CMMC PROGRAM UPDATE
Department of War Suspended CMMC Phase II Requirements
The deadline moved. The obligation didn’t.
⏱ 3 min read
Today the Department of War suspended CMMC Phase II requirements, which were set to take effect November 10, 2026, and launched a 60-day review of the program.
I’ve already heard the reaction: “Great, we can pause our compliance spend.”
Department of War Suspended CMMC Phase II Requirements: 5 Obligations That Still Apply
That would be a mistake. Here’s why:
Phase I self-assessments remain fully in effect.
NIST SP 800-171 Rev 2 is still enforced, now including select government-led assessments.
DFARS 252.204-7012 obligations to protect covered defense information remain contractually binding.
Your SPRS score still matters, and inaccurate scores still carry False Claims Act risk.
Prime flow-down clauses may still require certification regardless of the federal pause.
This is a 60-day review, not a repeal. Whatever replaces Phase II will be built on the same NIST 800-171 foundation. The work transfers.
Breathing Room, Not a Break
The contractors who treat this as breathing room, closing POA&M items on a realistic timeline and staying assessment-ready, will be positioned to win when the revised program lands.
The ones who hit pause will be restarting from behind, competing against companies that never stopped.
Source: U.S. Department of War — Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirement.
Unsure What the Pause Means for Your Contracts?
If you’re in the Defense Industrial Base and unsure what this means for your contracts, now is the time to review your flow-down language, not after the Task Force reports back.