DoD Suspends CMMC Phase II While Executive Cyber Attestations Remain Binding

The U.S. Department of Defense has suspended CMMC Phase II requirements as part of a broader acquisition reform effort, delaying the planned expansion of mandatory third-party cybersecurity assessments for many defense contractors. The pause does not remove existing obligations: contractors still face NIST SP 800-171 Rev. 2 self-assessments, DFARS 252.204-7012 requirements, and annual executive affirmations submitted through SPRS, while prime-contractor scrutiny, possible government spot audits, and persistent nation-state threats continue to drive cyber risk.

At the same time, industry reporting warns that those executive affirmations have become a growing legal and governance exposure because controlled unclassified information (CUI) often spreads beyond initially scoped systems into contracts, resumes, email, collaboration platforms, schedules, and supplier environments without clear labeling or tracking. Under 32 CFR Part 170, inaccurate visibility into where CUI resides can make signed CMMC attestations unreliable and increase potential False Claims Act exposure, especially when subcontractors handle CUI unknowingly, leaving contractors under pressure to build defensible processes to identify, monitor, document, and validate CUI handling even as the framework is revised.