CMMC Phase 2 Suspended: What Security Awareness Training Still Requires (2026)

Updated November 11, 2026. Status checked against the Department of War's July 13, 2026 release and DoD's CMMC program page, linked in Sources.

The short answer: CMMC Phase 2 is suspended, but the training requirements did not go away. On July 13, 2026 the Department of War suspended the Phase II requirements that were scheduled to start November 10, 2026, mainly third-party (C3PAO) Level 2 certification. Phase I self-assessments "remain firmly in place," DFARS 252.204-7012 still obligates contractors to protect covered defense information, and DoD says it will keep enforcing NIST SP 800-171 Rev 2 through self-assessments. If you handle CUI, the three Level 2 awareness and training requirements still apply to you today.

This page explains what changed, what Level 1 and Level 2 mean for security awareness training right now, and the records to keep so a self-assessment holds up. For the control-by-control reference, see our CMMC security awareness training requirements page. This is a plain-English summary, not legal advice.

What did DoD suspend in July 2026?

CMMC Phase 1 began on November 10, 2025, when the DFARS CMMC rule took effect. Under 32 CFR 170.3, Phase 2 was set to begin one calendar year later and would have added Level 2 certification by a C3PAO as a condition of award for applicable contracts.

On July 13, 2026 the Department of War announced "the immediate suspension" of the Phase II requirements and of pending and future CMMC implementation milestones in its solicitations. It also set up a CMMC Reform Task Force with 60 days to deliver a final report to the DoW CIO. Crowell & Moring's July 14 update notes that active solicitations and contracts that include Level 2 C3PAO or Level 3 requirements must be amended to remove them.

As of November 11, 2026, DoD's CMMC program page still says: "The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels." Watch that page for the result of the review.

What still applies to defense contractors?

• Phase I self-assessments. DoD's release says all Phase I self-assessment requirements remain in place.
• DFARS 252.204-7012. Contractors and subcontractors remain contractually obligated to safeguard covered defense information under this clause.
• NIST SP 800-171 Rev 2. DoD says it will enforce compliance with this standard through self-assessments while the review runs.

In practice, the pause changed who checks your work, not what the work is. A Level 2 self-assessment covers the same 110 requirements a C3PAO would have assessed.

Does CMMC Level 1 require security awareness training?

Not explicitly. Level 1 is an annual self-assessment and annual affirmation against the 15 basic safeguarding requirements in FAR 52.204-21. Those 15 cover access control, identifying and authenticating people and devices, media sanitization, physical access, boundary protection, flaw remediation and malicious code protection. None of them mentions awareness training.

That does not make training optional in practice. Several of those 15 depend on people behaving correctly: escorting visitors, not posting controlled information publicly, and not running malicious code. Short, regular training is the cheapest way to make those controls hold. Level 1 also does not allow a plan of action and milestones, so every requirement has to be met at the time you affirm.

What does CMMC Level 2 require for training?

Level 2 is the 110 requirements of NIST SP 800-171 Rev 2. Three of them sit in the Awareness and Training family, and in CMMC they are labeled AT.L2-3.2.1, AT.L2-3.2.2 and AT.L2-3.2.3.

• 3.2.1, security awareness: "Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems."
• 3.2.2, role-based training: "Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities."
• 3.2.3, insider threat: "Provide security awareness training on recognizing and reporting potential indicators of insider threat."

While the program is paused in Phase 1, Level 2 is met by self-assessment every three years, with an affirmation after each assessment and annually after that. A Level 2 self-assessment may carry a plan of action and milestones for some gaps, but it has to be closed out within 180 days.

One wrinkle: NIST withdrew SP 800-171 Rev 2 in May 2024 and replaced it with Rev 3, but the CMMC rule still points to Rev 2. Assess against Rev 2 until DoD says otherwise.

How to document training for a CMMC self-assessment

1. Write a short training policy that names who gets awareness training, who gets role-based training, and how often. Our free security policy templates include one.
2. Train everyone with access to systems that hold CUI, including managers and administrators, and keep completion records with names and dates.
3. Assign separate role-based training to people with security duties, such as IT staff, administrators and whoever handles incident reports. One general course for everybody does not cover 3.2.2.
4. Include insider threat content: what the warning signs look like and exactly how to report them.
5. Run phishing simulations so you can show awareness changing behavior, not just course completions.
6. Keep the records with your System Security Plan so they are ready for your next affirmation.

What the pause means for MSPs serving defense subcontractors

Many small defense subcontractors rely on an MSP to run their IT, and the 7012 clause still applies to them. The pause gives MSPs time, not a reprieve. Clients that stopped preparing when the C3PAO deadline moved still owe a Level 2 self-assessment and annual affirmations, and the training records are one of the easier pieces to get right early.

How Hook Security fits

Hook Security covers 3.2.1 and 3.2.3 directly, including insider threat content, with short training modules, automated phishing simulations and completion records for every employee. Role-based training for 3.2.2 needs deliberate assignment, so plan which people get which content rather than assuming one course covers it. Hook is built for MSPs and is used by hundreds of MSPs, with 250,000+ employees trained monthly. No platform can guarantee a passing assessment; that depends on your full control environment and documentation.

Bottom line

CMMC Phase 2 is paused, not cancelled. If you handle CUI, the three Level 2 training requirements apply now through self-assessment, and if you only handle federal contract information, Level 1 still expects the people side of its 15 requirements to work. Train everyone, add role-based and insider threat content, and keep dated records.

FAQ

Is CMMC still required after the Phase 2 suspension?

Yes. DoD suspended Phase II requirements on July 13, 2026, but Phase I self-assessments remain in place, and DFARS 252.204-7012 still requires contractors to safeguard covered defense information.

Does CMMC require annual security awareness training?

The Level 2 requirements do not set a frequency. They require that managers, administrators and other personnel are made aware of security risks, that people with security duties are trained, and that training covers insider threat. Most organizations train at least annually and keep dated records for each annual affirmation.

Do Level 1 contractors need security awareness training?

The 15 Level 1 requirements in FAR 52.204-21 do not mention training. Training still helps the people-dependent requirements, such as visitor escorts and malicious code protection, hold up at your annual self-assessment.

Sources

• Department of War suspends CMMC Phase II requirements (Office of Industrial Base Growth, July 13, 2026)
• About CMMC (DoD CIO)
• Department of War immediately suspends CMMC Phase II requirements (Crowell & Moring, July 13, 2026, updated July 14)
• 32 CFR Part 170, CMMC Program (eCFR, up to date as of Oct 23, 2026)
• NIST SP 800-171 Rev 2, section 3.2 (NIST)
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Acquisition.gov)

Keep reading

• CMMC security awareness training requirements - the AT.L2 controls, cadence and what an assessor asks to see.
• FTC Safeguards Rule training requirements - what the rule requires of non-bank financial businesses.
• Free security policy templates - eight ungated policies, including a training policy.
• Best security awareness training platforms (2026, US) - eight platforms compared for US businesses.
• Best security awareness training for MSPs - the MSP vendor landscape.
• Phishing simulation for MSPs - how Hook's phishing simulator works for MSPs and their clients.
• PCI DSS training requirements by SAQ - which Requirement 12.6 items your SAQ asks for.