DoW Pauses CMMC Phase 2: What Defense Contractors Need - Clark Hill
The Department of Defense (DoD) has paused implementation of CMMC Phase 2, delaying mandatory cybersecurity certification requirements for defense contractors. This pause affects contractors preparing for CMMC assessments and those relying on CMMC compliance for contract awards.
Aforeworn detected this change in the Government Contracting (SAM/FAR) space on July 17, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Defense contractors, especially those in the defense industrial base, small businesses with set-asides, and GSA schedule holders who handle controlled unclassified information (CUI). should confirm how it applies to their specific situation before acting. There is a time constraint attached: Ongoing; no new deadline for CMMC certification, but existing compliance deadlines for NIST SP 800-171 (e.g., annual self-assessment) still apply.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Government Contracting (SAM/FAR) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
DoD paused CMMC Phase 2, which would have required contractors to achieve CMMC certification (Level 2 or higher) to bid on or perform certain contracts. The pause means no new CMMC requirements will be enforced until further notice, but existing DFARS 252.204-7012 and NIST SP 800-171 compliance obligations remain.
Who it affects
Defense contractors, especially those in the defense industrial base, small businesses with set-asides, and GSA schedule holders who handle controlled unclassified information (CUI).
What you must do
Continue to maintain compliance with DFARS 252.204-7012 and NIST SP 800-171 self-assessment requirements. Do not halt cybersecurity preparations; the pause is temporary and CMMC may be reinstated with modifications.
Deadline
Ongoing; no new deadline for CMMC certification, but existing compliance deadlines for NIST SP 800-171 (e.g., annual self-assessment) still apply.
Never miss a change like this again
Aforeworn watches Government Contracting (SAM/FAR) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Government Contracting (SAM/FAR)
- The CMMC Pause: The DoD Suspends Phase 2 Requirements - embedded.com
- US-CONGRESS BILLS-119hr9738ih: Streamlining Military Infrastructure Act
- Proposed RFO Rule Would Create Procurement Integrity-Specific Process for Protecting or Releasing Contractors’ Proprietary Information - The National Law Review
- US-CONGRESS BILLS-119s4784rs: National Defense Authorization Act for Fiscal Year 2027
- Revolutionary FAR Overhaul: FAR Council Proposes Streamlined Public Notice Requirements Under FAR Part 5 - The National Law Review