On July 13, 2026, the Department of War immediately suspended the Phase II requirements of the Cybersecurity Maturity Model Certification (CMMC) program, previously scheduled to begin on November 10, 2026, and placed later milestones on hold while it conducts a 60-day review.
During the pause, acquisition programs may only require Level 1 or Level 2 self-assessments; they may not mandate external (i.e., third-party and government-led) certification.
The pause does not suspend underlying obligations to protect Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Phase I self-assessment requirements, NIST SP 800-171 Rev. 2 obligations, and applicable FAR and DFARS cybersecurity clauses remain in effect.
Applicability
The suspension is relevant to defense contractors and subcontractors with current contractual obligations for CMMC Level 2 or Level 3 external assessment or who have been anticipating that such obligations would be forthcoming.
Organizations subject only to Level 1 or Level 2 self-assessment requirements are largely unaffected, as such obligations remain within the current Phase I framework, which is still valid.
What Changed?
The announcement changes the near-term compliance timetable in several ways:
- The November 2026 Phase II transition is paused: The next implementation phase and later milestones are on hold until further notice.
- New requirements for external certification may not be imposed: During the review, acquisition programs may issue requirements for Level 1 or Level 2 self-assessments, but not Level 2 or Level 3 external assessments.
- Existing requirements for external certification must be removed: Active solicitations containing the paused assessment requirements must be amended to remove them as soon as practicable, and existing contracts must have the paused requirements removed prior to the exercise of the next option period or during the next scheduled administrative modification.
- A 60-day program review is underway: A reform task force will perform a full review of the program and recommend a more scalable approach intended to reduce barriers for smaller businesses.
- Final rules and timing remain unresolved: Security leaders should expect more guidance after the review and avoid treating the pause as a permanent exemption.
What Has Not Changed?
The certification timetable changed; the underlying security and contract obligations did not:
- Self-assessments still apply: Level 1 self-assessments for FCI and Level 2 self-assessments for CUI may continue to appear in solicitations and contracts, and existing contracts with these requirements remain valid. Required affirmations and assessment records should remain current.
- NIST SP 800-171 Rev. 2 compliance remains the interim baseline: Compliance with NIST SP 800-171 will continue to be enforced through contractor self-assessments and select government-led assessments. A paused external assessment mandate does not excuse missing controls or unsupported self-assessment scores.
- FAR and DFARS obligations remain enforceable: Applicable FAR and DFARS clauses continue to require protection of covered information, including safeguarding CUI and incident reporting. Clients may also continue to impose cybersecurity expectations on their subcontractors.
Recommended Actions
The suspension should be viewed as additional preparation time, not a reason to pause readiness activities. Contractors should continue to:
- maintain accurate system boundaries;
- complete and update self-assessments;
- complete remediation plans;
- preserve evidence of control implementation; and
- monitor Department of War guidance.
Organizations that continue preparing during the review will be better positioned to respond to revised requirements without a costly restart or compressed implementation timeline.