The CMMC Pause: The DoD Suspends Phase 2 Requirements - embedded.com
The Department of Defense has suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) requirements, delaying mandatory third-party assessments for defense contractors.
Aforeworn detected this change in the Government Contracting (SAM/FAR) space on July 17, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated Medium urgency. Defense contractors, small businesses with set-asides, GSA schedule holders, federal grant recipients should confirm how it applies to their specific situation before acting. There is a time constraint attached: No new deadline; await further DoD guidance.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Government Contracting (SAM/FAR) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
DoD suspended Phase 2 of CMMC, which required third-party certification for contractors handling Controlled Unclassified Information (CUI).
Who it affects
Defense contractors, small businesses with set-asides, GSA schedule holders, federal grant recipients
What you must do
Continue self-assessment and compliance with NIST SP 800-171; no immediate third-party audit needed.
Deadline
No new deadline; await further DoD guidance.
Never miss a change like this again
Aforeworn watches Government Contracting (SAM/FAR) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Government Contracting (SAM/FAR)
- Application of the No TikTok on Government Devices Act to the TikTok USDS Joint Venture
- DoW Pauses CMMC Phase 2: What Defense Contractors Need - Clark Hill
- US-CONGRESS BILLS-119hr9738ih: Streamlining Military Infrastructure Act
- Proposed RFO Rule Would Create Procurement Integrity-Specific Process for Protecting or Releasing Contractors’ Proprietary Information - The National Law Review
- US-CONGRESS BILLS-119s4784rs: National Defense Authorization Act for Fiscal Year 2027