CMMC Phase II Suspended: What Defense Contractors Must Do Now

The U.S. Department of War shocked the defense contracting world on July 13, 2026, by immediately suspending Cybersecurity Maturity Model Certification Phase II requirements — halting a mandate that would have affected more than 100,000 contractors.

The suspension arrives just months before Phase II's November 10, 2026, deadline and raises urgent questions for every enterprise operating within the Defense Industrial Base. Is this a temporary pause or a fundamental rethinking of how the government enforces cybersecurity compliance? The answer matters enormously — because the underlying legal obligations have not moved an inch.

---

Why the DoW Pulled the Brakes on Phase II

The core problem was a structural mismatch that anyone familiar with supply chain logistics could see coming. Phase II required contractors handling Controlled Unclassified Information (CUI) to obtain certification from an accredited Certified Third-Party Assessment Organization — known as a C3PAO. The logistical reality, however, was brutal.

Only approximately 100 authorized C3PAOs exist nationwide. They were expected to audit more than 100,000 defense contractors before the November deadline. DoW Chief Information Officer Kirsten A. Davies captured the absurdity of that equation with blunt precision during a press briefing: "The math just simply doesn't math."

The bottleneck was not the only pressure point driving the suspension. Small and medium-sized businesses — the innovative backbone of the Defense Industrial Base — were actively walking away from defense contracts entirely. Data from the Small Business Administration confirmed that ballooning compliance costs were pushing these companies out of the market before Phase II even took effect.

Under Secretary of War for Acquisition and Sustainment Michael Duffey reinforced that the pause aligns with broader acquisition reform goals. The objective is to prioritize speed to capability and remove barriers that prevent commercial innovators from participating in defense work. In response, the DoW established a CMMC Reform Task Force to conduct a comprehensive 60-day review of the entire program.

Officials were careful to draw a clear line between pausing bureaucratic certification requirements and lowering cybersecurity expectations. The suspension targets administrative red tape — not the security standards themselves. For contractors already invested in building robust cybersecurity compliance programs, this distinction is both reassuring and strategically important.

The C3PAO Capacity Problem in Numbers

To appreciate the scale of the bottleneck, consider the ratio directly: roughly one authorized assessment organization for every 1,000 contractors requiring audit. Even operating at maximum throughput, the C3PAO ecosystem had no realistic path to clearing that queue before the November deadline. This was not a failure of intent — it was a failure of infrastructure planning at the program design level.

The Reform Task Force will need to address this structural deficit head-on, whether through expanding accreditation pathways, introducing tiered assessment models, or redistributing compliance verification responsibilities across a broader ecosystem of qualified assessors.

---

What Is Suspended and What Remains Legally Binding

This distinction is arguably the most critical point for any defense contractor to understand. The suspension of Phase II does not suspend the obligation to protect sensitive government data. Treating this pause as a cybersecurity holiday would be a costly — and potentially criminal — mistake.

Understanding where the boundaries fall requires looking at each program element individually. The landscape of cybersecurity frameworks applicable to defense contractors remains active and enforceable regardless of the Phase II pause.

Here is the current state of each key CMMC element:

• Phase I self-assessments: Still active. Contractors must continue performing annual self-assessments, submitting scores to the Supplier Performance Risk System (SPRS), and filing annual affirmations.
• Phase II third-party audits: Suspended indefinitely. The November 10 deadline for mandatory C3PAO audits is on hold.
• DFARS 252.204-7012: Still active and contractually binding. Safeguarding covered defense information remains a legal requirement in existing contracts.
• NIST SP 800-171 Rev 2: Still active. This technical standard must be implemented and self-assessed against by all applicable contractors.

Government-led spot audits remain operational. False self-attestations carry severe legal and financial consequences under the False Claims Act — a reality that has not changed regardless of the Phase II pause.

What the Contracting Community Is Revealing About Itself

Brian Haugli, CEO of cybersecurity firm SideChannel, offered a pointed observation on LinkedIn that cuts to the heart of what this moment reveals about the contracting community. "Watch what happens next," Haugli wrote. "Thousands of defense contractors are about to reveal whether they were building security programs or buying certificates."

He added that adversaries targeting the Defense Industrial Base "didn't read the press release and stand down" — a reminder that threat actors operate on their own timeline regardless of regulatory shifts.

This observation carries significant weight. Contractors who invested in compliance theater — acquiring documentation and certifications without embedding genuine security controls — now face a moment of exposure. The absence of an imminent audit deadline removes the external forcing function that kept some programs moving. For those organizations, the temptation to deprioritize security spending will be real. Acting on that temptation would be a strategic error with long-term consequences.

---

Four Actions Defense Contractors Should Take Right Now

With the August 14, 2026, public RFI deadline approaching and the Reform Task Force set to return findings in autumn 2026, the window for strategic action is narrow. For organizations still working to align their programs with established compliance frameworks used across regulated industries, now is the moment to accelerate — not pause — that work.

Do Not Stop NIST SP 800-171 Implementation

Phase I self-assessments remain active and contracting officers are still verifying compliance status before awarding contracts. Core technical controls — including access management, multi-factor authentication, and incident response — remain mandatory. Any contractor who interprets the Phase II suspension as permission to slow implementation is misreading the regulatory landscape and creating unnecessary risk exposure.

Keep SPRS Scores Accurate and Current

An outdated or inaccurate score in the SPRS database creates contracting risk and legal exposure. This is ongoing maintenance that cannot be deprioritized. Contracting officers use SPRS data as a real-time signal of contractor trustworthiness — an organization with a stale or inflated score is flagging itself for scrutiny before a single conversation takes place.

If a C3PAO Audit Is Already Underway, Consider Finishing It

Organizations that were mid-assessment before the suspension may find that stopping now costs more than completing the process. A verified strong security posture remains a competitive differentiator when bidding on contracts. When the revised framework arrives in autumn 2026, organizations holding completed assessments will be better positioned to demonstrate continuity of controls — a meaningful advantage in competitive procurement environments.

Participate in the Public RFI Before August 14

The DoW is actively soliciting feedback on compliance costs and how organizations are using commercial tools to meet security goals. This is a rare opportunity for contractors — particularly small and mid-sized businesses — to directly influence how the rebuilt framework takes shape. Organizations that have experienced the compliance cost burden firsthand have the most credible and valuable input to offer. Submitting detailed, evidence-based feedback is not just civic participation; it is a direct mechanism for shaping the rules your organization will operate under. The official CMMC program page at the Department of Defense provides current documentation and updates on the RFI process.

Prepare for a Leaner, More Self-Attestation-Heavy Framework

The Reform Task Force is expected to deliver a revised framework in autumn 2026 that leans more heavily on self-attestation and commercial security tools. Contractors who built genuine security programs rather than compliance-only pipelines are best positioned to adapt quickly when new requirements drop. Those who did not will face a compressed timeline to close gaps — against a backdrop of heightened scrutiny from both contracting officers and federal investigators.

---

CMMC is not dead. The suspension has created breathing room, but it has not created permission to stand still. The requirement will return in a revised form. The adversaries operating against the Defense Industrial Base never paused.

For defense contractors navigating this moment, the practical takeaway is direct: use this pause to close real security gaps, not to close budget lines. The organizations that treat this window as an investment opportunity rather than a cost-saving window will be the ones best positioned when the revised framework arrives — and when the next contract award decision hinges on who can demonstrate genuine, defensible security.