What Contractors Should Know While the Department of War Reviews the CMMC Program.
On July 12, the Department of War suspended CMMC Phase 2 requirements.
Set to kick in November 10, 2026, they’re now on hold for at least 60 days while a CMMC Reform Task Force reviews the entire program top to bottom.
On the surface, this appears to be a significant change to CMMC.
However, over its eight years of development, the DOW has paused and restarted milestones before.
What we do know: your contractual obligation to protect federal data did not change.
So far, no one outside the government knows what the task force will recommend—anyone who tells you they do is guessing.
Here’s what we can tell you about the pause, the program moving forward, and what your organization can (and should) be doing in the meantime.
What CMMC Requirements Are Actually on Hold?
The CMMC Phase 2 requirement includes third-party attested assessments.
That’s it.
The November 10 deadline for these attestations is what’s being paused.
The task force’s review is meant to align CMMC with the Acquisition Transformation System (ATS).
The ATS wants better speed-to-capability, lower barriers for small- and non-traditional businesses, and less bureaucracy. Whether that means CMMC gets reworked, replaced, or restarted on a new timeline, we’ll know in 60 days—hopefully.
The problems the task force is looking at:
- Consistency with the upcoming FAR CUI rule—bringing similar requirements across all federal agencies, not just the DoW
- Defense Industrial Base (DIB)-wide compliance challenges around the November deadline
- Micro companies with fewer than 10 employees are struggling to keep up, and the Next-Generation Commercial Operations in Defended Enclaves (NCODE) program, meant to assist them, is not yet fully functioning.
What Didn’t Change and Why It Matters
Despite CMMC Phase 2’s pause, Phase 1 is still in effect.
If you handle CUI under contract, you still must comply with NIST SP 800-171A.
You still have to self-assess. You still have to submit a Supplier Performance Risk System (SPRS) score.
And the DoW specifically noted that select government-led assessments may still take place during this interim period—so don’t assume you can’t be audited.
DFARS 252.204-7021 didn’t go anywhere either.
If your contract has that clause, this announcement does not nullify it. Ask your contracting officer—in writing—what this means for your specific situation.
Finally, the False Claims Act (FCA) is still the False Claims Act. If your SPRS score says you’re doing things you aren’t doing, you’re exposed. A pause on third-party assessments doesn’t pause the FCA.
What to Do Now
If you’ve got a Level 2 CMMC requirement and haven’t started your compliance work yet, this 60-day pause is not a reason to keep waiting. It’s an opportunity to get ahead.
60 days is enough time to make significant progress.
I recommend you use the time to identify gaps against the 110 controls in NIST SP 800-171, and build a realistic roadmap with milestones.
The worst move is wasting these 60 days waiting for clarity just to end up exactly where you are now when the task force decision lands on CMMC Phase 2.
Organizations that used the pause to develop a plan will be ready to execute. Organizations that didn’t will be right back to scrambling.
If you’re a subcontractor, reach out to your prime. Their CMMC requirements may not have changed just because the DoW hit pause.
If they still expect you to pursue certification, that expectation still stands.
If you’re mid-journey on CMMC compliance, keep going.
I get the temptation to shelf it and wait for the task force report.
Don’t.
We don’t know what will come out of this CMMC Phase 2 review, so any pause in your efforts could present challenges or consequences down the line.
Plus, separate from any government requirement, the work you’re doing makes your business harder to breach. That’s worth doing on its own.
There is one notable upside here. If you were sweating the November deadline—you just got more time. Use that time wisely to prepare properly and without feeling rushed.
If you’re not sure where you stand—contracts, SPRS scores, self-assessments—we’re happy to help you sort it out.
We will update you as we continue to learn more.
