Quick Answer
Federal contracting enters 2027 less settled than it looked mid-year. DoD suspended CMMC Phase 2 in July 2026, so third-party certification isn't becoming a November 2026 award condition after all, though the underlying cybersecurity rules stay in force. A separate NDAA requirement pushes DoD to expand how it credits commercial past performance by December 18, 2026. Meanwhile, procurement forecasts keep consolidating and firm-fixed-price contracts are now the government's stated default.
Key Takeaways
- CMMC Phase 2 is suspended, not starting November 10, 2026. DoD locked the pause into a binding class deviation in September 2026, and self-assessment and NIST 800-171 obligations remain fully in effect.
- Congress didn't enact the negative-event CPARS overhaul that circulated in draft NDAA language. The existing five-point rating system and 14-day comment window are still the rule.
- DoD owes guidance by December 18, 2026 on giving more weight to commercial and other non-government past performance, a real opening for businesses without a long federal track record.
- Procurement forecasts continue moving into GSA's single governmentwide tool, though DoD hasn't joined it yet, so it's not the complete picture some contractors expect.
- Firm-fixed-price is now the government's default contract type under a 2026 executive order, which raises the value of pricing discipline before bidding.
Why the 2027 Outlook Looks Different Than It Did in July
Several changes that seemed locked in earlier this year didn't land the way they were first announced. A cybersecurity certification deadline got paused. A performance-scoring overhaul that made headlines in draft legislation never made it into law. That matters because a contractor who builds a 2027 budget or compliance calendar around the wrong version of these changes wastes preparation time and can miss the deadlines that did survive. The safest move heading into next year is separating what's confirmed from what only looked confirmed a few months ago.
Cybersecurity: CMMC Phase 2 Is Suspended, Not Arriving in November
DoD suspended the CMMC Phase 2 rollout on July 13, 2026, pausing the requirement that would have made third-party Level 2 certification a condition of award for most contracts involving controlled unclassified information starting November 10, 2026. In September 2026, DoD went further and issued a class deviation directing contracting officers to remove third-party assessment requirements from active solicitations and contracts, which turns the pause into binding contract language rather than a policy memo that could quietly reverse itself.
What didn't change is the underlying obligation. DFARS 252.204-7012, the NIST SP 800-171 controls, and SPRS self-assessment scoring all remain in force, and Phase 1 self-assessment requirements have been in effect since November 2025. A reform task force reviewed the program over the summer, and a public report is expected, but no new Phase 2 implementation date has been announced. A contractor whose contracts involve controlled unclassified information should keep its self-assessment and SPRS score current regardless of what happens with certification timing. USFCR's CMMC Support helps businesses run that gap assessment and keep documentation audit-ready while the certification requirement is on hold.
Performance Records: What's Actually Changing for Past Performance
An earlier version of the FY2026 NDAA would have replaced CPARS's adjectival ratings with a system that logged only negative performance events. That provision didn't survive conference and isn't part of the law as enacted. The five-point rating scale and the 14-day window to respond to an evaluation remain exactly what they were.
What did become law is a narrower, arguably more useful change for growing contractors. DoD must issue guidance by December 18, 2026 on accepting commercial and other non-government work as relevant past performance and on using alternative evaluation methods where a contractor's federal history is thin. For a business with strong commercial delivery experience but little or no prime federal past performance, this is the detail worth watching, not a scoring overhaul that never happened.
Buying Mechanics: Forecasts, Fixed-Price Defaults, and the FAR Rewrite
The rest of the 2027 picture is about how agencies buy. Several civilian agencies have moved their procurement forecasts into GSA's Forecast of Contracting Opportunities tool, and more consolidation is coming. Still, DoD hasn't joined the tool, so treat it as a strong starting point rather than a complete forecast of federal demand. The broader rewrite of the acquisition regulation keeps moving part by part, mostly through proposed rules and interim class deviations rather than finalized regulation, generally trading prescriptive process for plainer, statute-based language and more contracting officer discretion. And firm-fixed-price contracts are now the government's stated default under a 2026 executive order, with agencies required to justify a different contract type above set dollar thresholds, which puts a premium on realistic cost estimating before a bid goes in.
USFCR has guided over 500,000 businesses since 2010, and the pattern that holds up year after year is simple. Contractors who track what's actually confirmed, rather than what circulated as expected, spend their preparation time on the deadlines that matter.
FAQ
Is CMMC Phase 2 still starting on November 10, 2026?
No. DoD suspended Phase 2 on July 13, 2026, and locked that pause into contract language through a class deviation issued in September 2026. No new implementation date has been announced. Self-assessment, SPRS scoring, and NIST 800-171 compliance remain required regardless.
Did CPARS move to a negative-event-only rating system?
No. That change was proposed in draft NDAA language but was dropped before the FY2026 NDAA became law. The existing adjectival rating system and 14-day evaluation comment window are still current.
What does the December 18, 2026 past-performance deadline actually cover?
DoD must issue guidance by that date on accepting commercial and other non-government work as relevant past performance and on using alternative evaluation approaches when a contractor's federal track record is limited. It doesn't change the CPARS scoring mechanics.
How should a small contractor prioritize these changes?
Confirm your CMMC exposure without scheduling or paying for anything against the old November date. Start organizing commercial past performance documentation now, ahead of the December guidance. Use GSA's forecast tool as a starting point, not a complete DoD picture. Watch pricing discipline as fixed-price becomes the default.
Next Steps
Update your 2027 planning calendar to match what's confirmed rather than what was originally announced. Don't commit budget to CMMC third-party assessment prep based on the November 2026 date, but keep self-assessment and SPRS documentation current. Begin organizing commercial past performance records now so your business is ready once DoD's December guidance clarifies how that experience gets credited. For contractors who want help sorting which of these changes actually affect their business, USFCR helps businesses turn a year of regulatory movement into an ordered preparation plan.
