Suspension of CMMC Phase II: A New Direction for Cybersecurity in the Defense Industrial Base
The US Department of Defense (DoD) has announced the suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements as part of a broad initiative to reassess the program aimed at bolstering innovation within the United States defense industrial base (DIB). Initially slated to take effect on November 10, 2026, these requirements represented the second phase of a carefully planned rollout designed to enhance cyber hygiene among defense contractors and subcontractors managing federal contract information (FCI) and controlled unclassified information (CUI).
As part of its phased approach, CMMC is intended to transition defense contractors from basic self-attestation of cybersecurity compliance to more stringent, independent assessments. While Phase I allowed companies to self-report their compliance status, Phase II mandated that contractors dealing with sensitive information undergo evaluations performed by Certified Third-Party Assessment Organizations (C3PAOs). These assessments would ensure compliance with the 110 security controls outlined in NIST SP 800-171, a standard set by the US National Institute of Standards and Technology (NIST).
The DoD had previously estimated that between 220,000 and 300,000 firms are involved in the DIB, with approximately 80,000 expected to meet the new requirements of CMMC Phase II. However, a report by CyberSheath published in October 2025 revealed a startling statistic: only 1% of defense contractors felt fully prepared to undergo the Phase II audits. This lack of readiness underlined growing concerns regarding the potential bureaucratic and financial burdens that these requirements could impose on smaller companies within the DIB.
CMMC Phase II was part of a multi-phase initiative that would ultimately see the introduction of CMMC Phases III and IV, aimed at increasing compliance rigor over time. Phase III was intended to bring about level 3 audits for contracts involving the most sensitive data, with oversight directly from the DoD. Meanwhile, Phase IV would have required full compliance from all DoD contractors and subcontractors.
Rationale Behind the Suspension
In a statement released on July 13, the DoD outlined its motivations for suspending Phase II, citing concerns that the CMMC program has created “prohibitive compliance costs and bureaucratic burdens” rather than achieving its primary goal of enhancing cybersecurity across the DIB. The Department referenced recent data, including findings from the Small Business Administration (SBA), which suggested that the stringent compliance requirements were pushing innovative companies out of the sector, thereby hampering progress in delivering vital capabilities to military personnel.
In response to these challenges, the DoD plans to establish a ‘CMMC Reform Task Force’ that will conduct a comprehensive 60-day review of the program. This initiative seeks to realign the CMMC framework with Secretary of War Pete Hegseth’s acquisition transformation system (ATS) strategy. The new directives aim at lowering barriers for small, medium, and non-traditional businesses while replacing bureaucratic compliance requirements with scalable and resilient cybersecurity measures.
A. Davies, the Department’s Chief Information Officer, highlighted the significance of maintaining a robust cybersecurity framework, asserting that it is vital for protecting American innovation and supporting the readiness of warfighters. During this interim period, the DoD will enforce cybersecurity compliance through self-assessments and select government-led evaluations aligned with the NIST SP 800-171 Rev 2 standard, focusing more on practical cyber hygiene rather than administrative complexities.
Experts Caution Against Complacency
The announcement of the suspension has stirred a mixed reaction among experts in the field of cybersecurity compliance. Dave Schroeder, director of National Security Initiatives at the University of Wisconsin-Madison, pointed out that the suspension likely arose from inadequacies in contractor preparedness for Phase II compliance by the November deadline. He indicated that the suspension might provide breathing room, but it does not negate the necessity of adhering to established cybersecurity protocols.
Similarly, Nelina Varenas, a founding member of the KDM Consortium, warned against misinterpreting the suspension as an opportunity for contractors to abandon their compliance efforts. In a LinkedIn article published shortly after the DoD’s announcement, she noted that all Level 1 self-assessment requirements remain mandatory. She urged organizations not to take a step back, as the delay ought to be seen as a chance to refine and thoroughly implement cybersecurity practices in anticipation of future enforcement.
In closing, while the future of the CMMC program remains shrouded in uncertainty, the suspension represents a pivotal moment for the DIB. It offers both challenges and opportunities as the DoD recalibrates its approach to cybersecurity compliance, emphasizing the need for resilience and innovation in protecting sensitive data. As stakeholders navigate this complex landscape, maintaining rigorous cybersecurity standards will be critical to ensuring the operational readiness of American defense capabilities.