DoD Pauses CMMC Phase 2 as Task Force Reviews Cybersecurity Compliance Implications

The Department of Defense (DoD) has announced the suspension of the upcoming Phase 2 requirements under its Cybersecurity Maturity Model Certification (CMMC) program, which were originally set to go into effect on November 10, 2026. This decision is part of a broader, 60-day review that will explore the efficacy and burdens of current cybersecurity compliance measures. Led by DoD Chief Information Officer Kirsten Davies, the task force will focus on gathering input from industry stakeholders, particularly small businesses, to assess the impact of CMMC on the defense industrial base.

The CMMC program was established to enhance cybersecurity across defense contractors, but many in the industry have criticized the program for imposing excessive compliance costs and administrative burdens. As Davies noted, the existing framework has created hurdles, leading some innovative companies to withdraw from defense contracting due to the prohibitive cost and complexity of compliance. "The combination of prohibitive compliance costs, severe shortages in third-party assessment capacity, and complex regulatory timelines is actively forcing innovative new entrants and small businesses to opt out of [DoD] contracts and freezing critical suppliers out of the market," she explained.

Under the revised framework, the DoD will maintain Phase 1 self-assessment requirements while the task force assesses the feedback received through a Request for Information (RFI) alongside nationwide listening sessions. The intent is to streamline compliance processes, potentially making them more efficient and less costly while still ensuring robust cybersecurity measures are in place. Industry participants are encouraged to share their experiences and recommendations on affordable and effective cybersecurity solutions that can align with compliance frameworks. Responses are due by August 14, 2026, indicating that the DoD is looking for quick and actionable recommendations.

This cautious approach suggests that the DoD is mindful of balancing the need for stringent cybersecurity measures with the realities faced by contractors, especially smaller firms who may lack the resources to manage robust compliance mandates. The task force aims to create a more flexible and accessible compliance environment for companies committed to securing their processes without becoming overwhelmed by regulatory burdens. In doing so, the DoD hopes to foster a diverse pool of suppliers better equipped to support defense and national security objectives.

The findings from this review are expected to yield recommendations for potential modifications to the CMMC program. According to Davies, based on industry feedback, the recommendations could range from significant overhauls to minor adjustments. However, the DoD remains committed to transparency during this process, indicating that the results of the task force will be made publicly available for stakeholder awareness and engagement.

The emergence of a dual focus on cybersecurity resilience and cost-effectiveness will be pivotal in shaping future defense acquisition strategies. Contractors should closely monitor developments from this review as they may significantly alter the landscape of compliance and eligibility for future contracts.

• Why this matters: Procurement professionals should anticipate potential changes to CMMC requirements that could affect contract eligibility and cybersecurity compliance obligations.
• The pause on Phase 2 implementation provides an opportunity for contractors, especially small businesses, to influence program reforms through the RFI and listening sessions.
• Organizations should evaluate current cybersecurity practices against Phase 1 standards and prepare for possible revised requirements following the task force's recommendations.
• This review signals DoD's intent to balance robust cybersecurity enforcement with manageable compliance costs, impacting future defense acquisition strategies.
• The task force's RFI seeks practical recommendations for reducing compliance costs and streamlining cybersecurity requirements.
• All current Phase 1 self-assessment requirements remain in effect during the review process, meaning organizations must continue compliance efforts in line with existing standards and practices.