On July 13, 2026, the Department of War suspended Phase 2 of CMMC pending a 60 day review. The headlines have been loud, and a lot of federal contractors have read them and relaxed.
If you hold a GSA Schedule and sell mostly to civilian agencies, here is the part the headlines did not tell you: that announcement was probably never about you, and the rule that is about you did not pause.
Does the CMMC Pause Apply to My Contracts?
Only if you hold Department of War contracts that carry the CMMC clause.
CMMC is a Department of War program. It flows through DFARS 252.204-7012 and the CMMC clauses into defense contracts. If you sell to the Department of the Interior, Health and Human Services, the Department of Energy or any other civilian agency, the CMMC pause changed nothing about your obligations, because CMMC was not your obligation in the first place.
What you have instead is a separate track, and it has been quietly advancing for nine years.
What Is the FAR CUI Rule?
FAR Case 2017-016 is the Federal Acquisition Regulation's own rule for handling Controlled Unclassified Information. Unlike CMMC, it is not limited to defense. It is written to apply across federal contracting.
The timeline in brief:
- Opened as a FAR case in 2017
- A proposed rule finally published January 15, 2025, after years of anticipation
- An updated proposed rule published June 23, 2026 at 91 FR 37550, superseding the January 2025 version
- Comments on that updated rule were due July 23, 2026
It is still a proposed rule. It has not been finalized, and the government has not published a confirmed date for finalization. A target of December 2025 came and went.
So this is not a requirement you are late on. It is a requirement you can still see coming, which is a materially better position than most defense contractors were in last week.
Why Should I Care About a Rule That Is Not Final?
Three reasons.
First, the direction of travel is unambiguous. A rule does not survive nine years, two proposed versions and a public comment process because the government is losing interest in protecting controlled information.
Second, the underlying standard is the same one. The FAR CUI track and the CMMC track both point at NIST SP 800-171. The controls you would implement for one are very largely the controls you would implement for the other. Work done now is not wasted on either path.
Third, and this is the strategic point: the defense industrial base just got handed 60 days of breathing room and much of it will do nothing with it. Civilian federal contractors were never on that clock at all. If you start now, you are ahead of a rule instead of behind one. That is the only comfortable position in compliance and almost nobody ever occupies it.
What Should a GSA Schedule Holder Actually Do?
- 1
Work out whether you handle CUI at all
Many contractors assume they do not and are wrong, usually because of drawings, specifications, personally identifiable information or agency data received in performance.
- 2
Baseline yourself against NIST SP 800-171
If you do handle CUI, measure yourself against the standard both tracks reference. It is the common denominator of every path in front of you.
- 3
Read your existing contracts
Agency-specific CUI clauses already exist in places and do not wait for the FAR case to finalize. Your obligations may already be contractual today.
- 4
Do not buy a certification
There is nothing to certify against on the civilian side right now, and anyone selling you one is selling you something that does not exist.
- 5
Watch the FAR Council
Watch the FAR Council, not the Department of War, for what happens next on your side of federal contracting.
Frequently Asked Questions
Does the CMMC pause apply to civilian agency contracts?
No. CMMC is a Department of War program applied through defense contract clauses. If your contracts do not carry those clauses, the pause changed nothing for you.
Is the FAR CUI rule in effect?
No. It is a proposed rule. An updated proposed version was published June 23, 2026 and the comment period closed July 23, 2026. It has not been finalized and no finalization date has been confirmed.
Who would the FAR CUI rule apply to?
As proposed, federal contractors and subcontractors that handle Controlled Unclassified Information while performing federal contracts, across agencies rather than defense alone.
What standard would I have to meet?
The proposed rule points at NIST SP 800-171, the same standard underpinning the defense side.
Should I wait until it is final?
Waiting is a choice with a cost. The controls take time to implement, the standard is already known, and finalization timing is outside your control.
Where This Leaves You
Two tracks, moving at different speeds, in different directions, this month.
The defense track paused and gave its contractors time they mostly did not ask for. The civilian track kept moving and gave its contractors a comment deadline that just closed.
If you sell to the federal government and you handle controlled information, the useful question is not whether CMMC is cancelled. It is whether you could demonstrate, today, that you protect the data an agency has trusted you with.
Run the gap assessment and get your Score of Record so you know exactly where you stand against NIST SP 800-171, before a rule or an agency makes the decision for you.
Run the Gap Assessment
