Years in the Making, Suspended in a Day: DoD/W Halts CMMC Phase II but Keeps Baseline Cybersecurity Obligations - regulatoryoversight.com
DoD halts CMMC Phase II rulemaking but retains existing DFARS cybersecurity clauses (252.204-7012, 252.204-7019, 252.204-7020). Contractors must still meet NIST SP 800-171 requirements and self-assessments. No new certification deadlines, but compliance obligations remain unchanged.
Aforeworn detected this change in the Export Controls & ITAR (DDTC / BIS / DFARS) space on July 21, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Defense contractors subject to DFARS cybersecurity clauses, including those handling CUI or FCI. should confirm how it applies to their specific situation before acting. There is a time constraint attached: Ongoing; no new deadline from this change, but existing contract deadlines for NIST SP 800-171 assessments and Plans of Action (POA&Ms) remain.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Export Controls & ITAR (DDTC / BIS / DFARS) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
CMMC Phase II (proposed rule for certification tiers) is suspended indefinitely; however, existing DFARS 252.204-7012 (safeguarding CUI) and 252.204-7019/7020 (NIST SP 800-171 assessment) remain in effect.
Who it affects
Defense contractors subject to DFARS cybersecurity clauses, including those handling CUI or FCI.
What you must do
Continue to comply with current DFARS cybersecurity requirements; do not pause or reduce security efforts. Monitor for future CMMC rulemaking.
Deadline
Ongoing; no new deadline from this change, but existing contract deadlines for NIST SP 800-171 assessments and Plans of Action (POA&Ms) remain.
Never miss a change like this again
Aforeworn watches Export Controls & ITAR (DDTC / BIS / DFARS) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Export Controls & ITAR (DDTC / BIS / DFARS)
- US-CONGRESS BILLS-119hr9764ih: Hindering Oppressive Nations from Obtaining Revenue Act; HONOR Act
- International Traffic in Arms Regulations: U.S. Munitions List Category I Firearm Suppressors
- Implementation of Export Administration Regulations Export Controls on Silencers, Mufflers, and Sound Suppressors; and Other Firearms Related Changes
- US-CONGRESS HR8202: To amend the Export Control Reform Act of 2018 to provide for a ten-year statute of limitations for export control violations.
- US-CONGRESS SJRES70: A joint resolution providing for congressional disapproval of the proposed export of certain defense articles to Israel.