Several months into the Department of War’s (DoW) suspension of the next phase of the Cybersecurity Maturity Model Certification (CMMC) Program, contractors are continuing to navigate uncertainty relating to the program. With the Department’s review underway, this post takes stock of where the program stands, what remains in effect, and what contractors should be considering.
Suspension and Task Force
On July 13, 2026, the DoW issued a memorandum suspending Phase 2 of the CMMC Program, which was scheduled to begin on November 10, 2026. Phase 2 would have required third-party assessments and resulting CMMC Level 2 certifications as conditions of award for DoW contracts involving controlled unclassified information (CUI). The memorandum placed the remaining implementation of Phases 3 and 4 on hold pending further notice and established a CMMC Reform Task Force to review the CMMC program. This represents the second significant pause in the long history of the CMMC program, with the first occurring during the Biden administration prior to CMMC going into effect. That review resulted in “CMMC 2.0,” and we covered those developments in a series of articles that are linked here.
The same day it issued the memorandum, DoW released a Request for Information (RFI) regarding potential reform to CMMC and ways to reduce compliance burdens on the Defense Industrial Base. The text of the RFI appears to extend beyond consideration of the cost and availability of third-party assessments that were cited in the memorandum to broader questions. These include questions about assessment scope, the treatment of cloud and managed service providers, implementation across the supply chain, and the application of CMMC to operational technology and other specialized environments.
The Task Force convened in early September to consider the more than 1,100 comments that the RFI generated. The Task Force’s report was due to DoW’s Chief Information Officer (CIO) on September 11, 2026, though it has not yet been made public.
DoW CIO Kirsten Davies discussed the Task Force’s review during a September 9 appearance at the Billington Cybersecurity Summit. Press reports quote Davies as stating that more than half the comments supported the Phase 2 suspension, and that concerns from the third-party assessor base focused on how DoW would confirm compliance with federal cybersecurity requirements. The reported remarks also highlighted DoW’s parallel review of the Risk Management Framework and, consistent with the RFI, its focus on the cybersecurity risks to operational and manufacturing technology.
Taken together, these developments suggest that DoW is considering both possible roll-backs of planned requirements, as well as some potential expansions, such as those relating to the security of operational technology. The Task Force’s recommendations may provide the first clear indication of how DoW intends to balance those objectives.
What Remains in Effect
Until DoW finalizes its review and makes decisions relating to the future of CMMC, contractors will continue to be required by standard DoW contract clauses to self-assess to CMMC compliance, including compliance with NIST SP 800-171 Rev. 2 controls for CMMC Level 2. This means that offerors generally must have the required current status and affirmation in the Supplier Performance Risk System (SPRS) to be eligible for award, and must have attested to ongoing compliance with the requirements. Likewise, contractors must still comply with other cybersecurity requirements set forth in DFARS 252.204-7012, including cloud security requirements, cyber incident reporting and investigation obligations, and media preservation requirements.
DoW has emphasized that it intends to continue enforcing the underlying security requirements during the suspension through CMMC self-assessments and selected DoW-led assessments. Contractors therefore should continue the work necessary to comply with applicable DFARS and NIST SP 800-171 requirements. Contractors may also choose to reconsider the timing of possible third-party assessments in light of the ongoing review, though there may be some benefits to pursuing third party reviews regardless of whether they are currently required.