CMMC Phase II Suspended: What the Department of War’s Announcement Means for Your Compliance Roadmap
On July 13, 2026, the Department of War (DoW) announced it is immediately suspending the transition to Phase II of the Cybersecurity Maturity Model Certification (CMMC) program. Phase II, the tier that would have required formal third-party (C3PAO) certification, had been scheduled to begin phasing into contracts on November 10, 2026. That timeline, along with all pending and future CMMC implementation milestones tied to Phase II, has now been put on hold.
For defense contractors and subcontractors who have spent the last several years preparing for certification, this is a significant development. But it is important to understand exactly what changed, what didn’t, and why this is the wrong moment to ease off your security posture.
What the Department of War Actually Announced
According to the official release, the suspension is tied to Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives, which prioritize speed to capability, reduced barriers for small, medium, and non-traditional businesses, and a shift away from bureaucratic compliance toward scalable, resilient cybersecurity. DoW cited data, including reporting from the Small Business Administration, indicating that CMMC compliance costs and administrative burden were pushing innovative companies out of the defense industrial base (DIB), which in turn risked delaying capability delivery to the warfighter.
To address this, DoW’s Chief Information Officer, Kirsten A. Davies, announced the immediate suspension of Phase II requirements and the launch of a 60-day study into the program’s future. The Department is standing up a CMMC Reform Task Force, which will serve as the central body for synthesizing industry feedback gathered through a public Request for Information (RFI). The task force is expected to recommend more scalable, realistic security measures aimed at lowering barriers for small and non-traditional businesses, with a final report due to the DoW CIO within 60 days.
Under Secretary of War for Acquisition and Sustainment Michael Duffey framed the move as part of a broader push to cut bureaucracy while maintaining a firm security baseline, positioning it as a way to keep innovators and competitive suppliers active in the defense supply chain.
What Is Suspended
- The Phase II third-party certification requirement and its rollout schedule
- All pending and future CMMC implementation milestones tied to Phase II across DoW solicitations and contracts
What Is Not Suspended
- DFARS clause 252.204-7012 — your contractual obligation to safeguard covered defense information remains fully in force
- CMMC Phase I self-assessment requirements — these remain firmly in place
- NIST SP 800-171 Rev 2 compliance — DoW will continue enforcing this standard through self-assessments and select government-led assessments during the interim period, with an emphasis on tangible cyber hygiene rather than paperwork
DoW was explicit on this last point: suspending Phase II does not eliminate the requirement to protect federal data. Every defense contractor and subcontractor remains contractually bound to safeguard covered defense information under DFARS 252.204-7012, regardless of where CMMC certification stands.
Our Read: A Pause and a Redesign, Not a Cancellation
It’s tempting to read this announcement as a green light to shelve your compliance efforts. We’d strongly caution against that interpretation, for a few reasons.
Your legal exposure hasn’t changed. DFARS 252.204-7012 is written into your contracts today, independent of CMMC’s certification status. Suspending Phase II doesn’t touch that clause.
This is very likely a “when,” not an “if.” DoW’s own language frames this as an effort to build a faster, more scalable version of CMMC, not to eliminate third-party verification as a concept. Companies that let their security posture lapse now risk having to scramble again once the task force’s recommendations take effect, with less runway to prepare than they have today.
NIST SP 800-171 Rev 2 is the real floor, and it’s still being enforced. DoW confirmed it will continue enforcing 800-171 through self-assessments and select government-led reviews throughout this interim period. If your organization has been building toward CMMC certification, the bulk of that work, your System Security Plan (SSP), Plan of Action and Milestones (POA&M), and SPRS score, is 800-171 work. None of it is wasted effort, and all of it still matters right now.
Adversaries aren’t operating on a 60-day review cycle. The threats CMMC was designed to address don’t pause while the task force does its work.
How to Use This Window Well
Rather than standing down, the companies that come out ahead over the next several months will be the ones who use this pause to genuinely strengthen their security posture. We recommend focusing on:
- Get your SPRS score accurate and current. This score is under increasing scrutiny and will matter regardless of what CMMC ultimately becomes.
- Stress-test your SSP and POA&M. If a government-led assessment showed up tomorrow, would your documentation hold up?
- Close real control gaps against NIST SP 800-171 Rev 2 — access management, incident response, encryption–not just paperwork gaps.
- Get flow-down right with your subcontractors. DFARS 7012 obligations extend down your entire supply chain, and this remains one of the most common blind spots we see.
- Watch the CMMC Reform Task Force closely. We’re tracking its work and will flag anything material as soon as it becomes public.
Companies that use this window to genuinely strengthen their posture rather than chase a moving certification date will walk into whatever comes next already compliant, without a last-minute scramble or wasted spend.
Where Does Your Organization Stand?
The security bar hasn’t moved. Only the certification mechanism is under review. If you’d like an honest, no-pressure assessment of where your business stands today against NIST SP 800-171 and DFARS 252.204-7012, we’re glad to help. No lectures, no fear tactics, just a clear picture of where you stand and a practical plan to get where you need to be.
