Loading story…
The U.S. Department of Defense has paused CMMC Phase 2, delaying the rollout of third-party certification assessments. However, CMMC Phase 1 self-assessments and existing DFARS obligations remain in effect: defense contractors and subcontractors handling controlled unclassified information (CUI) must protect it, submit required SPRS scores, and report cyber incidents within 72 hours under DFARS 252.204-7012.
Meanwhile, the FAR Council is advancing a proposed rule that would extend CUI safeguarding and incident-reporting requirements to contractors across FAR-based federal contracts, beyond the defense industrial base. The proposal would align with NIST SP 800-171 Revision 3, while CMMC Level 2 remains based on Revision 2, creating a potential interim compliance gap; organizations also cannot rely on POA&Ms in place of implementing material CMMC security controls.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The public comment period for the FAR Council's proposed CUI rule closed. The source states that no final rule had yet been issued.
The Department of Defense suspended CMMC Phase 2 under a strategic pause. Phase 2 would have required third-party certification assessments for applicable DoD solicitations.
The FAR Council published a proposed CUI rule as part of the Revolutionary FAR Overhaul. The proposal would extend CUI security and 72-hour incident-reporting requirements to contractors on FAR-based federal contracts and references NIST SP 800-171 Revision 3.
CMMC Level 1 and Level 2 self-assessments entered force for applicable DoD solicitations and contracts. Applicable solicitations and contracts continued to use the related CMMC DFARS provision and clause.
See what this changes for your reporting obligations and which controls it puts on the clock.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has suspended **CMMC Phase II** requirements as part of a broader acquisition reform effort, delaying the planned expansion of mandatory third-party cybersecurity assessments for many defense contractors. The pause does **not** remove existing obligations: contractors still face **NIST SP 800-171 Rev. 2** self-assessments, **DFARS `252.204-7012`** requirements, and annual executive affirmations submitted through **SPRS**, while prime-contractor scrutiny, possible government spot audits, and persistent nation-state threats continue to drive cyber risk. At the same time, industry reporting warns that those executive affirmations have become a growing legal and governance exposure because **controlled unclassified information (CUI)** often spreads beyond initially scoped systems into contracts, resumes, email, collaboration platforms, schedules, and supplier environments without clear labeling or tracking. Under **32 CFR Part 170**, inaccurate visibility into where CUI resides can make signed CMMC attestations unreliable and increase potential **False Claims Act** exposure, especially when subcontractors handle CUI unknowingly, leaving contractors under pressure to build defensible processes to identify, monitor, document, and validate CUI handling even as the framework is revised.
Jul 28, 2026
The Department of Defense has suspended the planned transition to **CMMC Phase 2**, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with **NIST SP 800-171 Rev. 2** through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days. DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
Sep 10, 2026
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026