The Department of War has announced an immediate suspension of Phase II implementation for the Cybersecurity Maturity Model Certification (CMMC) program, pausing mandatory third-party audits that were set to begin on November 10, 2026.
Key Elements of the Suspension Announcement
Following extensive consultation with the Small Business Administration (SBA) Office of Advocacy, defense procurement officials halted Phase II rollouts to address high compliance costs and a shortage of certified third-party assessment organizations (C3PAOs).
- Phase II Pause: Mandatory third-party certification audits for small defense subcontractors are suspended indefinitely pending a 60-day program overhaul.
- Reform Task Force Review: A newly created CMMC Reform Task Force will review program requirements to simplify compliance for small and medium-sized suppliers.
- Enforceable Baseline Controls Remain: The suspension does not relieve defense contractors of basic cybersecurity duties. Phase I self-assessments under DFARS 252.204-7012 and NIST SP 800-171 remain mandatory and enforceable in the Supplier Performance Risk System (SPRS).
- Public Comment Window: Small contractors can submit feedback on regulatory compliance costs through a Request for Information (RFI) open through August 14, 2026.
Why This Relief Matters for Small GovTech Contractors
Small defense contractors and technology startups faced potential compliance costs reaching nearly $600,000 for formal CMMC Phase II third-party audits. The pause prevents small suppliers from being disqualified from bidding on defense contracts while procurement rules undergo overhaul.
Recommended Action Steps for Defense Contractors
- Maintain NIST SP 800-171 Compliance: Continue verifying internal network controls and updating SPRS self-assessment scores.
- Pause External C3PAO Audit Retainers: Suspend costly third-party assessment engagements until the CMMC Reform Task Force issues revised rules.
- Review DFARS Contract Clauses: Ensure current contracts accurately reflect Phase I compliance requirements.
Educational information only, not licensed legal, tax, or financial advice. We refer to and partner with licensed professionals when personalized advice is needed. Laws change; no warranty of accuracy or timeliness.
Sources and Official References
- Primary Source: SBA Office of Advocacy Statement (July 13, 2026), SBA Office of Advocacy CMMC Statement
- Tier 2 Corroboration: FedScoop & GovConWire Defense Procurement Analysis, FedScoop CMMC Suspension Report
- Regulatory Baseline: DFARS 252.204-7012 & NIST SP 800-171 Revision 2