Pentagon suspends CMMC phase two requirements, launches review of program - Federal News Network
Pentagon suspends CMMC phase two requirements and launches a program review, delaying mandatory cybersecurity certification for defense contractors.
Aforeworn detected this change in the Government Contracting (SAM/FAR) space on July 14, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated Medium urgency. Defense contractors, small businesses with set-asides, GSA schedule holders, federal grant recipients subject to DFARS cybersecurity clauses. should confirm how it applies to their specific situation before acting. There is a time constraint attached: No immediate deadline; monitor DoD announcements for resumption of CMMC requirements.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Government Contracting (SAM/FAR) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
CMMC phase two requirements are suspended; a review of the program is initiated. No new certifications are required until further notice.
Who it affects
Defense contractors, small businesses with set-asides, GSA schedule holders, federal grant recipients subject to DFARS cybersecurity clauses.
What you must do
Maintain current NIST SP 800-171 compliance as per existing DFARS clauses. Do not pursue CMMC certification until guidance is updated.
Deadline
No immediate deadline; monitor DoD announcements for resumption of CMMC requirements.
Never miss a change like this again
Aforeworn watches Government Contracting (SAM/FAR) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Government Contracting (SAM/FAR)
- Defense Federal Acquisition Regulation Supplement: Inflation Adjustment of Acquisition-Related Thresholds (DFARS Case 2024-D002)
- Defense Federal Acquisition Regulation Supplement: Preventing Conflicts of Interest for Certain Consulting Services (DFARS Case 2024-D007)
- Defense Federal Acquisition Regulation Supplement: Disclosure of DoD Funding in Technical Publications (DFARS Case 2024-D003)
- Defense Federal Acquisition Regulation Supplement: Limitation on Certain Institutes of Higher Education (DFARS Case 2024-D023); Correction
- Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)