Articles
3 min read
CMMC News: DoD Suspends Phase II Requirements: What Changes and What Doesn’t
Organizations following the latest CMMC news should be aware that on July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. While the certification timeline has changed, Phase I self-assessment requirements remain fully in place.
The DoD is launching a 60-day, top-to-bottom review of the entire Cybersecurity Maturity Model Certification program to align it with Secretary Pete Hegseth’s Acquisition Transformation System (ATS), which prioritizes speed to capability, lower barriers for small, medium, and non-traditional businesses, and scalable security over bureaucratic compliance. CIO Kirsten A. Davies framed the move as removing “paralyzing costs” and “red tape” that — per recent SBA data cited in the release — have been driving innovative companies out of the Defense Industrial Base (DIB) and delaying delivery of capabilities to warfighters.
What This CMMC Update Means
Critically, the suspension does not relax the underlying obligation to protect federal data. During the interim period, the Department will enforce cybersecurity compliance against the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.
All defense contractors and subcontractors remain contractually bound to safeguard covered defense information under DFARS clause 252.204-7012. A newly established CMMC Reform Task Force will synthesize industry feedback gathered through a public Request for Information (RFI) and deliver a final report to the DoD CIO within 60 days.
Key Takeaway
While the certification timeline has changed, organizations should view this as a procedural pause – not a reduction in cybersecurity expectations.
What Organizations Should Do Now
While this CMMC update changes the certification timeline, it does not reduce organizations’ cybersecurity responsibilities.
Recommended Actions for Groups
- Don’t stand down security programs. The certification milestone paused, but the substantive obligations (NIST SP 800-171 Rev 2, DFARS 252.204-7012) did not. Maintain your control implementation and reallocate any freed-up “certification prep” budget toward closing real gaps.
- Keep your self-assessment and POA&M current. Government-led assessments against NIST 800-171 Rev 2 remain in scope during the interim. Ensure your SPRS score, System Security Plan, and Plan of Action & Milestones are accurate and defensible.
- Submit feedback to the RFI. This is a rare, direct channel to influence the program’s future. Groups facing prohibitive compliance costs (especially small, medium, and non-traditional businesses) should document specific burdens and cost data and respond formally.
- Pause — don’t cancel — third-party (C3PAO) certification efforts. Hold new Phase II certification spend while preserving the underlying remediation work; the future program will likely still expect a strong 800-171 baseline.
- Watch the 60-day window. Assign someone to monitor the Task Force’s output and the brilliant basics page so you can adjust quickly once the reformed requirements are published.
- Communicate up your supply chain. Primes should reassure and align subcontractors that safeguarding obligations still flow down under DFARS 7012, so no one misreads the suspension as a compliance holiday.
While the CMMC Phase II implementation timeline may change, organizations should not view this announcement as a reason to pause cybersecurity efforts. The underlying requirements to protect sensitive defense information remain in place, and maintaining progress now will position your organization to respond quickly once updated CMMC guidance is released.
Whether your organization is evaluating its current readiness, addressing gaps or preparing for future certification requirements, Withum’s Cybersecurity Services Team can help you understand your obligations, identify gaps and prepare for what’s next.
Have Questions or Need Guidance?
For more information on this topic, please contact a member of our team.
Related Insights
Navigating AI Security: Challenges and Best Practices
Artificial intelligence has moved from experiment to everyday business tool. As organizations accelerate AI adoption, AI security has become just as important as innovation. Employees now draft communications, analyze data and even write software with AI assistants — often faster than leadership can put guardrails in place. That speed is a genuine competitive advantage, but…
Audits, Fines and Ransomware: The High Cost of ‘Good Enough’ IT in Healthcare
Healthcare organizations operate in a complex environment; stakes are high and there is no margin for error. Cybersecurity in healthcare is no longer just an IT concern – it directly impacts patient safety, regulatory compliance, and day-to-day operations. Protecting sensitive patient data, ensuring regulatory compliance, and supporting continuous care have never been more important. When organizations settle for “good enough” IT solutions (systems and support/delivery) that merely meet minimum standards, they open…