The Department of War (DoW) recently announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements that were scheduled to take effect on November 10, 2026. The Department has also initiated a comprehensive review of the CMMC program to evaluate potential reforms aimed at reducing barriers for small, medium-sized, and non-traditional defense contractors.

What Changed?

The Department has directed that:

• The November 2026 transition to CMMC Phase II has been suspended.
• Pending and future CMMC implementation milestones are on hold until further notice.
• Contracting activities will currently be limited to requiring CMMC Level 1 Self-Assessments or CMMC Level 2 Self-Assessments.
• New requirements for CMMC Level 2 Third-Party (C3PAO) Certifications and Level 3 assessments are suspended while the review is underway.

Organizations should be aware that:

• DFARS 252.204-7012 requirements remain in effect.
  • Continue operating and maintaining the controls, processes, and incident reporting capabilities required by your DoD contracts.
• Protection of Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) remains a contractual obligation.
  • Continue enforcing security controls that protect sensitive government information throughout its lifecycle.
• NIST SP 800-171 security requirements remain the foundational cybersecurity standard for defense contractors handling CUI.
  • Continue implementing, documenting, and maturing your NIST SP 800-171 compliance program.
• The Department has stated that cybersecurity and supply chain resilience remain critical priorities despite the suspension.
  • Continue preparing for assessment readiness so your organization remains positioned to meet future DoD requirements.

Guidance for Organizations Already Certified

If your organization has already completed a CMMC certification assessment:

• Your certification status remains valid.
• Existing investments in compliance, governance, documentation, and technical controls continue to provide value.
• We recommend maintaining your compliance program and continuing normal control monitoring and evidence collection activities.
• Continue preparing for future renewals until additional government guidance is released.

Guidance for Organizations Preparing for Assessment

If your organization is actively preparing for a CMMC assessment:

• Do not stop your cybersecurity improvement efforts.
• Continue implementing and documenting NIST SP 800-171 requirements.
• Continue developing and maintaining key artifacts such as System Security Plans (SSPs), Policies, Procedures, and Plans of Action & Milestones (POA&Ms).
• Continue assessment preparation and evidence collection activities.
• Address known gaps and remediation items according to your roadmap.

Our Perspective

While the certification requirement has been temporarily suspended, the underlying cybersecurity expectations for defense contractors have not disappeared. Organizations that continue strengthening their cybersecurity programs will be better positioned to meet future contractual requirements, maintain eligibility for defense-related work, and demonstrate due diligence in protecting sensitive government information.

Layer 8 Security will continue monitoring developments and will provide updates as additional guidance becomes available from the Department. If you have questions regarding how this announcement affects your organization, current CMMC readiness efforts, or upcoming assessments, please contact Layer 8 Security.

References

1. Department of War CIO Memorandum, “Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of Cybersecurity Maturity Model Certification Requirements”, Memorandum 26-P-1023, July 2026. [dowcio.war.gov]
2. Department of War News Release, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements”, July 13, 2026. [war.gov]
3. Department of Defense CIO, “Cybersecurity Maturity Model Certification Procedures During Suspension Period”, Attachment to Memorandum 26-P-1023, July 2026. [dodcio.defense.gov]

 

BACK TO BLOGS