Pentagon suspends CMMC Phase 2 cybersecurity mandate

The Pentagon has suspended a major upcoming cybersecurity mandate for defense contractors, halting a requirement for costly third-party audits that officials said was driving small businesses out of the defense supply chain. The Department of Defense announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements on July 13, nearly four months before they were set to take effect on November 10, 2026.

Chief Information Officer Kirsten Davies and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey announced the decision, which also suspends all pending CMMC milestones and future phases, including Phase III scheduled for November 2027. Davies ordered a 60-day study of the program's future and the creation of a CMMC Reform Task Force to review the framework.

Officials cited prohibitive compliance costs and a severe shortage of accredited assessors as the primary reasons for the pause. A Department-convened small business roundtable and analysis from the Small Business Administration found that Phase II compliance could cost individual companies hundreds of thousands of dollars, with estimates reaching nearly...