Loading story…
The U.S. Department of Defense has suspended CMMC Phase II requirements as part of a broader acquisition reform effort, delaying the planned expansion of mandatory third-party cybersecurity assessments for many defense contractors. The pause does not remove existing obligations: contractors still face NIST SP 800-171 Rev. 2 self-assessments, DFARS 252.204-7012 requirements, and annual executive affirmations submitted through SPRS, while prime-contractor scrutiny, possible government spot audits, and persistent nation-state threats continue to drive cyber risk.
At the same time, industry reporting warns that those executive affirmations have become a growing legal and governance exposure because controlled unclassified information (CUI) often spreads beyond initially scoped systems into contracts, resumes, email, collaboration platforms, schedules, and supplier environments without clear labeling or tracking. Under 32 CFR Part 170, inaccurate visibility into where CUI resides can make signed CMMC attestations unreliable and increase potential False Claims Act exposure, especially when subcontractors handle CUI unknowingly, leaving contractors under pressure to build defensible processes to identify, monitor, document, and validate CUI handling even as the framework is revised.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
In July 2026, the U.S. Department of Defense suspended CMMC Phase II requirements, pausing the expected expansion of mandatory third-party cybersecurity audits for many defense contractors. The cited analysis says the move reflects structural reform under the Pentagon’s Acquisition Transformation System rather than a cancellation of cybersecurity obligations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
govconwire.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Department of Defense has suspended the planned transition to **CMMC Phase 2**, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with **NIST SP 800-171 Rev. 2** through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days. DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
Sep 10, 2026
The U.S. Department of Defense has paused **CMMC Phase 2**, delaying the rollout of third-party certification assessments. However, CMMC Phase 1 self-assessments and existing DFARS obligations remain in effect: defense contractors and subcontractors handling controlled unclassified information (CUI) must protect it, submit required SPRS scores, and report cyber incidents within 72 hours under `DFARS 252.204-7012`. Meanwhile, the FAR Council is advancing a proposed rule that would extend CUI safeguarding and incident-reporting requirements to contractors across FAR-based federal contracts, beyond the defense industrial base. The proposal would align with **NIST SP 800-171 Revision 3**, while CMMC Level 2 remains based on Revision 2, creating a potential interim compliance gap; organizations also cannot rely on POA&Ms in place of implementing material CMMC security controls.
Sep 2, 2026
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026