Share on LinkedInShare on LinkedIn

ARTICLE · 15 JULY 2026

DoD Suspends Phase II Of CMMC Program

Butzel Long
Explore more from Butzel Long

The Department of Defense has suspended Phase II of its Cybersecurity Maturity Model Certification program, halting the planned November 2026 requirement for third-party cybersecurity assessments of defense contractors. While Phase I self-assessment requirements remain in effect, DoD has launched a 60-day review to address industry concerns about compliance costs and barriers to participation in the Defense Industrial Base.

United StatesGovernment, Public Sector
Derek Mullins
Derek Mullins
Beth S. Gotthelf
Beth S. Gotthelf
Anthony J. Scalise
Anthony J. Scalise
Claudia Rast
Claudia Rast

On July 13, 2026, the US Department of Defense (“DoD”), also known as the Department of War, announced that it was immediately suspending Phase II of the Department’s rollout of the Cybersecurity Maturity Model Certification (“CMMC”) program, which phase was to come into effect on November 10, 2026. This announcement, accompanied by memoranda to senior Pentagon leadership, represents a potentially seismic shift in DoD’s position with respect to the regulation of defense contractors’ cybersecurity posture.

As noted in a prior Butzel Client Alert, CMMC is a verification framework used by the US government to assess a contractor’s cybersecurity protections in order to protect sensitive government information, specifically Federal Contract Information (“FCI”) and Controlled Unclassified Information (“CUI”), from cyber threats. Phase I, which took effect on November 10, 2025, introduced CMMC Level 1 and Level 2 self-assessments as a condition of award for new contracts that included

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

Article

SBA Extends Deadline For Comments On Historic Overhaul Of Size Standards

The Small Business Administration has extended the comment period for two proposed rules that could dramatically reshape federal government contracting by significantly expanding the pool of entities eligible for small business set-aside procurements. With some size standard thresholds proposed to increase as much as tenfold, these changes would fundamentally alter the makeup of the small business contractor base.
United StatesGovernment, Public Sector
Crowell & Moring LLP
Crowell & Moring LLP
Article

BIOSECURE Act Update: Court Enjoins WuXi AppTec’s 1260H Designation, but Strategic and Compliance Clocks Keep Running

The U.S. District Court for the District of Columbia has preliminarily enjoined the Department of War from enforcing WuXi AppTec's Section 1260H designation, finding the agency misread its evidence on state and military affiliation. However, this ruling does not close alternative pathways to biotechnology company of concern (BCC) designation under the BIOSECURE Act, and earlier supply-chain restrictions continue to drive near-term compliance decisions with a critical June 30, 2027 deadline for sub-tier supp
United StatesGovernment, Public Sector
Greenberg Traurig
Greenberg Traurig
Article

Weekly Sanctions Update: September 14, 2026

The Treasury Department intensifies economic pressure on Iran through Operation Economic Outcast, suspending aviation licenses and sanctioning dozens of entities while implementing a presumption of denial for Iran-related transactions. Meanwhile, new enforcement actions target Chinese cybercrime platforms, Ecuadorian terrorist organizations, and Israeli settlers, as Congress considers comprehensive Russia-Iran sanctions legislation.
GlobalGovernment, Public Sector
Steptoe LLP
Steptoe LLP
Article

Massachusetts’ 2026 Ballot Questions: What Clients Need To Know

Massachusetts voters will decide nine statewide ballot questions in November 2026 that could fundamentally reshape the state's legal, regulatory, and fiscal landscape. These measures address government transparency, election reforms, housing development, marijuana regulation, firearms laws, and state revenue limits, with implications extending far beyond Election Day to implementation, regulation, and ongoing policy debates.
United StatesGovernment, Public Sector
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.
Article

DOJ Continues DEI False Claims Act Enforcement With $25 Million Accenture Settlement

The Department of Justice announced a $25 million settlement with Accenture Federal Services over allegations that the company violated the False Claims Act by falsely certifying compliance with anti-discrimination requirements while allegedly using race or sex in hiring, promotion, and access to professional development programs. This marks the third major DEI-related FCA enforcement action in 2026, following similar settlements with IBM and Deloitte.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Weekly Sanctions Update: September 21, 2026

The Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 has become law, imposing sweeping sanctions on Russian officials, financial institutions, and shadow fleet vessels while authorizing tariffs up to 100 percent on major purchasers of Russian oil and natural gas. How will these new measures impact global trade relationships, particularly with China and India as the largest buyers of Russian crude?
GlobalGovernment, Public Sector
Steptoe LLP
Steptoe LLP
Article

National Historic Preservation Act Overhaul: What You Need To Know

The Advisory Council on Historic Preservation has advanced a Notice of Proposed Rulemaking that would fundamentally restructure Section 106 of the National Historic Preservation Act, marking the most significant regulatory overhaul in over 20 years. The proposed changes would shift the consultation process from a multi-step framework to an agency-prepared report system, narrow the scope of protected properties, and grant federal agencies greater unilateral authority in resolving adverse effects.
United StatesGovernment, Public Sector
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

DOJ's $2 Million Honeywell Settlement Under The Civil Cyber-Fraud Initiative: What Compliance Failures Mean For Defense Contractors

The Department of Justice secured a $2 million settlement with Honeywell Aerospace for allegedly failing to comply with NIST SP 800-171 cybersecurity requirements under a Department of War contract. This case demonstrates how cybersecurity compliance failures can trigger False Claims Act liability even without an actual data breach or cyberattack, and highlights the growing role of whistleblowers in exposing contractors' gaps between contractual obligations and actual security practices.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

New Section 338 Actions Against Canada And Section 301 Tariffs On 60 Trading Partners And Brazil: Key Considerations For US Importers

The Trump Administration has announced sweeping tariff actions targeting Canadian goods under Section 338 and implementing forced labor-related tariffs on 60 trading partners under Section 301. These measures, effective in July and August 2026, will significantly impact importers through increased costs, enhanced customs scrutiny, and complex compliance requirements across multiple statutory frameworks.
European UnionInternational Law
Butzel Long
Butzel Long