The Department of War (formerly Department of Defense) has suspended the rollout of CMMC Phase 2 requirements pending a 60-day review by a newly formed task force. This pause delays the mandatory Level 2 third-party certification assessments for contractors handling CUI, initially set for November 10, 2026. The decision is driven by bureaucratic obstacles and a shortage of certified assessors, with an emphasis on not lowering cybersecurity standards. Phase 1 requirements, including Level 1 and Level 2 self-assessments, remain in effect. The task force will collect industry feedback to recommend adjustments aimed at reducing compliance burdens on small and nontraditional businesses while maintaining robust cybersecurity. The phased rollout of CMMC 2.0 started in November 2025 and plans full implementation by 2028.

The suspension delays the enforcement of more stringent third-party certification requirements for contractors handling controlled unclassified information, potentially affecting the timeline for enhanced cybersecurity verification in the defense industrial base. However, existing Phase 1 requirements and regulations remain in force, ensuring baseline cybersecurity protections continue. The pause aims to prevent smaller contractors from being excluded due to compliance costs, potentially preserving the defense supply chain's diversity and capacity. There is no indication of an active exploit or vulnerability being leveraged; rather, this is a policy and compliance program adjustment.

No immediate action is required to address a vulnerability or exploit since this is a suspension of a compliance phase rather than a technical flaw. Contractors should continue to comply with Phase 1 CMMC requirements and existing cybersecurity regulations. Organizations should monitor updates from the Department of War and the CMMC review task force for revised requirements and timelines. The vendor (Department of War) manages the program and its remediation through policy adjustments; no technical patch applies.