DoW Delays CMMC Phase II Implementation, Reviews Compliance Requirements

On August 21, 2026, the U.S. Department of War (DoW) announced a significant pause in the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements. Initially slated to go live on November 10, 2026, this suspension includes deferring the necessity for mandatory third-party Level 2 audits aimed at defense contractors managing controlled unclassified information (CUI). Alongside this pause, the DoW has created a 60-day review task force to reassess how the CMMC aligns with modernization objectives in defense acquisitions and to mitigate compliance burdens, particularly for small and mid-sized contractors.

The implications of this suspension are profound for the defense industry, which faces a complicated compliance landscape. Although the DoW’s announcement alters the CMMC Phase II implementation schedule, contractors must still uphold their cybersecurity commitments under the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 and maintain compliance with NIST Special Publication (SP) 800-171. This means organizations must continue to evaluate their cybersecurity postures and conduct self-assessments for Levels 1 and 2, ensuring adherence to their current contractual obligations.

While some may view this delay as an opportunity for relief, it is crucial to understand that existing standards do not diminish. Prime contractors, including industry giants such as Lockheed Martin, Boeing, Northrop Grumman, General Dynamics, and RTX, will still require CMMC Level 2 certification as a prerequisite for participation in their supply chains. This requirement underscores the ongoing significance of cybersecurity readiness, as prime contractors seek to mitigate risks associated with cyber vulnerabilities.

The 60-day review task force has the potential to alter the landscape of CMMC compliance — however, for defense contractors, this implies a period of heightened scrutiny and preparation. With the procurement landscape evolving alongside these changes, professionals in the industry must remain vigilant and proactive, ensuring that they continually assess their cybersecurity measures and readiness. This review phase serves as a crucial moment for organizations to evaluate existing frameworks, assess cybersecurity infrastructure, and strategically plan for any possible changes to the CMMC requirements.

Moreover, the need to comply with the current procurement requirements remains paramount. As outlined by Jeremy Price, Managing Director, "CMMC Level 2 certifications remain valuable for demonstrating supply chain trustworthiness to prime contractors." Therefore, despite the pause on Phase II, stakeholders in the defense contracting sector should reinforce their cybersecurity frameworks and ensure robust compliance efforts to maintain market eligibility.

In summary, the DoW's suspension offers a temporary reprieve, but it must not result in complacency among defense contractors. The necessity for vigilance, assessment of current capabilities, and adaptation to any forthcoming changes will be critical as the DoW reviews the CMMC framework within the broader context of acquisition transformation.

• Defense contractors are required to comply with existing cybersecurity standards despite CMMC Phase II suspension.
• Prime contractors will still expect CMMC Level 2 certification, highlighting importance for subcontractors.
• DoW’s review period allows for reassessment of cybersecurity measures and response strategies against existing gaps.
• Procurement professionals should adjust risk management strategies to accommodate evolving compliance requirements.
• Additionally, contractors should remain attentive to contractual obligations under DFARS and NIST standards even during this pause.
• Organizations with scheduled third-party assessments should refer to new guidance when determining next steps.

Agencies involved in this context include the Department of War, National Institute of Standards and Technology, Department of State, and the Department of Commerce. Vendors directly impacted include Lockheed Martin, Boeing, Northrop Grumman, General Dynamics, and RTX. This suspension and review hold significant ramifications for cybersecurity compliance expectations across the Cybersecurity and Defense & Military sectors, making it essential for GovCon professionals to stay informed and proactive during this transitional period.