Share on LinkedInShare on LinkedIn

ARTICLE · 21 JULY 2026

Pentagon Suspends CMMC Phase 2 Requirements And Launches Review Of Cybersecurity Certification Program

WilmerHale
WilmerHale
Contributor
WilmerHale

WilmerHale

WilmerHale's London office was established more than 40 years ago. With lawyers qualified in the...

View firm profile
Explore more from WilmerHale

The US Department of Defense has suspended Phase 2 of its Cybersecurity Maturity Model Certification (CMMC) program, halting third-party assessment requirements that were set to take effect in November 2026. While this provides relief from expanded certification burdens, defense contractors must understand that underlying cybersecurity obligations remain fully in force. What does this mean for contractors' compliance strategies and their obligations to protect federal contract information?

United StatesGovernment, Public Sector

The Pentagon Pauses CMMC Phase 2 Implementation

On July 13, 2026, the US Department of War announced the immediate suspension of Phase 2 of the implementation of Cybersecurity Maturity Model Certification (CMMC) assessment requirements, which had been scheduled to take effect on November 10, 2026. The Department further suspended pending and future CMMC implementation milestones across its solicitations and contracts while it conducts a broader review of the CMMC program, which would have imposed significant compliance burdens on contractors and subcontractors in the defense industrial base. The Department also updated parts of its CMMC Frequently Asked Questions to reflect the suspension.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from