DoD Suspends CMMC Phase II: 60-Day Review and 30-Day RFI Signal Major Regulatory Shift

For defense contractors and their legal teams, the DoD's suspension of CMMC Phase II represents a sudden regulatory halt with significant contractual implications. While the suspension temporarily removes the third-party assessment mandate, it does not absolve contractors from existing cybersecurity obligations under DFARS and CUI handling. The 60-day review could lead to a revised rulemaking that fundamentally alters the landscape of defense procurement compliance.

On July 13, 2026, the U.S. Department of Defense abruptly suspended the transition to Cybersecurity Maturity Model Certification (CMMC) Phase II, scrapping the November 10, 2026 deadline that would have mandated third-party assessments for contractors handling controlled unclassified information (CUI). The move, announced via two memoranda, halts the most stringent tier of the Pentagon’s landmark cybersecurity certification program and signals a fundamental reassessment of how to secure the defense industrial base without unduly burdening industry participants. The suspension is effective immediately, and pending CMMC milestones in solicitations and contracts are paused while a 60-day Reform Task Force conducts a comprehensive review.

“

Secretary of Defense Pete Hegseth’s Acquisition Transformation System (ATS) now frames this suspension as part of broader acquisition reform aimed at accelerating acquisitions, reducing unnecessary regulatory burdens, and expanding opportunities.

The CMMC program, finalized in October 2024 under 32 C.F.R. Part 170, was designed to replace a self-attestation model with third-party validation to verify contractors’ implementation of NIST SP 800-171 security controls. It rolled out in phases: Phase I began in September 2025, requiring basic self-assessments, while Phase II, originally set for November 2026, was to enforce full certification for CUI handlers. The program’s complexity and cost drew sharp criticism from industry, especially small and mid-sized contractors who argued that the compliance overhead threatened their viability. Secretary of Defense Pete Hegseth’s Acquisition Transformation System (ATS) now frames this suspension as part of broader acquisition reform aimed at accelerating acquisitions, reducing unnecessary regulatory burdens, and expanding opportunities.

The immediate effect for contractors is relief from the impending Phase II certification requirement. Defense firms that had been scrambling to achieve Level 2 third-party assessment readiness can now scale back those efforts, at least temporarily. However, the suspension does not relieve them of existing cybersecurity obligations. Contractors must still comply with Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, which mandates safeguarding CUI and reporting cyber incidents, and with any CMMC Phase I requirements, including applicable self-assessments. In addition, DoD program managers may still designate Level 1 or Level 2 (Self) assessment requirements on individual contracts, meaning that some self-assessment burdens persist. Thus, the compliance landscape remains in a state of partial limbo.

The 60-day CMMC Reform Task Force, established concurrently with the suspension, will gather industry feedback through a Request for Information (RFI) focusing on readiness, cost drivers, and current control implementations. The RFI, to be conducted over the coming month, seeks to identify barriers to participation in the defense supply chain. The task force’s recommendations, due at the end of the 60-day period, will inform a potential revision of the CMMC framework. The department’s goal is to maintain strong cybersecurity while removing friction that has narrowed the pool of eligible contractors, a concern amplified by recent geopolitical tensions and the need to surge production.