The Pentagon Just Suspended CMMC Phase 2. Here's What It Means and What Doesn't Change.

Yesterday the Department of Defense announced the immediate suspension of CMMC Phase 2 requirements. The third-party certification mandate that was set to take effect November 10, 2026 is on hold. A Reform Task Force will spend 60 days reviewing the program and come back with recommendations.

If you're a defense contractor, this is the biggest CMMC development since enforcement began last November. Here's what you need to know.

DoD CIO Kirsten Davies and Under Secretary of Defense for Acquisition Michael Duffey announced the suspension at a Pentagon briefing on July 13. The core issue: the program as designed was structurally broken.

Over 100,000 defense industrial base businesses needed third-party assessments. There were roughly 100 approved assessors. The SBA estimated compliance costs approaching $600,000 per certification for small firms. As Davies put it: "the math just simply doesn't math."

The SBA had been raising alarms for months that CMMC compliance was forcing small businesses out of the defense industrial base entirely. Companies that should be building capabilities for warfighters were instead spending their time and money navigating a certification process that couldn't scale.

Phase 2 is suspended. The November 10 deadline for third-party C3PAO certification as a condition of contract award is on hold. All pending and future CMMC implementation milestones in DoD solicitations and contracts are suspended. Contracting officers have been directed to amend active solicitations that contain Phase 2 requirements.

A CMMC Reform Task Force is conducting a 60-day review. DoD is issuing a Request for Information asking contractors about cost drivers, administrative burdens, which NIST 800-171 controls deliver meaningful risk reduction, and how companies are already using commercial cybersecurity tools. Responses are due August 14. Recommendations are expected around mid-September.

This is the part most people will miss.

Phase 1 self-assessment requirements remain in force. If you have DFARS 252.204-7012 in your contracts, you are still legally required to protect controlled unclassified information. NIST SP 800-171 Rev 2 is still the standard. Your SPRS score still matters. The DoD can still assess you at any time. Your primes can still gate awards on compliance.

The suspension targets the certification mechanism, not the underlying security requirement. If you handle CUI and you're not implementing the 110 controls in NIST 800-171, you're still noncompliant. You just don't need a third-party assessor to tell you that right now.

If you've been spending time and money getting your security posture right, building your SSP, implementing controls, and working toward NIST 800-171 compliance, that work is not wasted. Davies said it directly: "Every dollar spent on security is a wise dollar spent. Those who have been forward leaning in uplifting their cyber posture have contributed to national security. That is not money spent in vain."

The security requirement hasn't gone away. The verification mechanism is being reworked. Companies that are already compliant are in a stronger position regardless of what the task force recommends, because primes still evaluate subcontractor security posture, and the underlying DFARS obligation hasn't changed.

If you were putting off CMMC compliance hoping it would go away, you got a temporary reprieve on the certification deadline. You did not get a reprieve on the security requirement itself.

Here's the reality: the 60-day review could result in Phase 2 coming back with new dates, a narrower scope (third-party assessment only for higher-risk contracts), a shift toward automated or government-led verification, or a fundamentally restructured program. Every scenario on the table keeps NIST 800-171 Rev 2 as the substantive standard.

The contractors who use this pause to actually implement controls will be ready for whatever comes next. The ones who use it as an excuse to do nothing will be in the same scramble they were in before, just with a different deadline.

There's an irony here that's worth noting. The compliance industry spent years building around CMMC. Assessor organizations stood up. Consulting firms built CMMC practices. Companies invested hundreds of thousands of dollars preparing for Phase 2. And the program got suspended because it couldn't scale.

This is what happens when compliance becomes more about the certification process than the actual security outcome. The DoD's own statement says they want to "replace prohibitive, third-party compliance models with scalable, realistic security measures." That's an acknowledgment that the mechanism was getting in the way of the goal.

Sound familiar? We've seen this dynamic play out in other frameworks. When the process becomes the product and the security outcome becomes secondary, something eventually breaks.

If you're a defense contractor or subcontractor handling CUI: