Pentagon Suspends CMMC Phase 2 and Reviews Contractor Cybersecurity Rules

The U.S. Department of Defense has suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said Phase 1 self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a 60-day review of the broader framework.

Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as NIST SP 800-171 controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.