The Department of War announced on July 13, 2026 the immediate suspension of CMMC Phase II third-party assessment requirements, a move the Small Business Administration says will keep tens of thousands of small defense contractors from being forced out of the Defense Industrial Base before a certification bottleneck they had no way to clear in time.
Background
The Cybersecurity Maturity Model Certification program was built to verify that companies handling controlled unclassified information on defense contracts actually meet NIST SP 800-171 Rev 2 security controls, rather than simply attesting that they do. CMMC 2.0 rolled out in three tiers: Level 1 self-assessment for basic safeguarding, Level 2 for controlled unclassified information (split between self-assessment and third-party assessment depending on data sensitivity), and Level 3 for the most sensitive programs, assessed directly by the Defense Industrial Base Cybersecurity Assessment Center.
Phase 1, which requires companies to self-assess and submit affirmations through the Supplier Performance Risk System, has been in force since November 2025, when the CMMC clause began appearing in new contracts. Phase 2 was the harder step: it required a subset of Level 2 contractors to obtain a certification from an accredited Certified Third-Party Assessment Organization, or C3PAO, before they could be awarded or retain certain contracts. That requirement was scheduled to take effect November 10, 2026.
The math behind that deadline had been evident for some time: the volume of companies needing third-party sign-off vastly outpaced the number of firms authorized to perform the assessments, a mismatch the Pentagon's own officials cited this week as the reason for pulling the deadline rather than letting it collide with the assessor shortage.
Key Details
DoD Chief Information Officer Kirsten Davies and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey announced the suspension jointly. Davies put the scheduling problem in blunt terms, telling DefenseScoop: "The math just simply doesn't math for small to medium-sized businesses to even get compliant by the transition date." Duffey framed the pause as a way to preserve the industrial base rather than shrink it, telling DefenseScoop: "By pausing Phase 2 implementation, we are keeping more companies in the DIB who would otherwise be forced out of the market at a time when we need them most."
The scale of the mismatch is what forced the decision. SBA's release puts the number of Defense Industrial Base small businesses that would have needed compliance at more than 120,000, against roughly 100 certified C3PAO assessors nationwide available to perform the audits. Even running continuously, that assessor pool could not have worked through the backlog before the November deadline.
Cost was the other half of the equation. SBA cites compliance costs of approximately $593,800 per company for a third-party certification, or $388,600 for a self-assessment path, figures that officials said would have pushed a meaningful share of small and mid-sized contractors out of defense work entirely rather than through it.
Both officials were explicit that the suspension is not a rollback of cybersecurity standards. Davies told Breaking Defense: "We are not reducing cybersecurity through this measure. We are reducing the red tape." Duffey added: "We're not relaxing any standards by any means. ... What we're removing is the bureaucracy of the third-party assessment." Phase 1 self-assessment and the underlying NIST SP 800-171 Rev 2 security obligations remain in effect during the pause; what is suspended is the requirement to pay for and complete an independent third-party audit by a fixed date.
SBA Administrator Kelly Loeffler publicly backed the move, saying "cybersecurity cannot come at the cost of bureaucracy that shuts out the very companies our warfighters depend on." The department is standing up a cross-functional CMMC Reform Task Force, drawing from the CIO's office, Acquisition and Sustainment, Research and Engineering, information security, legislative affairs, and legal counsel, to review the program end to end. The task force has 60 days to deliver recommendations, and the department is simultaneously issuing a public Request for Information to gather industry input on how the third-party assessment structure should be redesigned, or whether it should be replaced.
What It Means for Contractors
Nothing about a contractor's current cybersecurity obligations changes today. Phase 1 self-assessment, SPRS affirmations, and NIST SP 800-171 Rev 2 controls stay mandatory for companies handling controlled unclassified information, and the CMMC clause keeps appearing in new solicitations. What goes away, at least for now, is the hard November 10, 2026 deadline to have a C3PAO assessment completed and the six-figure spend that deadline was forcing companies to commit to on a compressed timeline.
Contractors who had already scheduled or paid for a third-party assessment should confirm directly with their C3PAO and contracting officer how the pause affects any assessment already in progress or scheduled work already contracted. The suspension applies to the Phase 2 requirement itself, not to individual firms' existing compliance postures, so companies that let their NIST 800-171 controls lapse in anticipation of Phase 2 taking over are still exposed under Phase 1 obligations that never went away.
The 60-day task force review and the open RFI are the parts of this story worth watching closest. Officials have left full restructuring, and outright cancellation of the third-party assessment model, on the table pending the task force's findings, meaning the shape of Phase 2 could look very different than the version paused this week, or it may not return in its current form at all. Small and mid-sized contractors who were budgeting for six-figure certification costs this fiscal year now have a window to redirect that spending toward closing actual NIST 800-171 gaps rather than paying for an assessor slot that may no longer be required in its current form. Companies should treat the RFI as a chance to shape whatever comes next rather than assume the requirement has been permanently retired, and contracting officers on active solicitations should be expected to field questions from bidders about how the pause affects near-term award timelines while the task force does its work.
