Organizations following the latest CMMC news should be aware that on July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. While the certification timeline has changed, Phase I self-assessment requirements remain fully in place.
The DoD is launching a 60-day, top-to-bottom review of the entire Cybersecurity Maturity Model Certification program to align it with Secretary Pete Hegseth’s Acquisition Transformation System (ATS), which prioritizes speed to capability, lower barriers for small, medium, and non-traditional businesses, and scalable security over bureaucratic compliance. CIO Kirsten A. Davies framed the move as removing “paralyzing costs” and “red tape” that — per recent SBA data cited in the release — have been driving innovative companies out of the Defense Industrial Base (DIB) and delaying delivery of capabilities to warfighters.
Critically, the suspension does not relax the underlying obligation to protect federal data. During the interim period, the Department will enforce cybersecurity compliance against the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.
All defense contractors and subcontractors remain contractually bound to safeguard covered defense information under DFARS clause 252.204-7012. A newly established CMMC Reform Task Force will synthesize industry feedback gathered through a public Request for Information (RFI) and deliver a final report to the DoD CIO within 60 days.
While the certification timeline has changed, organizations should view this as a procedural pause – not a reduction in cybersecurity expectations.
While this CMMC update changes the certification timeline, it does not reduce organizations’ cybersecurity responsibilities.
While the CMMC Phase II implementation timeline may change, organizations should not view this announcement as a reason to pause cybersecurity efforts. The underlying requirements to protect sensitive defense information remain in place, and maintaining progress now will position your organization to respond quickly once updated CMMC guidance is released.
Whether your organization is evaluating its current readiness, addressing gaps or preparing for future certification requirements, Withum’s Cybersecurity Services Team can help you understand your obligations, identify gaps and prepare for what’s next.
For more information on this topic, please contact a member of our team.
Cybersecurity Awareness Month reinforces the importance of employee awareness and sound security practices. As highlighted in our recent article on cyber risk and the changing threat landscape, organizations face increasingly sophisticated threats. But training and technical safeguards can only go so far without appropriate verification and oversight. Employees routinely approve financial transactions, manage access to…
Reporting window: September 28 – October 12, 2026 (trailing 14 days) This period had one defining pattern. Attackers came in through access someone else had already approved: a vendor’s login to a national register, an employee’s cloud credentials, a customer portal, and the consoles that manage whole networks. One ransomware attack on a cloud provider…
Reporting window: September 14 – September 28, 2026 (trailing 14 days) What Actually Matters This Cycle Executive Snapshot This cycle in one line: Attackers are going straight at the systems that hold people data, from HR and recruiting platforms to court records and a Pentagon personnel server, and many of the worst exposures trace back…
