DoD Review Weighs Narrower CMMC Phase 2 Restart and Updated Guidance

The U.S. Department of Defense (DoD) is reassessing how to move forward with the Cybersecurity Maturity Model Certification (CMMC) program after its pause. A task-force review, described in reporting by Federal News Network, presents near- and longer-term options rather than a settled implementation plan. One near-term possibility is restarting Phase 2 within 90 days, but initially for a narrower population of contractors. The review also points to improvements in guidance for marking Controlled Unclassified Information (CUI) and conducting assessments. These options could shape the sequence and scope of future compliance requirements for companies supporting defense contracts, but the review does not establish final rules or guarantee a restart on a particular schedule.

The most immediate compliance implication is that the pause does not cancel contractors’ existing obligations under NIST SP 800-171. Companies should continue meeting applicable requirements and maintaining evidence of their cybersecurity controls while DoD considers its next steps. The source material specifically advises contractors to document controls and their associated costs. That documentation can support internal readiness, inform contract and pricing decisions, and help firms respond if CMMC assessments resume or requirements change. A narrower Phase 2 population could mean some contractors face third-party assessments sooner than others, so defense suppliers should evaluate how the proposed scope might apply to their contracts and information-handling responsibilities.

The review also leaves important technical and regulatory questions unresolved. DoD is considering whether to account for NIST SP 800-171 Revision 3, while assessment guidance and CUI marking practices may be improved. Separately, potential rulemaking could address a 270-day Plan of Action and Milestones (POA&M) period, but this remains under consideration rather than an adopted requirement. For contractors, these open issues complicate decisions about compliance investments: planning must account for current obligations without assuming that future assessment criteria, remediation timelines, or implementation details are fixed. Procurement teams should likewise consider how uncertainty could affect supplier readiness, contract costs, and the availability of compliance support.

The pause also raises questions about the capacity of the third-party assessment market if DoD returns to certification requirements. Eric Crusius, a partner at Hunton, said, “Pausing CMMC without notice has been difficult. If the department wants third-party certifiers in the future, they will have a hard time to gin up capacity to do that.” His observation highlights a practical procurement risk: if demand for assessors increases quickly, contractors may face scheduling constraints as well as compliance expenses. The RFI-related reporting says DoD’s rationale for the pause is being challenged by responses, but the information available does not resolve when or how implementation will resume. Companies should therefore preserve current compliance discipline, track official rulemaking and guidance, and avoid treating the possible Phase 2 restart or POA&M period as final policy.

• DoD is weighing a Phase 2 restart for a narrower contractor population, potentially within 90 days; the review describes an option, not a confirmed schedule.
• The proposed narrower scope could change which defense suppliers are assessed first, making contract-level applicability reviews a near-term planning priority.
• Applicable NIST SP 800-171 obligations remain in place during the CMMC pause; contractors should continue implementing controls and retaining supporting evidence.
• Firms should document cybersecurity controls and related costs to support readiness, compliance planning, and procurement decisions.
• DoD may improve CUI marking and assessment guidance, but the review leaves implementation details unsettled.
• Possible consideration of NIST SP 800-171 Revision 3 means contractors should monitor official direction before assuming future assessment requirements.
• A possible 270-day POA&M period remains under consideration and should not be treated as an adopted remediation deadline.
• Eric Crusius of Hunton warned that an abrupt return to third-party certification could make it difficult to build assessor capacity, potentially affecting assessment timing and costs.
• Procurement teams should account for uncertainty in scope, guidance, standards, remediation rules, and assessment availability when forecasting supplier compliance support and contract costs.