On July 13, 2026, the Department of War (DoW) announced it is immediately suspending the transition to CMMC Phase II, the tier that would have required formal third-party (C3PAO) certification. We’ve had a lot of client questions since then. Here are the straight answers.
What exactly happened?
DoW suspended the Phase II certification requirement and its rollout, which had been scheduled to begin phasing into contracts on November 10, 2026. All pending and future CMMC implementation milestones tied to Phase II are also suspended. DoW’s Chief Information Officer, Kirsten A. Davies, tied the decision to Secretary of War Pete Hegseth’s Acquisition Transformation System directives, which push for faster capability delivery and lower compliance barriers for small and mid-size businesses.
Does this mean CMMC is going away?
No. DoW is standing up a CMMC Reform Task Force to run a 60-day review, drawing on industry feedback, aimed at making the program faster and less burdensome, not eliminating it. Read this as a redesign in progress, not a cancellation.
What’s actually suspended?
Just the Phase II certification requirement and its associated timeline and milestones.
What’s still in effect?
Everything else:
- DFARS 252.204-7012 — your contractual obligation to safeguard covered defense information
- Phase I self-assessment requirements
- NIST SP 800-171 Rev 2 compliance — DoW says it will keep enforcing this through self-assessments and select government-led reviews
Should we stop working on our compliance program?
No. Here’s the short version of why:
- Your legal exposure under DFARS 7012 hasn’t changed
- This is very likely a “when,” not an “if”. Companies that pause now may face a compressed timeline later
- Most of your CMMC prep work- SSP, POA&M, SPRS score- is 800-171 work, and none of it is wasted
- The threats CMMC was designed to address don’t pause for a policy review
What should we be doing right now?
- Get your SPRS score accurate and current
- Stress-test your SSP and POA&M against real scrutiny
- Close actual control gaps (access management, incident response, encryption), not just paperwork gaps
- Get subcontractor flow-down right under DFARS 7012
- Keep an eye on the CMMC Reform Task Force’s progress over the next 60 days
Where can we get help?
If you’d like an honest, no-pressure look at where your business stands today against NIST SP 800-171 and DFARS 252.204-7012, we’re glad to help. No lectures, no fear tactics, just a clear picture and a plan.
