DoD Pauses CMMC Phase 2 While FAR Council Advances Broader CUI Requirements

The U.S. Department of Defense has paused CMMC Phase 2, delaying the rollout of third-party certification assessments. However, CMMC Phase 1 self-assessments and existing DFARS obligations remain in effect: defense contractors and subcontractors handling controlled unclassified information (CUI) must protect it, submit required SPRS scores, and report cyber incidents within 72 hours under DFARS 252.204-7012.

Meanwhile, the FAR Council is advancing a proposed rule that would extend CUI safeguarding and incident-reporting requirements to contractors across FAR-based federal contracts, beyond the defense industrial base. The proposal would align with NIST SP 800-171 Revision 3, while CMMC Level 2 remains based on Revision 2, creating a potential interim compliance gap; organizations also cannot rely on POA&Ms in place of implementing material CMMC security controls.