Department of War Suspends CMMC Phase II: Rollout Set for November 10 Halted, Self-Assessments Stay
The U.S. Department of War announced on July 13, 2026, the immediate suspension of the transition to Phase II requirements of the Cybersecurity Maturity Model Certification (CMMC) program. Phase II had been scheduled to take effect on November 10, 2026, and would have required defense contractors handling controlled unclassified information to obtain Level 2 certification through third-party assessments as a condition of contract award. The Department said all Phase I self-assessment requirements remain firmly in place, and that pending and future CMMC implementation milestones across Department of War solicitations and contracts are also suspended.
Kirsten A. Davies, the Department's Chief Information Officer, said the move supports Secretary of War Pete Hegseth's directive to reduce compliance barriers for small and medium sized businesses, and that the Department is initiating a 60-day study of the future of the program. Davies said robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness, and that the defense industrial base can achieve both while unnecessary government red tape is reduced.
Michael Duffey, Under Secretary of War for Acquisition and Sustainment, said the Department has a strategic imperative to reduce bureaucracy as it builds the Arsenal of Freedom, and that the decision maintains a strict security baseline while removing paralyzing costs and keeping innovators and competition growing in the defense supply chain.
The Department said the current CMMC program, though designed to enhance defense industrial base cybersecurity, has instead created prohibitive compliance costs and bureaucratic burdens. Recent data, including reports from the Small Business Administration, confirmed that CMMC compliance is forcing innovative companies out of the defense industrial base, which will delay delivery of critical capabilities to warfighters. The Chief Information Officer's office is establishing a CMMC Reform Task Force to conduct a top-to-bottom review of the certification program, synthesize industry feedback from a public Request for Information on compliance challenges, and deliver its final report to the CIO within 60 days with realistic, scalable security measures.
During the interim period, the Department will enforce cybersecurity compliance with the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.
The Department stressed that the action does not eliminate the requirement for companies to protect federal data: all defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012. (Source: U.S. Department of War)
Source: U.S. Department of War
Published by GSM · USA (original Chinese edition)
Photo: 图：五角大楼，美国战争部总部（联邦固定图库）。 / Photo: The Pentagon, headquarters of the U.S. Department of War (federal asset library).
