Organizations following the latest CMMC news should be aware that on July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. While the certification timeline has changed, Phase I self-assessment requirements remain fully in place.
The DoD is launching a 60-day, top-to-bottom review of the entire Cybersecurity Maturity Model Certification program to align it with Secretary Pete Hegseth’s Acquisition Transformation System (ATS), which prioritizes speed to capability, lower barriers for small, medium, and non-traditional businesses, and scalable security over bureaucratic compliance. CIO Kirsten A. Davies framed the move as removing “paralyzing costs” and “red tape” that — per recent SBA data cited in the release — have been driving innovative companies out of the Defense Industrial Base (DIB) and delaying delivery of capabilities to warfighters.
Critically, the suspension does not relax the underlying obligation to protect federal data. During the interim period, the Department will enforce cybersecurity compliance against the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.
All defense contractors and subcontractors remain contractually bound to safeguard covered defense information under DFARS clause 252.204-7012. A newly established CMMC Reform Task Force will synthesize industry feedback gathered through a public Request for Information (RFI) and deliver a final report to the DoD CIO within 60 days.
While the certification timeline has changed, organizations should view this as a procedural pause – not a reduction in cybersecurity expectations.
While this CMMC update changes the certification timeline, it does not reduce organizations’ cybersecurity responsibilities.
While the CMMC Phase II implementation timeline may change, organizations should not view this announcement as a reason to pause cybersecurity efforts. The underlying requirements to protect sensitive defense information remain in place, and maintaining progress now will position your organization to respond quickly once updated CMMC guidance is released.
Whether your organization is evaluating its current readiness, addressing gaps or preparing for future certification requirements, Withum’s Cybersecurity Services Team can help you understand your obligations, identify gaps and prepare for what’s next.
For more information on this topic, please contact a member of our team.
Reporting window: October 26 – November 9 (trailing 14 days) Cyber Matters is Withum’s bi-weekly brief on the cyber threats and incidents that deserve leadership attention. Each edition filters two weeks of government alerts, vendor research and incident reporting down to the developments that change risk, and pairs each with practical steps. This edition covers…
University Hospitals (UH), an 18-hospital system based in Cleveland, has spent the past week recovering from a cybersecurity incident that took digital services offline and led to the rescheduling of some appointments and elective procedures. The incident remains under investigation, and the facts may change. Even so, the disruption already raises practical questions for every…
Reporting window: October 12 – October 26 (trailing 14 days) Cyber Matters is Withum’s bi-weekly brief on the cyber threats and incidents that deserve leadership attention. Each edition filters two weeks of government alerts, vendor research and incident reporting down to the developments that change risk, and pairs each with practical steps. This edition covers…
