DoW Pauses CMMC Phase 2, but Existing Cybersecurity Duties Remain

The Department of War (DoW) paused Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program on July 13, after the phase was scheduled to begin November 10, 2026. Phase 2 would have required many defense contractors handling controlled unclassified information (CUI) to obtain Level 2 certification from a third-party assessor before contract award. DoW initiated a 60-day review, which ended in September; as of October 21, the department had not published its results or announced a revised Phase 2 date. The pause may alter the timing of a specific certification requirement, but it does not cancel cybersecurity duties already imposed by contracts, regulations, or agency requirements.

A separate proposed rule may expand the compliance picture beyond defense procurement. Published by the Federal Acquisition Regulatory Council (FAR Council) on June 23 as part of the broader FAR overhaul, the proposal would establish similar CUI safeguards for contractors across federal agencies. It would require contractor systems handling CUI to meet National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 3, require reporting of CUI incidents within 72 hours, and extend requirements to subcontractors through flowdowns. The proposal would also reach commercial products and services, while excluding commercially available off-the-shelf items. The comment period closed July 23, but no date for a final rule has been announced, so contractors should treat these provisions as potential future requirements—not as rules already in force.

The proposed incident-reporting structure would direct civilian-contract reports to the Cybersecurity and Infrastructure Security Agency (CISA) and defense-contract reports to DoW. Agencies would also use a standard form to identify CUI in each contract. For cloud environments, contractors and software providers should assess the potential requirement for security equivalent to FedRAMP Moderate, while distinguishing that preparation from a binding obligation under the still-proposed rule. The FAR Council’s paperwork estimate anticipates nearly 20,000 respondents, suggesting that the proposal could affect a broad range of suppliers if finalized. Independent software vendors should therefore evaluate not only direct federal awards, but also how their products are used by prime contractors and subcontractors handling CUI.

For defense contractors, several obligations remain applicable now: CMMC Phase 1 self-assessments, annual affirmations in the Supplier Performance Risk System (SPRS), and Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which requires protection of covered defense information and reporting of cyber incidents. Prime contractors may retain cybersecurity requirements in their subcontracts, and some large primes had already told suppliers to treat November 10 as a deadline. Civilian contractors remain subject to the CUI clauses and agency-specific terms already included in their contracts. Enforcement risk is also current: in September, Honeywell Aerospace agreed to pay more than $2 million to resolve False Claims Act allegations related to NIST SP 800-171 compliance. The settlement was not a finding of liability, but it underscores why contractors should document their current controls and contract-specific compliance.

• CMMC Phase 2 was paused July 13; its review ended in September, with no results or new phase date published as of October 21.
• The paused phase had been scheduled for November 10, 2026, and would have required many defense CUI handlers to earn third-party-assessed Level 2 certification before award.
• The proposed FAR rule was published June 23; its comment period closed July 23, and no final-rule date has been announced.
• Proposed controls include NIST SP 800-171 Revision 3, CUI incident reporting within 72 hours, standardized contract identification of CUI, and subcontractor flowdowns.
• The proposal would apply to commercial products and services but exclude commercially available off-the-shelf items; the FAR Council estimated nearly 20,000 respondents.
• Current defense requirements include CMMC Phase 1 self-assessments, annual SPRS affirmations, and DFARS 252.204-7012 protections and incident reporting.
• Civilian contractors should review existing CUI clauses and agency-specific contract terms; proposed government-wide provisions are not yet binding.
• Software providers should map where their products process CUI, review subcontractor and prime-contractor obligations, and assess potential cloud-security needs equivalent to FedRAMP Moderate.
• Honeywell Aerospace agreed in September to pay more than $2 million to resolve False Claims Act allegations concerning NIST SP 800-171 compliance; the settlement was not a finding of liability.