Loading story…
The U.S. Department of Defense has suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said Phase 1 self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a 60-day review of the broader framework.
Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as NIST SP 800-171 controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Defense suspended Phase 2 of the Cybersecurity Maturity Model Certification program and paused later phases while beginning a 60-day review of the framework. During the review, Phase 1 self-assessments remain in place, and a newly formed reform task force will gather industry feedback on compliance costs, administrative burden, and the effectiveness of current controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcedefensescoop.com
Open sourcetechrepublic.com
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcegovconwire.com
Open sourcenextgov.com
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Defense is implementing the Cybersecurity Maturity Model Certification 2.0 (CMMC), requiring over 300,000 military contracting companies to enhance their cybersecurity protections. Despite the critical importance of these safeguards, more than half of defense contractors are reportedly unprepared for the initial phase of CMMC, which is set to begin imminently. Whistleblowers have played a significant role in exposing non-compliance, leading to major settlements by companies such as Raytheon and Aerojet Rocketdyne under the False Claims Act. The new requirements not only impact primary contractors but also extend to subcontractors and external service providers, including cloud service providers, who may not fully understand their obligations under CMMC. Many contractors and their service providers face confusion regarding the scope of CMMC, particularly in distinguishing between subcontractors and external service providers, and in understanding which IT and information security services fall under compliance requirements. Failure to include all relevant service providers in CMMC assessments could result in non-compliance and potential loss of business. Registered Practitioner Organizations are offering guidance to help organizations navigate these complexities, emphasizing the need for comprehensive compliance programs that address both direct and indirect CMMC obligations across the defense supply chain.
Jun 30, 2026
The **NSA** published *Zero Trust Implementation Guidelines* **Phase One** and **Phase Two**, expanding its series beyond earlier *Primer* and *Discovery Phase* materials to provide more actionable, task-based direction aligned to the DoD target-level maturity model. Phase One outlines **36 activities** intended to establish conditions for **30 zero trust capabilities**, while Phase Two defines **41 activities** to begin integrating core zero trust solutions and enable **34 additional capabilities**, with a modular approach intended to let organizations tailor adoption based on maturity and constraints. Separately, the **General Services Administration (GSA)** is tightening federal supply-chain cybersecurity expectations by issuing an IT security procedural guide (CIO-IT Security-21-112 Rev. 1) that imposes **CMMC-like** requirements on certain **new contracts involving CUI**, including implementation of **NIST SP 800-171** and selected **800-172** controls. The guide identifies **eight blocking requirements** (including **MFA**, **encryption of CUI in transit and at rest**, **vulnerability scanning/remediation**, and removal of **end-of-life components**) and requires **independent assessments** via FedRAMP third-party organizations or GSA-approved assessors, though GSA has not published assessor approval criteria—creating potential uncertainty for contractors; a separate GSA acquisition discussion on AI purchasing emphasizes flexibility, cost savings, and responsible use but does not materially add to the zero trust or contractor-control policy details.
Jun 29, 2026
The **Cybersecurity and Infrastructure Security Agency (CISA)** announced it will hold sector-by-sector virtual town halls to gather additional industry feedback on its long-delayed rulemaking under the **Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)**. The proposed regulation would require covered critical infrastructure entities to report **significant cyber incidents within 72 hours** and **ransomware payments within 24 hours**, but key details—such as which entities are covered, how to treat small businesses, what incident examples trigger reporting, and how to avoid conflicts with existing regulatory regimes—remain contentious and are a focus of the sessions. Separately, CISA leadership briefed staff on an impending **Cybersecurity Division reorganization** driven by resource constraints, including plans to **deprioritize or shut down some programs** to concentrate on higher-profile goals such as **operational technology (OT) security** and core national cyber defense functions. The internal messaging emphasized doing more with fewer personnel following a period of layoffs, retirements, and other disruptions, while refocusing the division on delivering actionable cyber intelligence to partners and coordinating broader “national cybersecurity defense” planning and operations.
Jun 29, 2026