Loading story…
The Department of Defense has released the final Cybersecurity Maturity Model Certification (CMMC) Rule, mandating new cybersecurity requirements for over 300,000 U.S. military contractors. The rule introduces a three-year phased rollout starting November 10, 2025, with a reduction from five to three security levels and a mix of self-attestation and third-party assessments. The framework aims to address persistent cyber threats and industry concerns, but will require significant adjustments in governance and compliance practices across the defense industrial base.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has finalized a rule requiring all defense contractors to comply with the Cybersecurity Maturity Model Certification (CMMC) program, effective November 9. Contractors must meet one of three CMMC levels based on the sensitivity of unclassified information they handle, with requirements ranging from annual self-assessments to government-led audits. Vendors failing to comply will be ineligible for new contracts, and conditional certifications will be available for those working toward compliance.
Jun 29, 2026
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026
The Department of Defense has suspended the planned transition to **CMMC Phase 2**, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with **NIST SP 800-171 Rev. 2** through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days. DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
Sep 10, 2026