Overview
- The department announced the suspension on Monday, July 13, 2026, halting the planned November 10 Phase II requirement for third‑party certification and pausing later rollout milestones.
- While Phase II is paused, program offices will accept Level 1 and Level 2 self‑assessments and selected government‑led audits instead of mandatory third‑party reviews.
- Officials pointed to a near‑total lack of assessor capacity and heavy compliance costs as the reason, saying roughly a hundred qualified assessors cannot meet demand across more than 100,000 affected Defense Industrial Base firms and that SBA data shows some suppliers left the market.
- The pause does not remove contractors’ legal duties to protect controlled unclassified information; companies must still follow NIST SP 800‑171 and DFARS 252.204‑7012 and face enforcement or legal risk if they misrepresent compliance.
- DoD created a CMMC Reform Task Force, posted an RFI with responses due August 14, and expects recommendations at the end of the 60‑day review that could shift validation toward government assessments, commercial service recognition, or other scalable models with knock‑on effects for procurements and assessor businesses.