Pentagon Hits Pause on CMMC Phase II: What Contractors Need to Know
❓What:
The DoD suspended CMMC Phase II requirements until it reviews the program to allow for more innovation in the US defense industrial base infosecurity-magazine
Phase II was originally scheduled to come into effect on November 10, 2026, requiring contractors handling CUI to transition from basic self-attestations to mandatory, independent assessments led by Certified Third-Party Assessment Organizations (C3PAOs) against the 110 NIST SP 800-171 controls infosecurity-magazineinfosecurity-magazine
The DoD will stand up a 'CMMC Reform Task Force' to conduct a 60-day, top-to-bottom review of the program infosecurity-magazine
During the interim, the DoD will enforce compliance via NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments infosecurity-magazine