Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules - SecurityWeek
The Pentagon has suspended CMMC Phase 2 implementation to reassess contractor cybersecurity rules, delaying mandatory certification requirements for defense contractors.
Aforeworn detected this change in the Government Contracting (SAM/FAR) space on July 18, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated Medium urgency. Defense contractors, small businesses with set-asides, GSA schedule holders, and federal grant recipients subject to DFARS cybersecurity clauses. should confirm how it applies to their specific situation before acting. There is a time constraint attached: No immediate deadline; monitor DoD announcements for revised timeline.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Government Contracting (SAM/FAR) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
CMMC Phase 2, which would have required third-party certification for contractors handling Controlled Unclassified Information (CUI), is suspended indefinitely while the Pentagon rethinks the rules.
Who it affects
Defense contractors, small businesses with set-asides, GSA schedule holders, and federal grant recipients subject to DFARS cybersecurity clauses.
What you must do
Continue current cybersecurity compliance efforts (e.g., NIST SP 800-171 self-assessment) but pause any investments specifically for CMMC certification until new guidance is issued.
Deadline
No immediate deadline; monitor DoD announcements for revised timeline.
Never miss a change like this again
Aforeworn watches Government Contracting (SAM/FAR) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Government Contracting (SAM/FAR)
- Application of the No TikTok on Government Devices Act to the TikTok USDS Joint Venture
- The CMMC Pause: The DoD Suspends Phase 2 Requirements - embedded.com
- DoW Pauses CMMC Phase 2: What Defense Contractors Need - Clark Hill
- US-CONGRESS BILLS-119hr9738ih: Streamlining Military Infrastructure Act
- Proposed RFO Rule Would Create Procurement Integrity-Specific Process for Protecting or Releasing Contractors’ Proprietary Information - The National Law Review