Loading story…
The Department of Defense has suspended the planned transition to CMMC Phase 2, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with NIST SP 800-171 Rev. 2 through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days.
DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Two DoD memoranda directed contracting activities to accept contractor self-assessments during a 60-day review, remove higher-tier assessment requirements from active solicitations and later contract modifications, and bar CMMC waivers. DoD expected to use NIST SP 800-171 Revision 2 and selected government-led assessments during the pause.
DoD CIO Kirsten Davies and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey suspended the planned transition to CMMC Phase 2, which had been scheduled for November 2026. The suspension paused requirements including third-party compliance attestation.
CISA and allied cyber authorities warned that Chinese state-sponsored operations had industrialized and integrated intelligence, military, and civilian security services into a continuous exfiltration effort.
The companion CMMC acquisition rule became effective, adding a contract clause and solicitation provision to the Defense Federal Acquisition Regulation Supplement.
The CMMC Program rule took effect, establishing assessment levels, a third-party assessor ecosystem, annual affirmations, and case-by-case waiver authority.
DoD began accepting applications for its Cyber Registered Apprenticeship Program, a skills-based hiring initiative for cybersecurity talent. The first listing closed four days early after receiving more than 15,000 applications, and DoD planned additional opportunities.
Industry stakeholders and defense leaders identified inconsistent government designation and marking of controlled unclassified information as a major supply-chain challenge. Davies also identified cyber resilience for manufacturers' operational technology as a gap not addressed by the prior CMMC framework.
DoD received more than 1,100 responses totaling more than 10,000 pages in response to its CMMC reform request for information. More than half of respondents supported the Phase 2 pause and reform effort, while many cited disproportionate burdens on small and medium-sized contractors.
The Department of Defense established a CMMC Reform Task Force to review the full program and issued a request for information seeking feedback from contractors affected by CMMC regulations.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcedefensescoop.com
Open sourcelawfaremedia.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026
The U.S. Department of Defense has suspended **CMMC Phase II** requirements as part of a broader acquisition reform effort, delaying the planned expansion of mandatory third-party cybersecurity assessments for many defense contractors. The pause does **not** remove existing obligations: contractors still face **NIST SP 800-171 Rev. 2** self-assessments, **DFARS `252.204-7012`** requirements, and annual executive affirmations submitted through **SPRS**, while prime-contractor scrutiny, possible government spot audits, and persistent nation-state threats continue to drive cyber risk. At the same time, industry reporting warns that those executive affirmations have become a growing legal and governance exposure because **controlled unclassified information (CUI)** often spreads beyond initially scoped systems into contracts, resumes, email, collaboration platforms, schedules, and supplier environments without clear labeling or tracking. Under **32 CFR Part 170**, inaccurate visibility into where CUI resides can make signed CMMC attestations unreliable and increase potential **False Claims Act** exposure, especially when subcontractors handle CUI unknowingly, leaving contractors under pressure to build defensible processes to identify, monitor, document, and validate CUI handling even as the framework is revised.
Jul 28, 2026
The U.S. Department of Defense has paused **CMMC Phase 2**, delaying the rollout of third-party certification assessments. However, CMMC Phase 1 self-assessments and existing DFARS obligations remain in effect: defense contractors and subcontractors handling controlled unclassified information (CUI) must protect it, submit required SPRS scores, and report cyber incidents within 72 hours under `DFARS 252.204-7012`. Meanwhile, the FAR Council is advancing a proposed rule that would extend CUI safeguarding and incident-reporting requirements to contractors across FAR-based federal contracts, beyond the defense industrial base. The proposal would align with **NIST SP 800-171 Revision 3**, while CMMC Level 2 remains based on Revision 2, creating a potential interim compliance gap; organizations also cannot rely on POA&Ms in place of implementing material CMMC security controls.
Sep 2, 2026