In a significant policy shift that will have immediate implications for the defense industrial base (DIB), the Department of Defense (DoD) announced on July 13, 2026, that it is suspending the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements. The announcement halts what would have been one of the most consequential cybersecurity compliance milestones for defense contractors and signals that the department intends to fundamentally reevaluate the future of the CMMC program.
The suspension reflects the department’s broader acquisition reform efforts under Secretary of Defense Pete Hegseth’s Acquisition Transformation System (ATS), which emphasizes accelerating acquisitions, reducing unnecessary regulatory burdens, and expanding opportunities for small, medium-sized, and non-traditional defense contractors. While the announcement eases one significant compliance obligation, it does not reduce contractors’ underlying cybersecurity responsibilities.
CMMC Phase II Suspended Effective Immediately
According to the department’s announcement, the transition to CMMC Phase II — which had been scheduled to take effect on November 10, 2026 — is suspended immediately. The department also directed that pending and future CMMC implementation milestones across department solicitations and contracts be paused while officials conduct a comprehensive review of the program.
Importantly, the suspension applies only to Phase II certification requirements. Contractors must continue to comply with all existing Phase I requirements, including applicable self-assessments.
The department has established a 60-day CMMC Reform Task Force that will conduct a comprehensive review of the certification program and consider industry feedback regarding compliance costs, implementation challenges, and potential alternatives. The task force will ultimately recommend a revised cybersecurity framework intended to maintain strong protections for sensitive government information while reducing barriers to participation in the defense marketplace.
Why the Department Is Reconsidering CMMC
The department’s announcement makes clear that acquisition speed and industrial base expansion are driving this decision. According to the department, recent data — including information from the Small Business Administration — indicates that the costs associated with obtaining third-party CMMC certification have discouraged many innovative companies from participating in defense contracting. Department officials expressed concern that the existing certification model has increased compliance costs without proportionate operational benefits and may be limiting competition across the defense industrial base.
Chief Information Officer Kirsten A. Davies stated that the department seeks to maintain robust cybersecurity while reducing unnecessary bureaucracy. Likewise, Under Secretary of Defense for Acquisition and Sustainment Michael Duffey emphasized that reducing compliance burdens is intended to preserve competition and accelerate delivery of innovative capabilities to the warfighter. These statements suggest that the department is exploring a cybersecurity framework that emphasizes measurable security outcomes rather than extensive certification requirements.
NIST SP 800-171 Remains the Foundation
Although CMMC Phase II has been suspended, contractors should not interpret the announcement as a relaxation of cybersecurity requirements. During the interim review period, the department confirmed that it will continue enforcing compliance with NIST Special Publication 800-171 Revision 2 through contractor self-assessments and selected government-led assessments. In other words, contractors handling Controlled Unclassified Information (CUI) should continue implementing and documenting the security controls required by NIST SP 800-171. For many contractors, day-to-day cybersecurity obligations will remain largely unchanged despite the suspension of third-party certification requirements.
DFARS 252.204-7012 Remains Fully Enforceable
Perhaps the most important aspect of the announcement is what did not change. The department expressly emphasized that all defense contractors and subcontractors remain contractually obligated to protect Covered Defense Information under DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. Accordingly, contractors must continue to implement adequate security, report qualifying cyber incidents, preserve affected systems, submit malicious software when required, and otherwise comply with the clause’s cybersecurity and incident reporting obligations.
The suspension of CMMC Phase II does not alter these contractual requirements. Contractors that fail to comply with DFARS 252.204-7012 continue to face significant contractual, administrative, and potential False Claims Act exposure if they knowingly misrepresent their cybersecurity compliance.
Potential Implications for Pending Procurements
The announcement also raises important questions for ongoing procurements. Many solicitations anticipated incorporating CMMC Phase II certification requirements over the coming months. Contracting agencies will now need to determine whether existing solicitations should be amended, whether pending procurements require revised evaluation criteria, and how future solicitations will address cybersecurity qualifications while the department conducts its review. Offerors should closely monitor amendments to active solicitations, agency guidance, and procurement-specific instructions, as contracting officers begin implementing this policy change.
What Contractors Should Do Now
Although this announcement temporarily relieves contractors of impending third-party certification requirements, it should not result in reduced cybersecurity efforts. Contractors should continue maintaining robust NIST SP 800-171 compliance programs, ensure their self-assessments accurately reflect current implementation status, verify ongoing compliance with DFARS 252.204-7012, and remain prepared for potential government cybersecurity assessments.
Companies should also closely follow the department’s 60-day review process. The recommendations of the CMMC Reform Task Force could substantially reshape how cybersecurity requirements are incorporated into future Department of Defense procurements and may result in an entirely different compliance framework focused more heavily on operational resilience than formal certification.
Looking Ahead
The suspension of CMMC Phase II represents one of the most significant cybersecurity policy developments affecting defense contractors in recent years. While the department has reaffirmed that cybersecurity remains a top priority, its announcement signals a willingness to rethink how those objectives are achieved.
Whether the ultimate result is a streamlined version of CMMC, a more flexible certification model, or an entirely new approach to cybersecurity compliance remains to be seen. For now, defense contractors should resist the temptation to view this announcement as a rollback of cybersecurity obligations. Instead, they should recognize that while certification requirements may be changing, the government’s expectations regarding protection of sensitive defense information remain firmly in place.
Organizations that continue investing in mature cybersecurity programs and maintaining compliance with NIST SP 800-171 and DFARS 252.204-7012 will be best positioned regardless of what reforms ultimately emerge from the department’s review.
If you have any questions about this noteworthy development or require assistance, please do not hesitate to contact Aron Beezley or Nathaniel Greeson.