For the past several years, organizations supporting the U.S. Defense Industrial Base (DIB) have been working toward Cybersecurity Maturity Model Certification (CMMC). The phased rollout has been well understood, with many organizations targeting November 2026 as the point where third-party CMMC Level 2 assessments would become a contractual requirement.

That changed this week.

On July 13, 2026, the Department of War announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which was originally scheduled for November 10, 2026. All Phase I self-assessment requirements remain firmly in place. The Department will begin a comprehensive review of CMMC aimed at aligning with the Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives prioritizing speed to capability, lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures.

The Department of War announced the immediate suspension of the planned CMMC Phase II implementation while it conducts a 60-day review of the program. During this period, organizations that would have required a third-party C3PAO assessment under Phase II will instead continue using Level 1 or Level 2 self-assessments where applicable. The stated goal is to reduce barriers for companies supporting the Defense Industrial Base while maintaining appropriate cybersecurity protections.

For many organizations, this raises one obvious question.

Does this mean CMMC is being delayed?

The answer is both yes and no.

What Actually Changed?

The important distinction is that CMMC itself has not gone away. The Department has suspended the implementation of Phase II, specifically the requirement for mandatory third-party C3PAO assessments, which were scheduled to begin appearing in applicable contracts in November 2026.

Instead, organizations can continue relying on self-assessments while the Department evaluates how the program should evolve. A newly created CMMC Reform Task Force will review industry feedback and make recommendations within 60 days. That is a significant policy change. It is not a cancellation of CMMC.

Why Was It Suspended?

Reading the announcement, one message becomes very clear. The Department believes the current implementation may have created unintended consequences. Small and medium-sized suppliers have consistently raised concerns about:

  • High certification costs
  • Limited availability of certified assessors
  • Long scheduling delays
  • Administrative overhead
  • Companies choosing to leave the defense market altogether

The Department’s announcement specifically cites concerns that compliance costs were discouraging innovation and shrinking the supplier base rather than strengthening it. That aligns closely with the broader Brilliant Basics initiative.

How Brilliant Basics Fits Into This

If you haven’t read the Department’s Brilliant Basics guidance, it is worth doing. Rather than focusing purely on compliance activities, Brilliant Basics emphasizes returning to fundamental principles across the Department, including:

  • Simplicity
  • Accountability
  • Operational effectiveness
  • Reducing unnecessary bureaucracy
  • Improving mission delivery

The overall message is straightforward:

If a process slows down the mission without significantly improving security or capability, it deserves to be questioned.

That philosophy appears to be influencing cybersecurity as well. Instead of allowing certification itself to become the objective, the Department seems to be asking whether the current implementation is actually achieving the desired security outcomes. That is a healthy question.

Compliance should improve security. It should not become security.

What Does This Mean for Contractors?

This is where I think many organizations will make one of two mistakes.

Mistake #1: “Great, we can stop working on CMMC.”

No. Nothing in the announcement suggests organizations should stop implementing NIST SP 800-171 controls or improving their cybersecurity posture. If anything, the opposite is true.

The Department has repeatedly stated that protecting Controlled Unclassified Information (CUI) remains a priority. Only the assessment process is being reviewed.

Mistake #2: “Everything we’ve done was wasted.”

Also no. If your organization has spent the past year:

  • implementing multi-factor authentication
  • improving endpoint security
  • deploying Microsoft Defender
  • hardening Microsoft 365
  • documenting policies
  • performing risk assessments
  • classifying CUI
  • improving logging and monitoring

…none of that work has been wasted. In fact, those are exactly the kinds of security improvements organizations should be making regardless of any certification program.

Good cybersecurity was never supposed to exist solely because CMMC required it.

What Should Organizations Do Now?

Personally, I would treat this as breathing room rather than a reset button. Use the extra time wisely.

Continue implementing NIST SP 800-171

Those 110 security requirements remain one of the strongest foundations for protecting CUI. Whether an assessor reviews them next year or two years from now, they are still good security practices.

Improve your documentation

One of the biggest challenges I see with organizations isn’t necessarily technical controls. It is documentation.

  • Policies.
  • Procedures.
  • Evidence.
  • Configuration standards.
  • Incident response.
  • System Security Plans (SSPs).
  • Plans of Action and Milestones (POA&Ms).

Those documents take time to mature. Use this opportunity to improve them.

Validate your Microsoft 365 environment

For organizations running Microsoft 365 Government, GCC, or GCC High, now is a good opportunity to review:

  • Conditional Access
  • Microsoft Defender
  • Microsoft Purview
  • Intune
  • Entra ID
  • Audit logging
  • Device compliance
  • Privileged Identity Management
  • Data Loss Prevention
  • Sensitivity Labels

Many organizations discover gaps long before an auditor ever would.

Focus on operational security

One thing I have said for a while now:

  • Passing an audit does not necessarily mean you are secure.
  • Likewise, failing an audit does not automatically mean you are insecure.

Security should be measured by how well you reduce risk, not simply by whether every document has been completed.

That mindset appears increasingly consistent with the direction the Department is now taking.

Could CMMC Change?

Absolutely. The Department has opened the door to reform. That could include:

  • Changes to assessment requirements
  • Reduced costs
  • Streamlined certification
  • Better support for small businesses
  • Different implementation timelines
  • Alternative validation approaches

We simply do not know yet. The 60-day review will likely provide much more clarity.

Final Thoughts

If you’ve been losing sleep trying to meet a November deadline, this announcement provides some welcome breathing room. But don’t confuse breathing room with permission to pause.

Cyber threats have not taken a 60-day break. Ransomware groups have not suspended operations. Nation-state actors have not decided to wait until the Department finishes its review.

Good cybersecurity remains good cybersecurity.

Whether your organization ultimately completes a self-assessment, a C3PAO assessment, or whatever comes next after the review, the objective should remain exactly the same:

Protect the information that matters.

If the Department’s review results in a simpler, more practical, and more effective CMMC program that strengthens the Defense Industrial Base without pushing smaller suppliers out of the market, that is likely a positive outcome for everyone involved.

The certification process may evolve. The need for strong cybersecurity does not.

Update: The Cyber AB Responds to the CMMC Phase II Suspension

Since publishing this article, the Cyber AB has released its response to the Department of War’s decision to suspend the rollout of CMMC Phase II. While the organization expressed disappointment with the pause, its overall message is clear: this is a temporary suspension of the Phase II implementation timeline, not the end of CMMC or third-party assessments.

The Cyber AB confirmed that the broader CMMC ecosystem remains active. Certified Third-Party Assessment Organizations (C3PAOs) can continue performing voluntary Level 2 assessments, training, and certification programs remain available, and they intend to work alongside the newly formed CMMC Reform Task Force during the Department’s 60-day review. The organization continues to support independent verification as a critical component of the long-term CMMC program.

For organizations, the practical advice hasn’t changed. The suspension does not remove existing contractual cybersecurity obligations under NIST SP 800-171 or DFARS requirements where they already apply. If you’ve already started your CMMC preparation, there is little value in stopping now. Continuing to improve your cybersecurity posture, documenting your implementation, and preparing for an eventual assessment still put your organization in a stronger position, regardless of what reforms emerge from the current review. In many cases, maintaining that momentum will be far easier than trying to restart months later once the Department announces its next steps.

Original response: https://cyberab.org/Portals/0/Documents/CyberABStatementOnDoWPhaseIISuspension-15JUL2026.pdf