Book a Briefing
by Mojave Research

DoW Suspends CMMC Phase II: What It Actually Means for the DIB

On July 13, 2026 the Department of War immediately suspended CMMC Phase II — the certification mandate that was set to hit contracts on November 10, 2026. Read the fine print before you stand down: NIST SP 800-171 Rev 2, DFARS 252.204-7012, and Phase 1 self-assessments all remain in force. The bar didn't drop. The paperwork clock did.

What Happened

On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements (official release — “Forging the Arsenal of Freedom”) — the phase that was scheduled to make third-party (C3PAO) certification a condition of award starting November 10, 2026. The Department is also suspending pending and future CMMC implementation milestones across DoW solicitations and contracts, and has launched a 60-day review of the program’s future.

“In support of Secretary Pete Hegseth’s directive to reduce compliance barriers for small and medium sized businesses, we are today suspending the CMMC Phase II requirements and initiating a 60-day study of the future of this program. Robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness. We believe the DIB can achieve both, while we reduce unnecessary government red tape.” — Kirsten A. Davies, DoW Chief Information Officer

The stated rationale: the certification program, designed to raise Defense Industrial Base (DIB) cybersecurity, had instead created prohibitive compliance costs and bureaucratic burden — with SBA data indicating it was pushing innovative companies out of the DIB and slowing delivery of capability to the warfighter.

The Fine Print Everyone Will Miss

This is the part that matters, and it is where a rushed reading gets contractors in trouble. Suspending Phase II is not a suspension of your security obligations. From the release, in plain terms:

  • NIST SP 800-171 Rev 2 still applies. During the interim, the Department will enforce compliance through self-assessments and select government-led assessments — focused on tangible cyber hygiene, not administrative overhead.
  • DFARS 252.204-7012 still applies. The action “does not eliminate the requirement for companies to protect federal data.” Every prime and subcontractor remains contractually obligated to safeguard covered defense information.
  • Phase 1 self-assessment requirements remain firmly in place. The SPRS score you attest to still governs eligibility.

What paused is the third-party certification bureaucracy — not the underlying controls, and not enforcement. If your System Security Plan is thin, your SPRS score is inflated, or your CUI boundary was never really scoped, you carry the same risk today that you did on July 12. A government-led assessment or a False Claims Act action does not care that Phase II is on hold.

What Changes for You — and What Doesn’t

Before (July 12) After (July 13)
C3PAO certification as a condition of award (Phase II) Coming Nov 10, 2026 Suspended
NIST SP 800-171 Rev 2 implementation Required Still required
DFARS 252.204-7012 safeguarding Required Still required
Phase 1 self-assessment + SPRS score Required Still required
Government-led assessments Possible Active — expect them

Where This Is Headed

The DoW CIO is standing up a CMMC Reform Task Force to run a top-to-bottom review, synthesizing DIB feedback gathered through a public Request for Information (RFI) on compliance challenges, and delivering a final report to the CIO within 60 days. The direction of travel — set by Secretary Hegseth’s Acquisition Transformation System — is scalable, resilient cybersecurity that prioritizes speed to capability and lowers barriers for small and non-traditional businesses, in place of one-size-fits-all paperwork. (Industry reporting indicates RFI responses are due by mid-August 2026.)

Translation for the DIB: a new, leaner model is coming. The contractors who use this window to build real resilience — rather than treating it as permission to stand down — will be the ones ready when it lands, and the ones positioned to shape it through the RFI.

Mojave Research’s Take

We built our CMMC practice around the controls that actually reduce risk, not a certificate on a wall. That thesis just became federal policy. Our guidance to DIB leaders this week:

  1. Do not stand down your 800-171 program. It is still enforced — now via self- and government-led assessments. Keep your SSP, SPRS score, and evidence honest and current.
  2. Finish the long-pole work anyway. CUI boundary scoping, SSP documentation, and control-gap remediation are the same work under any future model, and they lower cost no matter how reform lands.
  3. Turn compliance spend into resilience. With the certification clock paused, redirect budget from audit-prep theater into controls that measurably harden your environment.
  4. Engage the reform. The RFI is a rare chance for the DIB to shape a realistic, scalable standard. We can help you respond.

Our team includes a CMMC Registered Practitioner and is onboarding engagements now. A 30-minute readiness triage will tell you exactly where you stand against what is still required today — and how to convert paused-certification budget into genuine operational resilience. Start with our CMMC practice page or see our full capabilities.

Sources