts remain intact."
The Department's CMMC page now describes the program as "paused in Phase 1", where it "may only require self-assessments at two levels":
| CMMC Status | Requirements | Assessment | Affirmation |
|---|---|---|---|
| Level 1 (Self) | 15, from FAR 52.204-21 | Annual self-assessment, results entered in SPRS | After each assessment |
| Level 2 (Self) | 110, from NIST SP 800-171 Revision 2 | Self-assessment every three years, results entered in SPRS | After each assessment and annually thereafter |
The page's closing line is the one to remember: "This action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012."
So the work a contractor must do against the 110 requirements has not gone anywhere. What has gone, for now, is the certificate from a C3PAO at the end of it.
What it did not change: the rule
The memorandum directs the Department's own program managers and contracting officers. It does not amend 32 CFR Part 170, the regulation that defines the CMMC Program, its levels, its assessment types, its scoring and its ecosystem, and it does not amend the DFARS clause that puts CMMC into contracts. Both were adopted through rulemaking: the program rule was published on October 15, 2024, and the acquisition rule "is effective November 10, 2025." The program rule itself says that changes to its requirements "will not be effective as CMMC requirements unless and until made effective through rulemaking."
The phases are still written into the rule as they were. Phase 1 "Begins on the effective date" of the acquisition rule; Phase 2 "Begins one calendar year following the start date of Phase 1." What the memorandum holds in abeyance is the Department's use of those phases in solicitations, not the text.
What it did not change: the exam
The CCP exam tests the program as its documents describe it. ISACA's 2026 candidate guide sets 170 multiple-choice questions in 3.5 hours across six domains, weighted 5%, 5%, 15%, 35%, 25% and 15%. Domain 3, CMMC Governance and Source Documents, tests the rule and the documents it rests on; Domain 5 tests the CMMC Assessment Process; Domain 4, the largest, tests the model and how an assessor evaluates an implementation. None of that is a Phase 2 question. A self-assessment of Level 2 uses the same 110 requirements, the same assessment objectives and the same scoring methodology that a C3PAO assessment does, and that is what the exam asks about.
ISACA's pages, retrieved on September 24, 2026, two months after the suspension, list the exam, its fees and the class as before. Its CMMC page still describes "Formal implementation of the CMMC" as beginning on November 10, 2025, "with requirements increasing for each of the following three years to full implementation by November 2028." On the examination side, nothing has moved.
What a CCP can do during the pause
The rule defines the role in one sentence: a CCP "completes rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations to their OSA clients." The second part of the role, joining a C3PAO's Assessment Team, is the part the pause affects: a CCP "can participate as a CCP on Level 2 certification assessments with CCA oversight where the CCA makes all final determinations", and Level 2 certification assessments are what program offices may not require for now.
The advisory work is where the self-assessments are, and self-assessments are what the Department is enforcing. An OSA conducting a Level 2 self-assessment has to scope its environment, categorize its assets, assess 110 requirements against their objectives, score the result and decide what may go on a plan of action and milestones, then affirm in SPRS. Those are the Domain 4, 5 and 6 skills the exam tests, applied without a C3PAO in the room.
Two facts about the certification itself bear on timing. Under the rule, CCP "Certification is valid for 3 years from the date of issuance." And a passing score on the CCP exam is a prerequisite for the CCA, so anyone who wants to be on an Assessment Team when certification assessments resume has to pass this exam first.
What the task force can and cannot change
The task force's mandate, quoted above, is to recommend a framework that "replaces prohibitive, third-party compliance models with scalable, realistic security measures." Read plainly, that puts the third-party assessment model itself under review, which is the model the C3PAO ecosystem and the assessor path are built on. It would be wrong to read more than that into it: a recommendation is not a rule, and the memorandum promised guidance rather than a date.
What a memorandum cannot do is change the regulation or the exam. The regulation changes through rulemaking, as it did in 2024 and 2025. The exam changes when ISACA changes its content outline. As of this writing, the Department has published no report from the review, which under the memorandum's own clock ended in September, and ISACA has published no change to the exam.
So, is it worth it?
The answer depends on which of the CCP's two roles you want.
- If you advise contractors, as a consultant, a managed service provider or the person inside an OSA who owns its compliance, the CCP is worth as much as it was in June. The self-assessments continue, the 110 requirements continue, the scoring and POA&M rules continue, and the exam measures exactly that knowledge. The pause removed the deadline, not the requirement.
- If you want the assessor path, the CCP is the first of two exams and the certification lasts three years. The C3PAO assessments that path leads to are paused, and the review may change their shape. Nothing in the memorandum changes the exam you would sit now or the CCA that follows it.
- If you are waiting to see what the review says, watch two places: the Department's CMMC page, which carried the suspension the day it happened, and ISACA's CCP page, which carries the exam's fees and the current candidate guide.
Every lesson and question on this site is written from the rule, the CAP and the guides as they stand, and each names its source, so when a document changes, the lesson that cites it is the one to re-read. How to become a CCP walks the steps; sample questions show what the exam asks; and the first domain is open in full with a free account.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.