INSIGHT

CMMC Phase II Is on Pause. Your Cybersecurity Strategy Shouldn’t Be.

October 20, 2026

Since the Department of Defense (DoD) suspended Phase II requirements for the Cybersecurity Maturity Model Certification (CMMC) on July 13, 2026, the pause has become the working reality for the Defense Industrial Base (DIB). Phase II, which would have introduced third-party certification as a condition of award for many contracts involving Controlled Unclassified Information (CUI), was set to begin November 10, 2026. That date is no longer in play, and no replacement has been announced.

The 60-day review window for the CMMC Reform Task Force closed in September. As of early October, DoD has not publicly released the Task Force’s findings or said what comes next for the program. If your organization has spent the past two years setting budgets, hiring consultants, remediating gaps, and lining up a Certified Third-Party Assessment Organization (C3PAO), you may be wondering what to do with that momentum. If you have been hoping the requirement quietly disappears, the pause does not offer that reprieve either. Here is where things stand, what has not changed, and how you can use this stretch of uncertainty to strengthen your position.

Where Things Stand Today

The July announcement suspended the transition to Phase II, along with pending and future CMMC implementation milestones across DoD solicitations and contracts. DoD also formed the CMMC Reform Task Force to review the program and opened a public Request for Information (RFI). The RFI comment period closed August 14 after drawing more than 1,100 comments. In early September, DoD issued a class deviation directing contracting officers to remove third-party CMMC assessment requirements from solicitations and contracts, which writes the pause into contract language rather than leaving it as a policy memo alone.

The Task Force’s report was due to the DoD Chief Information Officer in mid-September. At this point, there has been no formal public announcement about the report’s findings or the future of the program. Much of the guidance from the original announcement still applies, and the uncertainty has not eased. Several points deserve attention:

Phase I self-assessment requirements remain in place. Level 1 and Level 2 self-assessments continue.
DFARS clause 252.204-7012 still applies. All defense contractors and subcontractors remain contractually obligated to safeguard covered defense information.
NIST SP 800-171 Rev 2 is still the standard. During the pause, DoD is enforcing compliance through self-assessments and select government-led assessments.
No new Phase II date has been announced. Any change to the program will likely arrive through a formal DoD announcement, so watching for one is part of the plan.

In plain terms, the CMMC framework is being reworked while your obligation to protect CUI and Federal Contract Information (FCI) stays exactly where it was.

The Questions on Every Contractor’s Mind

Conversations the Firm has with clients keep circling back to the same set of concerns. See if any of these sound familiar.

We Spent Six Figures Preparing. Was That Wasted?

For many mid-market contractors, CMMC readiness has meant new tooling, policy overhauls, System Security Plan (SSP) documentation, Plan of Action and Milestones (POA&M) work, and outside advisory fees. A suspension that stretches past its original review window can make those investments feel like sunk costs.

They are still working for you. The underlying controls come from NIST SP 800-171, which DoD continues to use as the enforcement standard. Work you have done on access control, media protection, incident response, and configuration management continues to count. The certification process around those controls may change, but the controls themselves keep protecting your business and your contracts.

Do We Slow Down, Speed Up, or Sit Still?

The answer depends on where you are in the readiness curve. Contractors who were on track for a Level 2 assessment in 2027 have room to breathe, and that room comes with a decision: use the time to mature your program, or lose the momentum you have built. Sitting still is rarely the right answer. Adversaries targeting the DIB are not waiting on the Task Force.

How Do We Explain This to the Board?

Executive teams and audit committees have been briefed for years on CMMC as a business-critical program. Now that the pause has lasted months, the question is whether earlier investments still make sense. Answering it takes clear communication about what has changed, what has not, and how the Firm you rely on for advisory support is helping you adapt.

What Happens to Our Prime and Subcontractor Relationships?

Primes have been flowing down CMMC-aligned requirements to their supply chains for months. Some of those flow-downs are contractual, some are aspirational, and some will be renegotiated as DoD removes third-party assessment requirements from its own solicitations and contracts. Reading your actual contract and flow-down language, rather than relying on headlines, is the most reliable way to know where you stand.

Why Cybersecurity Maturity Still Matters More Than the Certificate

DoD has been direct about its reasoning. Recent data, including reports from the Small Business Administration, indicated that CMMC compliance costs were pushing innovative companies out of the DIB and delaying delivery of critical capabilities. The Task Force is looking for a model that maintains a strict security baseline while removing prohibitive costs. DoD leadership has been equally direct that security expectations remain.

Speaking at the Billington Cybersecurity Summit on September 9, DoD CIO Kirsten Davies said, “This isn’t about whether cybersecurity is important or not. It is.” With enforcement running through self-assessments and select government-led assessments, the stakes rise for accurate, defensible, and continuously maintained compliance evidence. The Firm continues to advise clients to treat this period as a chance to build maturity.

A Four-Part Strategy While the Pause Continues

Here is a practical framework you can put in front of your leadership team this week.

1. Reassess, Do Not Retreat

Take a fresh look at your NIST SP 800-171 posture and your current Supplier Performance Risk System (SPRS) score. If the score you self-attested to is aspirational rather than accurate, close that gap now. With self-assessments and government-led assessments serving as the primary enforcement tools, documentation integrity is a higher-priority risk than it was before the pause.

2. Preserve Your Investment

Inventory the work you have already completed and map it to enduring controls. Areas that are likely to hold up under any Task Force revision include:

Multi-factor authentication and identity management
Endpoint detection and response
Incident response planning and tabletop exercises
Vulnerability and patch management
Secure configuration baselines
Insider threat and privileged access controls

3. Right-Size Your Roadmap

The November 2026 Phase II date no longer drives your timeline, so you can rebalance. Reallocate resources from documentation-heavy certification prep toward cybersecurity risk management priorities that measurably reduce risk, such as network segmentation, CUI data mapping, and third-party oversight.

4. Watch for What Comes Next

The RFI window has closed, but the story has not. Keep an eye out for the public release of the Task Force’s findings, any announcement from the DoD CIO, and amendments to your solicitations and contracts. Build a plan that holds up whether third-party certification returns on a new timeline, returns in a narrower form, or stays on hold. Assign someone on your team to track developments and review contract language as it changes.

How BPM Supports Defense Contractors Through the Transition

The Firm works with government contractors, aerospace and defense manufacturers, technology providers, and their subcontractors to build cybersecurity and compliance programs that hold up under scrutiny and evolve with the regulatory environment. Services particularly relevant to the current CMMC pause include:

Cybersecurity Assessment and Advisory: Evaluate your posture against NIST SP 800-171, DFARS 252.204-7012, and adjacent frameworks, then prioritize remediation based on your business model.
CMMC and NIST 800-171 Readiness: Support SSP development, POA&M tracking, SPRS score validation, and self-assessment preparation, and help you translate any changes DoD announces into program adjustments.
Managed IT and Cybersecurity Services: Provide continuous monitoring, vulnerability management, and security operations support aligned to your contractual obligations.
Government Contract Accounting and Risk Advisory: Align cybersecurity investments with allowable costs, indirect rate structures, and audit readiness.
Third-Party and Supply Chain Risk: Build a Third-Party Risk Management program that reflects current DFARS obligations, whether you are a prime managing subcontractor risk or a subcontractor responding to flow-downs.

The Bottom Line for Defense Contractors

The CMMC Phase II pause changes the timeline for third-party certification. Your DFARS obligations remain in force, NIST SP 800-171 Rev 2 remains the enforcement standard, and the threat environment keeps evolving regardless of what the Task Force recommends. Contractors who keep strengthening their programs and tightening their documentation will be better positioned however the reformed framework takes shape.

Let’s Talk About Your Next Steps

Whether you are validating a self-assessment, accelerating a NIST SP 800-171 readiness effort, or rethinking your cybersecurity roadmap while DoD’s review plays out, we are here to help you make the right call for your business. Contact us to learn how BPM’s CMMC compliance services and our Government Contract Consulting colleagues can help you navigate what this pause means for your organization.

Contact US