The Pentagon Pauses CMMC Phase 2 Implementation

On July 13, 2026, the US Department of War announced the immediate suspension of Phase 2 of the implementation of Cybersecurity Maturity Model Certification (CMMC) assessment requirements, which had been scheduled to take effect on November 10, 2026. The Department further suspended pending and future CMMC implementation milestones across its solicitations and contracts while it conducts a broader review of the CMMC program, which would have imposed significant compliance burdens on contractors and subcontractors in the defense industrial base. The Department also updated parts of its CMMC Frequently Asked Questions to reflect the suspension.

CMMC is a Department-administered program for verifying that contractors and subcontractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) have implemented the Level 1, Level 2 or Level 3 cybersecurity safeguards required by their contracts. Under the phased implementation schedule established in a 2024 rule, Phase 1 generally introduced CMMC Level 1 and Level 2 self-assessment requirements into applicable solicitations and contracts. Phase 2 would have expanded requirements for CMMC Level 2 certification assessments performed by accredited Certified Third-Party Assessment Organizations (C3PAOs) for contractors handling CUI. Phase 3 would then add CMMC Level 3 certification assessments performed by the Department’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) for contractors handling certain CUI.  

For existing contracts and agreements that already impose the Phase 2 or Phase 3 requirements, a memorandum from the Under Secretary of War for Acquisition and Sustainment directs contract and agreements officers to remove them via modification prior to the exercise of the next option period or during the next scheduled administrative modification.

Phase 1 Requirements and DFARS 252.204-7012 Remain in Effect

The suspension of the CMMC implementation schedule is not a general retreat from defense-contractor cybersecurity obligations. The Department expressly stated that “[a]ll Phase I self-assessment requirements remain firmly in place” and that the action “does not eliminate the requirement for companies to protect federal data.”

Most importantly, contractors and subcontractors whose agreements include Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 remain contractually obligated to safeguard covered defense information. For covered contractor information systems, that clause generally requires contractors to provide “adequate security,” including by implementing the applicable security requirements in NIST SP 800-171 Rev. 2. The clause’s other requirements (including obligations concerning cyber-incident reporting, preservation of images of affected systems, access to information and equipment, and flow-down to certain subcontractors) also remain in effect.

The suspension therefore changes only the planned mechanism and timing for independent certification by third-party assessors, not the underlying contractual obligations to implement applicable security controls. The Department underscored this distinction by stating that, during the suspension period, it will enforce compliance with the National Institute of Standards and Technology (NIST) SP 800-171 Rev. 2 standard “through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.”

Accordingly, contractors and subcontractors should not interpret the Phase 2 suspension as a signal to pause implementation or remediation work. Companies subject to DFARS 252.204-7012 must continue to self-assess their compliance with NIST SP 800-171 Rev. 2, maintain accurate system security plans and related documentation, address identified deficiencies, ensure that representations concerning their cybersecurity posture remain supportable, and post their self-assessment scores on the Supplier Performance Risk System (SPRS) portal. Contractors subject to DFARS 252.204-7021 Level 1 or Level 2 self-assessments must also affirm continuing compliance annually.

Why the Department Suspended the CMMC Phase 2 Implementation

The Department attributed its decision to longstanding concerns that the current CMMC model imposes excessive costs and administrative burdens, especially on small, medium-sized and non-traditional contractors. It stated that available data, such as reports from the Small Business Administration, indicated that those burdens were causing innovative companies to leave or avoid the defense industrial base, potentially delaying the delivery of capabilities to important Department programs.

The Department’s memorandum from its Chief Information Officer also noted severe shortages in C3PAO capacity and complex implementation timelines as additional barriers to expanding and diversifying the defense industrial base.

The development thus reflects ongoing dissatisfaction with the cost, capacity and administrative structure of the CMMC program—not a retreat from the substantive cybersecurity standards applicable to contractors and subcontractors. 

Department Review and Industry Engagement

The Department is establishing a CMMC Reform Task Force to conduct a “top-to-bottom” review of the CMMC program and deliver recommendations to the Department’s Chief Information Officer within 60 days. The Task Force will consider responses to a public Request for Information (RFI) concerning industry compliance challenges and will evaluate alternatives intended to provide “realistic, scalable security measures” while lowering barriers for small and non-traditional businesses.

Industry stakeholders may consider participating in the RFI process to provide concrete information about assessment costs, C3PAO availability, implementation timelines, effects on small businesses and subcontractors, and potential alternatives for verifying compliance. This new round of industry engagement may lead to material changes in the CMMC assessment structure, implementation schedule, or both.

Practical Considerations for Contractors

Pending further direction, defense contractors and subcontractors should:

• Continue complying with Phase 1 requirements. Applicable CMMC Level 1 and Level 2 self-assessment and affirmation requirements remain in place; this includes required posting of self-assessment information on the SPRS portal.
• Review existing and upcoming contracts. Determine which agreements include DFARS 252.204-7012 and related cybersecurity clauses, and confirm the systems and information within their scope.
• Continue NIST SP 800-171 implementation. The suspension of the Phase 2 implementation schedule does not affect the underlying controls required by DFARS 252.204-7012.
• Maintain defensible assessment records. Contractors should ensure that self-assessment results, system security plans, plans of action and milestones, and related representations accurately reflect their current cybersecurity posture.
• Monitor Department guidance and solicitations. The announcement suspends pending and future implementation milestones, but contractors should review individual solicitations, contracts and modifications for applicable requirements.
• Evaluate participation in the RFI. Companies affected by assessment cost, timing, capacity or subcontractor flow-down issues may wish to reply to the RFI.

The immediate result of the Department’s action is meaningful relief from the scheduled expansion of third-party certification assessments. It does not, however, relax the underlying obligations to protect government information through the implementation of mandatory cybersecurity safeguards. Until the Department completes its review and issues further guidance, contractors should continue to comply with DFARS 252.204-7012, NIST SP 800-171 Rev. 2 and applicable Phase 1 self-assessment requirements.