DoD Halts CMMC Phase 2 Initiatives for Review and Recommendations

The Department of Defense (DoD) has officially paused Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program for a thorough 60-day examination of its cybersecurity standards applicable to defense contractors. This decision, taken in mid-2026, is a key regulatory moment impacting defense procurement, particularly as the DoD aims to potentially streamline the CMMC framework. The recommendations from this review are expected by early October 2026. However, any substantive changes that come out of this process will necessitate a formal rulemaking procedure, which could further delay the ultimate implementation of CMMC Phase 2.

The CMMC framework was originally designed to enhance and structure the cybersecurity readiness of defense contractors against evolving threats. With two initial CMMC regulations having gone into effect in 2024, and the first phase already underway since November 2025, companies had been gearing up for an anticipated transition to Phase 2. This unexpected pause, however, raises concerns about contractors’ readiness and could influence their future contracting opportunities if they are unable to timely adapt to updated protocols following the review.

Even with the suspension of Phase 2, compliance with current CMMC standards remains critical. Experts advocate for continued efforts by defense contractors and subcontractors to implement the required cybersecurity measures to ensure they maintain eligibility for DoD contracts. The primary goal is to defend against supply chain vulnerabilities and other cybersecurity risks, which are more salient than ever as the geopolitical landscape evolves and defense technology becomes increasingly reliant on digital integrity.

Prime contractors, including industry giants such as Boeing, Lockheed Martin, and Leonardo DRS, recognize the necessity of maintaining a robust cybersecurity posture throughout their supply chains. These entities are actively urging their suppliers to advance their CMMC certification efforts, understanding the interdependence of compliance within the larger defense acquisition ecosystem. The overarching message is clear: suppliers must prepare themselves now to meet CMMC requirements, which are likely to remain integral in future contract award decisions.

Procurement professionals must brace for potentially extended timelines surrounding the formal enforcement of CMMC standards. However, it's pivotal that they also note that verification processes will not be disregarded in contract evaluations. Although contractors currently enjoy a reprieve amidst the temporary halt, failure to align with evolving compliance standards may significantly jeopardize their chances of securing future contracts.

Organizations should begin preparing for potential outcomes of the DoD's review and the ensuing rulemaking process. This may necessitate reassessments and possible adjustments to cybersecurity compliance strategies to maintain adaptability in an evolving regulatory environment. Flexibility in compliance practices will be essential as the DoD assesses industry feedback and refines its cybersecurity roadmap.

Ryan Heidorn, Chief Technology Officer at C3, succinctly summarizes the potential impact of the review, stating, "Because when we get to the other side of this pause, there’s going to be some sort of verification mechanism, and the timeline’s still going to be the same." This statement underscores the importance of ongoing diligence among contractors as they navigate the uncertainty that the CMMC presents.

As the DoD navigates this intricate path, the implications for defense contractors are profound, necessitating sustained compliance and strategic foresight in anticipation of forthcoming regulatory changes and potential procurement impacts.

• The DoD's review will last for 60 days, with recommendations due by early October 2026.
• Compliance with current CMMC standards remains critical for all defense contractors and subcontractors.
• Prime contractors like Boeing and Lockheed Martin are advocating for their suppliers to be CMMC verified.
• Extended timelines for CMMC enforcement are anticipated, aligning with the DoD's rulemaking process.
• Contractors who fail to comply with evolving standards risk losing DoD contracting eligibility.
• Organizations should reassess their cybersecurity practices in preparation for potential changes post-review.
• Ryan Heidorn emphasizes the importance of verification mechanisms post-pause, signalling continued scrutiny for all contractors.
• The CMMC Reform Task Force will consider industry feedback collected via a request for information prior to the review.
• The timeline implications of the program's pause may impact defense procurement strategies and resource allocations moving forward.
• Organizations should build flexibility into their cybersecurity compliance strategies to adapt to future DoD guidance.