CMMC Phase II Rollout Suspension: What Defense Contractors Need to Know

On July 13, 2026, the Department of War (DoW) suspended CMMC Phase II requirements that would have placed third-party certification requirements into new solicitations beginning November 10, 2026. This is only a temporary pause to the implementation of CMMC Phase II, delaying the requirement for mandatory third-party (C3PAO) assessments while it conducts a comprehensive review of the program. The Department emphasized that this is not a rollback of cybersecurity requirements—contractors must still comply with DFARS cybersecurity clauses, implement the security controls in NIST SP 800-171, and continue protecting Controlled Unclassified Information (CUI). 

Instead, this review is focused on determining whether the current certification and assessment model creates unnecessary cost, administrative burden, and barriers to participation in the Defense Industrial Base, particularly for small businesses. During the review, the Department will evaluate alternative approaches that maintain strong cybersecurity while reducing compliance costs, streamlining acquisition, and expanding competition, signaling that the future of CMMC is more likely to involve changes to how compliance is verified rather than what cybersecurity requirements contractors must meet.

The DoW announcement has provided this CMMC Reform Task Force with 60 days to deliver industry-led recommendations. What has not changed are the underlying cybersecurity and CMMC Phase I reporting obligations for defense contractors and subcontractors that handle controlled unclassified information (CUI).

Why the DoW Paused This Phase II of the Rollout

The memorandums repeatedly cite four primary reasons:

1. CMMC became too expensive: The Department states the current implementation has created prohibitive compliance costs, excessive bureaucracy, and significant administrative overhead rather than simply improving cybersecurity. 
2. Small businesses are leaving the Defense Industrial Base: The CIO specifically references SBA findings indicating that many small businesses, innovative startups and non-traditional defense contractors were deciding that defense work simply wasn’t worth the compliance burden.  The Department concludes that this ultimately hurts national security because fewer suppliers means less innovation and slower delivery of capability to the warfighter.  
3. Acquisition speed has become the priority: Everything is now being framed around Secretary Hegseth’s Acquisition Transformation System (ATS).  The repeated themes are: 1) speed to capability, 2) remove bureaucracy, 3) expand the industrial base, 4) increase competition, and 5) buy capability faster.  The CIO repeatedly states cybersecurity must support, not impede, those objectives.  
4. Cybersecurity still matters: The Department goes out of its way to say that robust cybersecurity remains a non-negotiable priority. The DoW is not walking away from cybersecurity, they are just questioning whether CMMC’s certification model is the right way to enforce it.  This Task Force is soliciting input from industry on how to do just that.

What Changed, Effective Immediately

The implementation memorandum specifically states that during the CMMC Phase II rollout suspension, program offices may require only:

• Level 1 (Self) (read this as the CMMC Level 1 Self Tab in SPRS)
• Level 2 (Self) (read this as the CMMC Level 2 Self Tab in SPRS)
  
  

They may not require the following for new solicitations during the suspension:

• Level 2 C3PAO assessments (read this as Level 2 Certification requirement in DFARS 7025 solicitation provision)
• Level 3 DIBCAC assessments (read this as Level 3 Certification requirement in DFARS 7025 solicitation provision)

Existing solicitations containing those requirements (solicitation Provision DFARS 252.204-7025 and contract clause DFARS 252.204-7021) are directed to be amended as practical.  

What This Does NOT Mean to Contractors

• It does not mean the CMMC program is canceled. This is a suspension with a 60-day “task force” review of the Phase II rollout of the CMMC Certification requirements to be placed into contracts starting November 10, 2026.  This is  not a repeal, in any way, of CMMC. The Phase I of the CMMC rollout is still in effect for reporting your scores to the CMMC L2 Tab and DFARS 252.204-7012 remains in place for reporting of your SPRS score to the NIST 800-171 tab. The 32 CFR Part 170 rule (which finalized rulemaking for the CMMC program as a whole) remains in place.  DFARS 252.204-7012 and DFARS 252.204-7021 remain in place.   And CMMC could return in a revised, streamlined or substantially similar form. Companies that use this period to maintain progress may be better positioned when the task force reports its recommendations. 
• It does not mean Phase I of the CMMC Rollout is rescinded. Phase I self-assessment requirements remain in place. Contractors should continue to post their scores on both the NIST 800-171 tab as well as the CMMC L2 “Self” Tab in the Supplier Performance Risk System (SPRS).  To qualify for contracts in the Phase I Rollout of CMMC,  annual affirmations continue to matter, and organizations should ensure that scores are current, accurate and supported by appropriate evidence. 
• It does not mean DIB contractors can stop protecting CUI. The release states that DFARS 252.204-7012 remains contractually binding on defense contractors and subcontractors handling covered defense information. That clause has required NIST SP 800-171 implementation since 2017.
• It does not mean NIST SP 800-171 is optional. During this interim period, the DoW is expected to continue enforcing NIST SP 800-171 Rev. 2 compliance through self-assessments and select government-led (DCMA DIBCAC) assessments. Contractors should continue to maintain documentation that supports implementation and be prepared to demonstrate the basis for their compliance posture.
• It does not mean the DoD will just “roll back” reporting to just the NIST 800-171 SPRS Tab.  The CMMC Level 2 “Self” Tab is the current requirement.  The requirement for the CMMC L2 “Self” (self-attest) tab is more difficult for contractors than the NIST 800-171 tab because they must mark each control as met or not met, and the SPRS system will automatically calculate the contractor’s score.  If your score is not an 88 or above (conditional CMMC certification level) or you have even one control still open that is score as a –3 or –5, the submit button will be grayed out until those minimum conditions are met.
• It does not mean that the False Claims Act claims risk for contractors has decreased. In a self-attestation environment, the accuracy of the assessment remains a critical control. The Department of Justice’s Civil Cyber-Fraud Initiative has resulted in settlements involving contractors that represented compliance they did not have.  Whistleblowers still exist and can report companies that are knowingly committing fraud to the U.S. Government. Contractors should evaluate whether their self-assessments, SPRS scores and supporting documentation can withstand scrutiny.  Remember that the CMMC L2 “Self” tab in SPRS Provides the DOJ a “system of record” for your scores – and the CMMC L2 is recording each control you have marked as met.  That system of record will keep your scores for 6 years.
• It does not mean existing certifications have lost value. Contractors that have already earned a Level 2 certification hold third-party validation of NIST SP 800-171 implementation, which may remain important to customers, primes and other stakeholders even while Phase II requirements are under review.
• It does not mean the threat has paused. Adversaries targeting the Defense Industrial Base (DIB) are not waiting on a task force report. The requirement to protect CUI exists because sensitive defense information continues to be actively targeted.

What is Currently Under Review by the DoW

What appears to be under review is the delivery mechanism: who evaluates implementation, how often assessments occur and how/when certification requirements are incorporated into solicitations. The standard itself has not changed.

The DoW’s reasoning also reflects a concern many contractors have raised: legacy compliance approaches can be costly, administratively burdensome and difficult for small and mid-sized innovators to sustain. The directive emphasizes speed to capability, lower barriers for small and non-traditional businesses, and tangible cyber hygiene rather than administrative overhead.

This is not compliance going away. It is a reminder that compliance activities should be practical, risk-aligned, and tied to meaningful data protection for the Government’s most sensitive but unclassified data flowing through contractor systems.

Contractors do not necessarily need to rebuild their entire enterprise network to handle CUI safely. In many cases, organizations may be able to construct a purpose-built secure enclave, keep commercial operations out of scope where appropriate, automate technical controls and make the cost of compliance more predictable. The objective should be real data protection supported by clear evidence, not administrative checklists that do not reduce risk.

Takeaways