Pentagon Suspends CMMC Phase Two for 60-Day Review
Summary
The Pentagon suspended CMMC phase two, which was due to require Level 2 third-party assessments for new contracts from November 2026, while a task force reviews the program. Phase one requirements remain in force.
Key points
- The Pentagon suspended CMMC phase two pending a 60-day review of the program.
- Phase two was scheduled to begin November 10, 2026, requiring Level 2 third-party certification assessments for new contracts.
- Officials cited a shortage of approved third-party assessors as one reason the deadline was no longer feasible.
- A newly formed task force will gather industry feedback and recommend changes, including scaled-back measures intended to ease contracting for small and nontraditional businesses.
- Contractors must still meet phase one requirements and existing rules for handling government information.
Article Details
- Event Type
- Suspension of CMMC Phase 2 requirements pending a 60-day review of the program
- Impact
- Level 2 third-party certification assessments for new contracts, originally scheduled to begin November 10, 2026, are suspended pending review. Contractors remain subject to Phase 1 requirements and existing rules for handling government information. Officials cited a shortage of approved third-party assessors and said the review will consider scaled-back measures intended to ease compliance costs, particularly for smaller businesses.
People
Kirsten DaviesCIO at the Department of War who announced the suspension and said robust cybersecurity remains a priority.Michael DuffeyUndersecretary of War for Acquisition and Sustainment who said the pause was needed to prevent compliance costs from squeezing smaller manufacturers out of defense work.Pete HegsethSecretary of War whose directive to scale warfighter readiness was cited by Kirsten Davies.