Department of War Halts CMMC Phase II, Impacting Defense Contractor Compliance

In July 2026, the Department of War announced a significant pause in Phase II of the Cybersecurity Maturity Model Certification (CMMC) program, a critical initiative aimed at bolstering cybersecurity among defense contractors. The suspension comes in the wake of two major challenges: overwhelming compliance costs, estimated at nearly $600,000 per organization, and a shortage of qualified assessors necessary for conducting cybersecurity evaluations. This decision delays the implementation of compliance measures that would have impacted over 100,000 defense contractors, marking a notable shift in the landscape of cybersecurity requirements in the defense sector.

The CMMC was designed to enforce rigorous cybersecurity standards to protect controlled unclassified information (CUI) shared with defense contractors. However, the prospect of escalating costs and the apparent lack of available assessors to certify compliance led to the suspension. As a result, procurement timelines related to the defense supply chain are now uncertain, and contracting officers must prepare for potential delays in the initiation of new contracts that hinge on CMMC compliance. Defense contractors must now navigate the implications of this temporary halt while grappling with existing regulatory requirements.

Despite the suspension of CMMC, other regulatory frameworks such as the FTC Safeguards Rule and the Gramm-Leach-Bliley Act (GLBA) remain in force. Organizations involved in providing services to defense contractors need to remain vigilant regarding their cybersecurity practices, as the obligation to protect sensitive information continues unabated. The delay in CMMC Phase II does not grant a reprieve from compliance under these existing regulations. Therefore, firms that handle sensitive financial data—and implicitly, those advising on compliance matters—must emphasize strengthening their cybersecurity measures in tandem with continuing client engagement.

This pause in the CMMC initiative also serves as a broader lesson in the realm of federal compliance programs. Agencies periodically revise, delay, or even terminate compliance programs without abandoning the associated cybersecurity risks. For firms managing sensitive financial and client data, this underscores the importance of maintaining a proactive and resilient cybersecurity stance rather than waiting for regulatory milestones to dictate their action. The cybersecurity landscape remains fraught with threats, and companies must prioritize cyber hygiene to safeguard client information against ongoing and evolving risks, irrespective of regulatory shocks.

As they adjust to the suspension of CMMC Phase II, defense contractors and related firms should consider practical strategies to enhance their cybersecurity postures beyond the delayed requirements. They must formalize policies, invest in multi-factor authentication, and solidify their information security frameworks, particularly considering the susceptibility of financial data to breaches.

In the wake of this suspension, firms should take actionable steps, including formalizing a written information security policy (WISP) that aligns with existing federal standards, and ensuring consistent implementation of multi-factor authentication across systems handling sensitive data. Robust planning and execution of incident response protocols and continuous staff training on phishing and cyber threats remain essential. Furthermore, a review of cyber liability insurance against actual security controls in place can help firms close any potential gaps in protection. Here's a summary of key implications and actionable insights related to the suspension of CMMC Phase II:

• Defense contractors are encouraged to reassess their cybersecurity compliance strategies given the suspension of CMMC Phase II, recalibrating procurement plans accordingly.
• Organizations that support defense contracts must uphold stringent data protection policies, ensuring compliance with ongoing regulations like the FTC Safeguards Rule and GLBA.
• This suspension can influence future contract timelines and requirements, leading to closer coordination between contractors and contracting officers.
• Cybersecurity consultants should stress adherence to active regulatory measures, specifically the FTC and GLBA, to assist clients in navigating the compliance landscape effectively.
• Firms managing client financial data must maintain a rigorous security posture, given the static nature of data protection obligations amidst evolving compliance timelines.
• Supplier engagement strategies should be updated to reflect potential shifts in contract realities caused by the suspension.