Pentagon Suspends CMMC Phase 2 Requirements for Program Overhaul

The Department of Defense has suspended the planned transition to CMMC Phase 2, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with NIST SP 800-171 Rev. 2 through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days.

DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.