Key Takeaways
- • The Department of War suspended Phase II of the CMMC program effective immediately, halting the November 10, 2026 rollout of mandatory third-party assessments by certified C3PAOs and indefinitely pausing all future CMMC implementation milestones across DoW solicitations and contracts.
- • Phase I self-assessment requirements remain fully in effect, and underlying cybersecurity obligations under NIST SP 800-171 Rev. 2, DFARS 252.204-7012, and FAR 52.204-21 continue to be enforced—this suspension addresses verification mechanisms only, not substantive security duties.
- • DoW established a 60-day CMMC Reform Task Force to conduct a "top-to-bottom" review citing prohibitive compliance costs, insufficient third-party assessment capacity, and barriers to small and nontraditional businesses, with recommendations expected to the DoW CIO within 60 days.
- • The Department of Justice's Civil Cyber-Fraud Initiative enforcement activity will continue unabated, with recent June 2026 settlements against both small and large defense contractors for NIST SP 800-171 control failures and misrepresented cybersecurity posture, leveraging False Claims Act treble damages and whistleblower qui tam provisions.
- • Prime contractors lose objective third-party validation of supplier cybersecurity controls, requiring heightened reliance on internal subcontractor risk management programs and increasing exposure to supply chain breach risk absent CMMC certification data.
Summary
On July 13, 2026, the Department of War announced an immediate suspension of CMMC Phase II requirements originally scheduled for November 10, 2026. This phase would have mandated third-party assessments by certified CMMC Third-Party Assessment Organizations (C3PAOs) as a contractual condition for many DoW award recipients. Simultaneously, DoW placed all pending and future CMMC implementation milestones "in abeyance until further notice," effectively freezing the broader certification rollout across defense industrial contracts. The decision provides near-term relief to defense contractors facing escalating compliance costs, though DoW explicitly clarified that the suspension targets verification mechanisms rather than substantive cybersecurity obligations.
The Pentagon's action preserves Phase I self-assessment requirements in full effect and reaffirms that underlying federal data protection mandates remain enforceable. Contractors must continue implementing the 110 NIST SP 800-171 Rev. 2 controls required under DFARS 252.204-7012 and comply with FAR 52.204-21 provisions governing Federal Contract Information and Covered Defense Information. DoW stated unambiguously that the suspension "does not eliminate the requirement for companies to protect federal data," signaling that the pause reflects sympathy toward compliance cost burdens without relieving substantive security responsibilities.
To address systemic challenges, DoW established a CMMC Reform Task Force to conduct a comprehensive 60-day review of the program. The Task Force will solicit industry feedback through a public request for information and examine three primary concerns cited by DoW leadership: prohibitive compliance costs, acute shortages in third-party assessment capacity, and structural barriers facing small and nontraditional businesses. The Task Force is tasked with recommending "scalable, realistic security measures" and will deliver recommendations to the DoW CIO within the 60-day window, potentially signaling a pathway toward revised CMMC architecture—colloquially referred to as "CMMC 3.0" in industry discussion.
A critical practical consequence is the loss of objective third-party validation in supplier cybersecurity posture. Prior to the suspension, prime contractors could leverage CMMC certifications as independent evidence that subcontractors adequately protected sensitive government information and Controlled Unclassified Information (CUI). With Phase II suspended, that certification data becomes unavailable, forcing primes to expand their own subcontractor risk management programs and accept elevated supply chain breach risk absent external validation.
Notably, the suspension will not impede the Department of Justice's Civil Cyber-Fraud Initiative enforcement momentum. Since launching the initiative in October 2021, DOJ has aggressively pursued cybersecurity-related False Claims Act violations, leveraging treble damages, civil penalties, and whistleblower qui tam provisions. Recent June 2026 settlements against both small and large defense contractors for NIST SP 800-171 control failures and misrepresented cybersecurity posture demonstrate sustained enforcement intensity. Contractors remain subject to DOJ scrutiny on three primary misconduct categories: providing deficient cybersecurity products or services, misrepresenting cybersecurity practices or protocols, and violating obligations to monitor and report cybersecurity incidents. The administration has announced more cybersecurity fraud resolutions than the prior administration combined, with whistleblower complaints driving a disproportionate share of cases. Contractors should treat cybersecurity compliance, accuracy of government-facing representations, incident reporting, and subcontractor flow-down disciplines as live, priority obligations while remaining alert to internal whistleblower risk and considering engagement with experienced counsel under privilege regarding past non-compliance.
The Pentagon's action preserves Phase I self-assessment requirements in full effect and reaffirms that underlying federal data protection mandates remain enforceable. Contractors must continue implementing the 110 NIST SP 800-171 Rev. 2 controls required under DFARS 252.204-7012 and comply with FAR 52.204-21 provisions governing Federal Contract Information and Covered Defense Information. DoW stated unambiguously that the suspension "does not eliminate the requirement for companies to protect federal data," signaling that the pause reflects sympathy toward compliance cost burdens without relieving substantive security responsibilities.
To address systemic challenges, DoW established a CMMC Reform Task Force to conduct a comprehensive 60-day review of the program. The Task Force will solicit industry feedback through a public request for information and examine three primary concerns cited by DoW leadership: prohibitive compliance costs, acute shortages in third-party assessment capacity, and structural barriers facing small and nontraditional businesses. The Task Force is tasked with recommending "scalable, realistic security measures" and will deliver recommendations to the DoW CIO within the 60-day window, potentially signaling a pathway toward revised CMMC architecture—colloquially referred to as "CMMC 3.0" in industry discussion.
A critical practical consequence is the loss of objective third-party validation in supplier cybersecurity posture. Prior to the suspension, prime contractors could leverage CMMC certifications as independent evidence that subcontractors adequately protected sensitive government information and Controlled Unclassified Information (CUI). With Phase II suspended, that certification data becomes unavailable, forcing primes to expand their own subcontractor risk management programs and accept elevated supply chain breach risk absent external validation.
Notably, the suspension will not impede the Department of Justice's Civil Cyber-Fraud Initiative enforcement momentum. Since launching the initiative in October 2021, DOJ has aggressively pursued cybersecurity-related False Claims Act violations, leveraging treble damages, civil penalties, and whistleblower qui tam provisions. Recent June 2026 settlements against both small and large defense contractors for NIST SP 800-171 control failures and misrepresented cybersecurity posture demonstrate sustained enforcement intensity. Contractors remain subject to DOJ scrutiny on three primary misconduct categories: providing deficient cybersecurity products or services, misrepresenting cybersecurity practices or protocols, and violating obligations to monitor and report cybersecurity incidents. The administration has announced more cybersecurity fraud resolutions than the prior administration combined, with whistleblower complaints driving a disproportionate share of cases. Contractors should treat cybersecurity compliance, accuracy of government-facing representations, incident reporting, and subcontractor flow-down disciplines as live, priority obligations while remaining alert to internal whistleblower risk and considering engagement with experienced counsel under privilege regarding past non-compliance.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.