CMMC Cybersecurity Awareness Training After Phase 2 Suspension

Your compliance lead read the July memo and asked whether the awareness training program could wait. It is a fair question, because the suspended item is the one most contractors were spending money on. The cmmc training requirements underneath it did not move. The answer is that the training obligation never moved.

What paused is the assessment, and what remains is the requirement being assessed. That distinction is worth 10 minutes of your time. Contractors who read the pause as a holiday will arrive short of evidence when assessments resume.

What the July 2026 Suspension Covers

Covering the suspension precisely matters, because 2 documents did the work. Both were released on July 13, 2026 under publication case 26-P-1023. One is a policy memorandum signed by DoD CIO Kirsten Davies, and the other an implementation memorandum from the undersecretary for acquisition and sustainment, and together they froze the schedule.

Together they place all pending and future CMMC implementation milestones in abeyance until further notice. That includes the November 2026 transition to Phase 2, with Phases 3 and 4 frozen alongside it. Under Phase 2, a C3PAO third-party assessment at CMMC Level 2 would have become a condition of award for contracts involving controlled unclassified information, the gate most contractors were budgeting for.

Those frozen milestones came with a review attached, because the memoranda also opened a 60-day review of the program and created a CMMC Reform Task Force. That task force delivered its report to the CIO around September 11, 2026, and no outcome had been published when this was written, so the schedule stays frozen for now. The program is suspended and not repealed, and 32 CFR Part 170 and the DFARS rule both stand.

Reading the right-hand column is the whole point of the article. Every item in that column carries a training consequence for your workforce. None of them has a new date attached, which is what makes the pause so easy to misread.

What Phase 1 Still Asks For

Standing rules are easier to read than suspended ones, and Phase 1 is unchanged from before the memo. Phase 1 took effect on November 10, 2025 and its 3 duties stand. A CMMC Level 2 self-assessment, submission of that score to the Supplier Performance Risk System, and an annual affirmation by a senior company official are all unchanged.

That affirmation is the sentence worth rereading, because a senior official attests annually that the company meets the requirements. An affirmation resting on controls nobody implemented is a different kind of exposure from a failed assessment.

Why the Training Obligation Did Not Pause

That affirmation rests on controls, and pausing those was never on the table. The obligation comes from the controls themselves, and the assessment only checks them. NIST SP 800-171 Revision 2 carries 110 security requirements across 14 families, and the Awareness and Training family is section 3.2.

Those 110 requirements include 3 controls in that one family. Each covers a different population, and together they reach almost everybody:

• 3.2.1 covers managers, system administrators and users, on security risks and the applicable policies.
• 3.2.2 covers personnel trained to carry out their assigned information security duties.
• 3.2.3 covers insider threat awareness, for everyone with system access.

The third of those 3 is the one contractors underestimate. Insider threat awareness applies to every person who can log in. That usually means the whole company, including people whose own duties never touch controlled unclassified information.

Where DFARS 252.204-7012 Fits

Fitting into the clause is what makes these controls contractual. DFARS 252.204-7012 requires adequate security on all covered contractor information systems. It points at NIST SP 800-171 as the standard that defines adequate, which is how a control written for engineers becomes a term of your contract.

That pointer is what carries the Awareness and Training controls into your contract. A training gap is therefore a clause gap, and it stands alongside the SPRS score and the annual affirmation as something a senior official has already put a signature against. None of the 3 was touched by the July memoranda.

What Assessors Will Want to See

Wanting evidence of what happened is the pattern every assessment follows. An assessor asks who was trained, on what, and when, and a policy document answering none of those 3 is not evidence.

Those 3 questions decide what the record has to hold:

• Record the individual by name, and never the department or the headcount.
• Record which control the content satisfies, so 3.2.1 and 3.2.3 are distinguishable.
• Record the date of completion, and the version of the material delivered.
• Record the recurrence, so an annual obligation is visibly annual.

The second item is the one most programs skip. A single general awareness course assigned to everyone may well satisfy 3.2.1 and 3.2.3 on content. If the record cannot show which control it addresses, an assessor has to take your word for it.

Why the Pause Is the Right Time

Taking your word for it is not something an assessor will do twice, and the pause is the right time to fix that. Nobody is scheduling a C3PAO assessment of your company this quarter. A gap found now costs a remediation, where the same gap later costs a finding.

Contractors who use the window well do 2 things. They assign the training to everyone with system access and capture the completion per person. They also go back far enough to show the obligation was met during the periods already affirmed.

Where KnowledgeCity Fits in a CMMC Training Record

Going back far enough is easier with one system, and that is where the platform earns its place. KC LMS accepts SCORM packages from any vendor your security team already trusts. Content built that way is delivered and tracked beside everything else your people have to complete.

SCORM alone does not solve assignment, which matters when 3.2.3 covers every person with system access. Assignment here follows the attributes your HR record already holds. A new starter picks up insider threat awareness without anybody remembering, and each completion is stored against the person with a date an assessor can read. The certificate carries its own expiry, so the annual cycle raises its own reassignment.

Evidence comes out as a report, with no reconstruction needed. A dashboard shows the overdue count and opens into the named list behind it. Built-in reports cover compliance, overdue learners and completion. Contractors who have run this describe the change teams report when keeping hazcom and lockout audit-ready. It is the same discipline aimed at a different regulator, and it stops a gap surfacing during the assessment itself.

Frequently Asked Questions

1. What exactly did the July 2026 memoranda suspend?

The phased implementation schedule, including the November 2026 move to Phase 2 under which a C3PAO third-party assessment at CMMC Level 2 would have become a condition of award for CUI contracts. Phases 3 and 4 are frozen too. All pending and future implementation milestones sit in abeyance until further notice.

2. Do the NIST SP 800-171 controls still apply?

Yes, all 110 of them, across 14 families. The Awareness and Training family at section 3.2 contains 3 controls: 3.2.1 on security risks and applicable policies, 3.2.2 on assigned information security duties, and 3.2.3 on insider threat awareness. None was affected by the suspension.

3. What still has to happen every year?

Phase 1 obligations continue. A CMMC Level 2 self-assessment, submission of the self-assessed score to the Supplier Performance Risk System, and an annual affirmation of continued compliance by a senior company official all remain in force, as does DFARS 252.204-7012.

4. Who needs insider threat awareness training?

Everyone with system access. Control 3.2.3 reaches well past the security team, and assuming otherwise produces most of the gaps. At most contractors it reaches the entire workforce, including people whose own duties never touch controlled unclassified information.

5. Is the suspension likely to become permanent?

Nothing published says so. The Reform Task Force delivered its report to the CIO around September 11, 2026, and the outcome has not been released. The program was suspended and not repealed, with 32 CFR Part 170 and the DFARS rule both still standing, so the prudent assumption is that assessments resume in some form.

References

1. Federal News Network. Pentagon Suspends CMMC Phase Two Requirements and Launches a Review of the Program.
2. Latham and Watkins LLP. What Defense Contractors Should Know About the Suspension of CMMC Phase 2.
3. Holland and Knight LLP. Department Suspends CMMC Phase II Requirements.
4. National Institute of Standards and Technology. Special Publication 800-171 Revision 2.
5. Defense Acquisition Regulations System. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.
6. Department of Defense Chief Information Officer. Cybersecurity Maturity Model Certification.