The Pentagon Just Paused CMMC Phase II: What Every Defense Contractor Should Know

On July 13, the Department of War announced the immediate suspension of the transition to Cybersecurity Maturity Model Certification Phase II, which had been scheduled to take effect on November 10, 2026.

CMMC Phase I self-assessment requirements remain in place.

The decision follows concerns that high compliance costs, limited third-party assessment capacity, and complex implementation timelines were discouraging small and non-traditional businesses from participating in the Defense Industrial Base. The Small Business Administration reported that many firms had left or were considering leaving defense-related work because of these pressures.

Here is what changes:

• During the suspension, program offices may require only CMMC Level 1 Self or Level 2 Self assessments

• CMMC Level 2 C3PAO and Level 3 DIBCAC assessment requirements may not be designated

• Active solicitations containing those requirements must be amended, while existing contracts will require formal modifications through the contracting process

• A CMMC Reform Task Force will conduct a top-to-bottom review of the program and deliver recommendations to the Department CIO within 60 days

• NIST SP 800-171 Rev 2 compliance will continue through self-assessments and select government-led assessments
  

It is important to understand what has not changed.

This is a pause in the rollout of higher-level certification requirements, not a pause in cybersecurity. Contractors subject to DFARS 252.204-7012 remain responsible for safeguarding covered defense information, and applicable requirements for Federal Contract Information also remain in place.

"The CIO's decision ensures we maintain a strict security baseline while removing paralyzing costs and keeping innovators and competition growing in the defense supply chain," said Hon. Michael Duffey, Under Secretary of War for Acquisition and Sustainment.

For small and non-traditional businesses, the suspension may provide relief from the immediate third-party certification burden. For the broader Defense Industrial Base, the final shape of the CMMC program remains unsettled until the Department completes its review.

The 60-day review is the next major milestone to watch.

Malama Kai remains committed to helping our partners navigate the evolving defense landscape and deliver what the mission demands.

Sources: Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements (U.S. Department of War) Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements > U.S. Department of War > Release | U.S. Department of War SBA Commends U.S. Department of War’s Suspension of CMMC Phase II for Small Defense Contractors | U.S. Small Business Administration