If your LinkedIn feed and texts look anything like mine right now, it’s full of hot takes about the Department of War suspending CMMC Phase 2. Some of it is useful; a lot of it is noise. Let’s cut through it.
Here’s the short version: Don’t make any business decisions based off of a few LinkedIn posts. This is not the end of CMMC, and for the vast majority of contractors, nothing about your day-to-day compliance work needs to change today.
What actually happened.
On July 13, 2026, the Department of War announced it was suspending Phase 2 of CMMC the requirement that would have brought third-party cybersecurity assessments to contracts involving sensitive but unclassified information starting November 10, 2026. Phase 3 and Phase 4, the later stages of the rollout, are suspended along with it. DoW CIO Kirsten Davies also announced a 60-day, top-to-bottom review of the entire program.
That’s a real shift. It is not, however, the government walking away from cybersecurity requirements for the Defense Industrial Base (DIB).
This is the part that matters most, and it’s the part getting buried under the headlines:
Phase 1 is untouched. It’s still what authorizes C3PAOs to conduct assessments, and it still lets contracting officers require third-party assessments on a limited, case-by-case basis.
Your contractual obligations didn’t move.
Every defense contractor and subcontractor remains contractually obligated to safeguard covered defense information under DFARS 252.204-7012, and NIST SP 800-171 implementation is still required. Prime contractors are continuing to flow down CMMC requirements to their subcontractors regardless of what the government’s formal timeline says. If your compliance requirements are coming from a prime contract, those requirements haven’t gone anywhere.
If you were upgrading your compliance systems or working toward CMMC compliance, because it’s the right thing to do for your systems and your customers, continue doing so. If you were doing it because of a contract requirement, that contract almost certainly still requires it.
Why this is actually good news for many of you.
DoW CIO, Kristen Davies cited two key concerns in her remarks: the “burden of a massive compliance overhead” for small businesses and the need for the DIB to “rapidly deliver superior technology to the tactical edge by removing prohibitive compliance costs and administrative barriers.” Officials also acknowledged that the sheer volume of organizations expected to pursue third-party assessments would create significant pressure on the certification ecosystem, making the original November timeline increasingly difficult to achieve.
This pause buys breathing room for everyone in that pipeline. C3PAOs get more time to scale up. Contractors, especially the small and mid-sized businesses who’ve felt the compliance costs hardest, get more runway to get ready properly instead of scrambling against a hard deadline. That’s not the program falling apart. That’s the program being paced sensibly
We’ve seen this before.
Anyone who’s been in this space since 2020 remembers when the original CMMC program was paused and everyone declared it dead. It wasn’t. It came back as CMMC 2.0, streamlined, but built around the exact same goal: protecting Controlled Unclassified Information (CUI) across the DIB. Every administration puts its own fingerprints on how this program runs. The underlying mission hasn’t budged once in six years, and there’s no real signal it’s about to.
So what should you actually do this week?
Nothing dramatic.
Specifically:
- Keep assessing, documenting, and improving. Self-assessments, POA&Ms, SSPs – all of that still matters.
- Check your specific contracts**, not the headlines. If you have a DFARS clause or a prime flow-down requirement, that’s your real compliance driver, and it’s still in force.
- Watch the next 60 days. The DoW has opened a public Request for Information as part of its CMMC Reform Task Force review. They are asking the industry directly about cost drivers, and which controls actually reduce risk. That’s a genuine chance to influence what comes next and you should take it if it applies to you.
- Don’t rip up your roadmap. Whatever emerges from this review, “protect CUI” isn’t going away as a requirement. The work you’re doing now isn’t wasted, even if the certification mechanism around it changes shape.
Bottom line.
This is a suspension and a review, not a cancellation, and not chaos. Keep your socks on. We’ll keep watching this closely and will flag anything that changes what you need to do. Until then, business as usual.
Have questions about what this means for your specific contracts or assessment timeline? Reach out to the team at Edwards Performance Solutions, we’re happy to talk through it.