On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. For many defense contractors, the big question is simple: what changes now, and what still needs attention?
The short answer is that the administrative rollout of Phase II has paused, but cybersecurity obligations have not disappeared. If your company handles federal contract information (FCI) or controlled unclassified information (CUI), you should treat this pause as a moment to clarify your compliance roadmap, not to step away from it.
What the Phase II pause means
The Department has said it will review CMMC as part of a broader effort to reduce compliance burden and remove barriers for small, medium, and non-traditional defense businesses. In practice, that means some of the more formal CMMC implementation steps are being reconsidered.
However, the core expectation to safeguard sensitive government information remains. Contractors should not interpret this announcement as a suspension of cybersecurity responsibility.
Which requirements still matter for defense contractors?
- Protection of FCI and CUI still matters. If you receive, process, or store sensitive contract-related information, your organization is still expected to protect it appropriately.
- DFARS 252.204-7012 remains important. Contractors handling CUI should still be aligned to the underlying security expectations tied to NIST SP 800-171 Rev. 2.
- Self-assessments and affirmations still deserve attention. The government has made clear that foundational self-assessment activity remains part of the picture during this pause.
- Contract language still drives risk. Prime contractors and subcontractors should continue reviewing contract requirements, flowed-down obligations, and SPRS-related expectations carefully.
What contractors should do right now
- Review your current compliance status. Confirm where you stand on FCI, CUI, NIST SP 800-171 controls, documentation, and affirmations.
- Do not pause internal readiness work. If you were already working toward stronger cybersecurity controls, policy updates, or evidence collection, that work is still valuable.
- Check your contracts and upcoming bids. Even while the broader implementation is being reviewed, contract-specific expectations may still affect eligibility and risk.
- Use this time strategically. The pause creates an opportunity to strengthen your environment, clean up documentation, and prepare for whatever revised implementation path follows.
Why this pause should not lead to inaction
Many defense contractors have already invested time and resources into CMMC readiness. The organizations that use this pause well will be the ones that focus on practical security, documentation discipline, and contract readiness rather than waiting for the next deadline to force action.
If you are unsure how the Phase II pause affects your business, the best next step is to assess your current requirements, your data environment, and your likely near-term obligations.
Book a Consultation
If you want to talk through how the CMMC Phase 2 pause affects your organization, you can schedule time with our team below.
Open the booking page in a new tab
Gavii helps defense contractors understand what still applies, what can wait, and how to move forward with confidence.
