DOW Suspends CMMC Phase II: What The Pause Means For Contractors Right Now

Executive Summary

• What’s new: On July 13, 2026, the DOW announced an immediate suspension of Phase II of the Cybersecurity Maturity Model Certification Program, holding subsequent milestones in abeyance pending a 60-day Reform Task Force review.
• Why it matters: The suspension does not offer relief from current obligations; government contractors must still complete self-assessments, post Supplier Performance Risk System scores, and maintain DFARS and NIST compliance activity.
• What to do next: Companies will want to continue Phase I, DFARS and NIST SP 800-171 compliance activity; maintain C3PAO-readiness work; and consider submitting comments to the DOW’s consultation.

On July 13, 2026, the Department of War (DOW)¹ announced the immediate suspension of Phase II of the Cybersecurity Maturity Model Certification (CMMC) Program, which had been scheduled to take effect on November 10, 2026.² The CMMC program is a DOW initiative to ensure that industry meets the cybersecurity requirements that apply to acquisition programs and systems that process controlled unclassified information on contracts with the DOW. The CMMC program establishes three levels of cybersecurity requirements, which escalate based on the sensitivity of the underlying information.

The CMMC final rule contemplated three phases of implementation:

• Phase I, which has been in effect since November 10, 2025, implements (i) Level 1 self-assessment and FAR 52.204-21 affirmation requirements and (ii) Level 2 self-assessment and NIST SP 800-171 affirmation requirements.
• Phase II would have introduced Level 2 assessments to be performed by an accredited third-party assessor (C3PAO).
• DOW is also holding all subsequent CMMC milestones (i.e., Phase III’s Defense Industrial Base Cybersecurity Assessment Center certification for Level 3) in abeyance pending a 60-day review by a newly established CMMC Reform Task Force tasked with aligning the program with Secretary Pete Hegseth’s Acquisition Transformation Strategy.

CMMC Phase I remains fully in force, and DOW must still include CMMC Level 1 self-assessment or Level 2 self-assessment requirements in applicable solicitations and contracts, and contractors must still complete self-assessments and post scores to the Supplier Performance Risk System (SPRS). The following are also unaffected: (i) DFARS 252.204-7012 safeguarding and rapid cyber incident reporting obligations; (ii) NIST SP 800-171 Rev. 2 controls; the Department of Justice’s (DOJ’s) Civil Cyber-Fraud Initiative enforcement authority under the False Claims Act.

Practical Considerations for Government Contractors

• The suspension does not offer relief from current obligations.
  • If a government contract or solicitation currently requires only Level 1 or Level 2 self-assessment, nothing changes; self-assessment, SPRS scoring and annual affirmation obligations continue on their existing timeline.
  • Additionally, any self-attestations, System Security Plans (SSP) and Plan of Action and Milestones (POA&M) required under NIST SP 800-171 and DFARS 252.204-7012 remain in effect.
• Active C3PAO requirements are being stripped from requests. DOW has directed contracting officers to amend active solicitations to remove any Level 2 (C3PAO) or Level 3 (DIBCAC) requirements “as soon as practicable,” and to modify existing contracts containing those requirements no later than the next option exercise or scheduled administrative modification.
• The November 10, 2026, third-party deadline is off, for now. There is no announced reinstatement date, and DOW officials have not ruled out more significant restructuring, or even cancellation, once the 60-day review concludes.
• False Claims Act exposure is, if anything, sharper. With self-assessment now the primary (rather than interim) enforcement mechanism, the accuracy of SPRS scores and compliance affirmations warrants heightened attention.

Key Steps to Consider Now

Companies should consider:

• Continuing all Phase I, DFARS, and NIST SP 800-171 compliance activity (e.g., self-assessments, SPRS scoring, annual affirmations, and SSP and POA&M updates) without interruption or delay.
• Maintaining C3PAO-readiness work. The suspension is a pause, not a cancellation; a backlog of assessment demand is likely if/when third-party requirements resume, and contractors that stay ready will be better positioned to compete for awards that others cannot immediately satisfy.
• Auditing current and pipeline solicitations for any CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) clauses and flagging them for removal or amendment consistent with DOW’s directive.
• Reviewing upcoming option-period exercises and administrative modifications to confirm the government follows through on removing suspended requirements and to avoid overcommitting to third-party assessments that are not currently mandatory.
• Revisiting compliance budgets and vendor/assessor contracts in light of the uncertain timeline, without abandoning the underlying NIST SP 800-171 control implementation, which remains mandatory regardless of the CMMC Phase II pause.

How to Engage: Shaping the Next Phase of the CMMC

DOW has opened a Request for Information (RFI) on SAM.gov soliciting industry input to inform the Reform Task Force’s recommendations. Written responses are due by email no later than 12:00 p.m. on Friday, August 14, 2026. The RFI poses seven questions, including (i) which security controls deliver meaningful risk reduction versus which impose disproportionate cost with limited benefit, (ii) how Phase I self-assessments could be streamlined and (iii) what commercial cybersecurity capabilities DOW should recognize within a revised framework. This is an opportunity to influence the program’s next iteration, and clients with cost, timeline or implementation concerns and supporting data are well positioned to submit comments.

Footnotes

1. Congress has not yet acted on the administration’s renaming of the Department of Defense.

2. The suspension is implemented through two internal DOW CIO/undersecretary memoranda: the CMMC Reform Memo and the Implementing Suspension of CMMC Phase II Memo.