A Aforeworn
Forewarned is forearmed.
Home › Niches › Export Controls & ITAR (DDTC / BIS / DFARS) › Change
Medium urgency

Department of War Suspends CMMC Phase II Requirements, but Cybersecurity Obligations Remain - Morgan Lewis

Detected July 16, 2026 · in Export Controls & ITAR (DDTC / BIS / DFARS)

The Department of War has suspended CMMC Phase II requirements, but existing cybersecurity obligations under DFARS remain in effect. This change reduces immediate compliance pressure for CMMC certification but does not eliminate the need for basic cybersecurity measures.

Aforeworn detected this change in the Export Controls & ITAR (DDTC / BIS / DFARS) space on July 16, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated Medium urgency. Defense contractors and subcontractors subject to DFARS cybersecurity clauses should confirm how it applies to their specific situation before acting. There is a time constraint attached: Ongoing; no new deadline from this suspension.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Export Controls & ITAR (DDTC / BIS / DFARS) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.

What changed

CMMC Phase II requirements are suspended; however, DFARS 252.204-7012 and other cybersecurity obligations remain enforceable.

Who it affects

Defense contractors and subcontractors subject to DFARS cybersecurity clauses

What you must do

Continue to comply with existing DFARS cybersecurity requirements; do not halt cybersecurity efforts. Monitor for future CMMC updates.

Deadline

Ongoing; no new deadline from this suspension.

Source: https://news.google.com/rss/articles/CBMiywFBVV95cUxOczg1Vzh0cDZpTE14UVI5aUR6NjBqNUV0TGdVNUxuVVZzNDVBN3hleTRERENaOUxXR1lYaDgzN2FsNTdTa0REZlgwbElwcUZRQ2dmTDM2VkVYZTlwQjNjMHNsaktkQTdjMHdLSEl6SXN1WVU0Qk0wN2F2cFJsSDdmdnFnMmZfQ3dvQXJseTRLQkxrck5tdWJPUkQxblhoMldzVEF0UGIxeXMyUHpQZU9ka05aTjZ1eUt3VHhJZWF1OC1neURsb3BUVjc2WQ?oc=5

Never miss a change like this again

Aforeworn watches Export Controls & ITAR (DDTC / BIS / DFARS) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.

Start your free trial

Related changes in Export Controls & ITAR (DDTC / BIS / DFARS)