On July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of CMMC Phase II requirements, originally set to take effect November 10, 2026. If you’re a defense contractor wondering what this means for your DoD contract (and whether to pump the brakes on compliance prep or not), this article is for you.
Short answer? Keep building. Here’s why.
The CMMC 2.0 suspension is real, but it’s not a green light to stand down. The DoD CIO announced the immediate suspension of Phase II requirements alongside the launch of a CMMC Reform Task Force, charged with delivering a top-to-bottom program review within 60 days. The move followed mounting pressure from small business stakeholders and the Small Business Administration (SBA), who raised the alarm that compliance costs were driving qualified companies out of the Defense Industrial Base (DIB).
The cost data tells the story. According to the SBA, total compliance costs can reach approximately $593,800 per CMMC certification for small firms requiring third-party assessment, and roughly $388,600 for firms eligible for self-assessment. With more than 120,000 DIB small businesses affected and only about 100 approved third-party assessors available, the program’s original timeline was a structural mismatch.
The pause is an acknowledgment that the program design wasn’t built for the supply chain it was meant to protect. It is not a signal that cybersecurity requirements are going away.
The suspension applies to Phase II requirements only. Phase I self-assessments remain firmly in place, and DFARS clause 252.204-7012 contractual obligations haven’t changed. You are still required to protect Covered Unclassified Information (CUI) and Federal Contact Information (FCI). During the review period, the DoD confirmed it will enforce cybersecurity compliance through NIST SP 800-171 Rev 2 via self-assessments and select government-led assessments.
| What has changed | The certification timeline is under review, third-party assessment requirements are suspended, and the Reform Task Force is actively soliciting industry feedback to recalibrate the framework. |
| What has not changed | The underlying security requirements. If you handle CUI, you still need to protect it. A pause on certification deadlines is not a pause on your data protection obligations. |
No. If you’ve been through a compliance cycle before, you may already know why.
Regulations shift. Deadlines move. Program designs get recalibrated. What doesn’t change is whether your organization can protect the data it handles. That capability doesn’t build itself during a pause, and it doesn’t disappear from a prime contractor’s vendor questionnaire because a federal deadline shifted.
The fundamentals (e.g., access controls, multi-factor authentication, incident response, vulnerability management) are not going to disappear from the final framework. They’ve been anchored in NIST SP 800-171 since CMMC 1.0, and the DoD has explicitly confirmed NIST SP 800-171 Rev 2 enforcement continues during the review period. Contractors who built toward those fundamentals are in a stronger competitive position regardless of what the reformed Phase II looks like.
The contractors who may struggle are the ones who hit pause now and start from scratch six months from now when the Reform Task Force delivers its recommendations.
Keep building, but build smart. The 60-day review period is the window to make ground-level progress without the distraction of certification deadlines.
Here’s where to focus:
| CMMC-Aligned Fundamental | Why It Matters Now | NIST 800-171 Domain |
| Multi-factor authentication | Required for all CUI system access; Phase I baseline | 3.5 — Identification & Authentication |
| Access control & least privilege | Limit who touches what & document it | 3.1 — Access Control |
| Incident response plan | Must be documented, tested, and current | 3.6 — Incident Response |
| System & communications protection | Encrypting CUI in transit and at rest | 3.13 — System & Comm. Protection |
| Audit logging & monitoring | Evidence of protection, not just policy | 3.3 — Audit & Accountability |
| Vulnerability management | Regular scanning with tracked remediation | 3.11 — Risk Assessment |
| Configuration management | Documented baselines for all CUI systems | 3.4 — Configuration Management |
| Employee security awareness training | People-layer protection; table stakes for any assessment | 3.2 — Awareness & Training |
Use this period to get your documentation in order as well. System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and asset inventories are the artifacts that auditors, and your enterprise customers, will request. Building them now, under less deadline pressure, will produce better documentation than scrambling six months from now.
The DoD announcement couldn’t have been clearer: “This action does not eliminate the requirement for companies to protect federal data.” The suspension is about bureaucratic cost structure, not lowering the bar on security.
We’ve seen this dynamic play out before. Compliance frameworks get revised, deadlines shift, certification structures change… but the underlying obligation to protect sensitive government data has only ever moved in one direction. Contractors who treated CMMC as a checkbox they were waiting to fill in are now waiting again. Contractors who treated it as a genuine security program are positioned to win work when the supply chain opens back up.
That distinction between compliance posture and security posture is exactly what prime contractors and contracting officers evaluate when they assess supply chain partners. A strong program you build during the pause will be a competitive differentiator.
Ready to build a program that holds up regardless of where the CMMC 2.0 framework lands? Contact our team to map your current posture and prioritize what moves the needle.
Phase I self-assessments remain required. Phase II requirements, including third-party certifications for many contractors, have been suspended as of July 13, 2026, pending a 60-day DoD review. Contractual obligations under DFARS 252.204-7012 to protect CUI and FCI remain fully in force.
Active contracts are not affected by the suspension. If your contract includes CMMC requirements, those remain. What changed is that new Phase II enforcement milestones and certification requirements have been paused while the DoD's Reform Task Force completes its review. NIST SP 800-171 Rev 2 compliance continues to be enforced via self-assessment in the interim.
No. The underlying security requirements, largely rooted in NIST SP 800-171, aren't going away. Companies that keep building during this period will be better positioned when the final framework publishes, and more competitive with prime contractors and enterprise customers who evaluate supply chain security independently of DoD deadlines.
The DoD CMMC Reform Task Force has a 60-day window to complete its review and deliver recommendations, putting initial findings around mid-September 2026. The timeline for any new rulemaking or updated implementation schedule has not yet been announced.
The suspension primarily affects the more than 120,000 small businesses in the Defense Industrial Base that would have been required to seek third-party or self-assessment certification under Phase II by November 10, 2026.