Pentagon announces ‘immediate suspension’ of CMMC Phase II mandates

The Pentagon has announced the immediate suspension of CMMC Phase II requirements, which were scheduled to go into effect November 10, 2026, citing onerous burdens on smaller defense firms. Kirsten Davies, the Pentagon's chief information officer, stated the suspension is in support of Secretary of War Hegseth's directive to scale warfighter readiness, emphasizing that robust cybersecurity remains a critical priority but that the measure is about reducing red tape. A July 10 memo notes that the current CMMC iteration imposes significant and often prohibitive burdens on the Defense Industrial Base, particularly small and non-traditional businesses. Michael Duffey, Undersecretary of Defense for Acquisition and Sustainment, clarified that the suspension halts complex audits and the requirement for third-party assessors and audits, with active solicitations containing those requirements to be amended. The audits apply to CMMC Levels II and III. The CMMC program, initiated in 2019 during the first Trump administration, was designed to bolster cybersecurity across the industrial base, with Phase II requiring both self-assessment and third-party assessments every three years.