DoD Suspends the CMMC Phase 2 Transition: What Defense Contractors Should Do Now

The Department of Defense has changed the timing of its Cybersecurity Maturity Model Certification (CMMC) rollout—but defense contractors should not interpret the change as a reason to stop preparing.

In Class Deviation 2026-O0025, Revision 3, effective September 3, 2026, the DoD directed contracting officers to remove or revise certain CMMC requirements in new and existing solicitations and contracts. Most notably, the memorandum suspends the planned November 2026 transition to CMMC Phase 2.

However, the memorandum does not eliminate CMMC, and it does not remove contractors’ responsibility to protect Controlled Unclassified Information (CUI). Baseline compliance with NIST SP 800-171 Revision 2 remains required under DFARS 252.204-7012.

For organizations in the Defense Industrial Base (DIB), this is a change in implementation timing—not a retreat from cybersecurity accountability.

What changed?

The memorandum implements a July 13, 2026 directive titled Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements. It instructs DoD acquisition personnel to revise CMMC requirements as follows:

• The November 2026 transition to CMMC Phase 2 is suspended.
• Requiring activities may still include CMMC Level 1 (Self) or Level 2 (Self) assessments in procurement requests and requirements documents.
• Active solicitations containing affected requirements are to be amended as soon as practicable.
• For existing contracts, affected requirements are to be removed through a contract modification before the next option period or during the next scheduled administrative modification.
• Contractors handling covered defense information must still comply with NIST SP 800-171 Revision 2 under DFARS 252.204-7012.

Contractors should review the language of each solicitation, award, option, and modification rather than assume that every CMMC requirement has automatically disappeared. The applicable obligation will continue to depend on the specific procurement and contract terms.

What did not change?

The most important point is that the underlying security requirements remain in place.

Organizations that process, store, or transmit CUI on covered contractor information systems must continue to provide adequate security and implement the applicable requirements of NIST SP 800-171 Revision 2. Contractors also remain responsible for other applicable DFARS obligations, including cyber incident reporting and the flowdown of relevant requirements to subcontractors.

The revised DFARS text also preserves the broader CMMC structure, including CMMC status levels, Supplier Performance Risk System (SPRS) records, annual affirmations of continuous compliance, assessment identifiers, subcontractor flowdown expectations, and the use of plans of action and milestones where permitted.

In short, the compliance destination remains. The timetable for expanding third-party certification requirements has changed.

Why waiting would be a mistake

The suspension gives contractors additional preparation time, but readiness still requires much more than completing a last-minute checklist.

A defensible CMMC program requires an organization to understand where CUI and Federal Contract Information reside, define the systems and users within the assessment boundary, implement the required safeguards, document how controls operate, collect supporting evidence, address gaps, and maintain compliance over time.

These activities often expose issues that cannot be corrected quickly, such as:

• Incomplete asset inventories or unclear CUI data flows
• Missing or outdated policies and procedures
• Weak access control and multifactor authentication coverage
• Insufficient logging, monitoring, or incident-response evidence
• Unresolved NIST SP 800-171 requirements
• Inaccurate or outdated System Security Plans
• Poorly managed Plans of Action and Milestones
• Limited visibility into subcontractor compliance
• Evidence that exists but is scattered across email, shared drives, and spreadsheets

Contractors that use the suspension as preparation time can reduce remediation pressure, improve the quality of their evidence, and approach future assessments with greater confidence. Contractors that stop preparing may face the same gaps later, but with less time to resolve them and more revenue at risk.

Five actions defense contractors should take now

1. Review current and pending contract language

Identify solicitations and contracts containing CMMC or DFARS cybersecurity clauses. Monitor amendments and modifications closely, especially before proposal submission, award, renewal, or option exercise.

2. Confirm where FCI and CUI are handled

Map how sensitive government information enters, moves through, and leaves the organization. Verify which people, systems, cloud services, locations, and subcontractors are within scope.

3. Measure current compliance with NIST SP 800-171

Perform a requirement-by-requirement assessment based on actual implementation. Record deficiencies accurately and support every conclusion with objective evidence.

4. Strengthen documentation and evidence

Keep the System Security Plan, policies, procedures, configurations, logs, screenshots, training records, test results, and other artifacts current and connected to the requirements they support. An implemented control that cannot be demonstrated may not withstand assessment scrutiny.

5. Manage remediation as an ongoing program

Assign owners, target dates, resources, and priorities to identified gaps. Track progress centrally, validate completed actions, and reassess controls when the environment changes.

How Cyberator helps contractors prepare for CMMC

Cyberator provides DoD contractors with a structured, centralized way to prepare for CMMC and maintain visibility into readiness.

With Cyberator, organizations can:

• Assess current practices against applicable CMMC and NIST SP 800-171 requirements
• Identify security and compliance gaps across people, processes, and technology
• Upload and organize evidence against individual requirements
• Assign remediation actions, owners, priorities, and due dates
• Maintain policies, procedures, and supporting artifacts in one location
• Track progress through dashboards and management reporting
• Monitor subcontractor and third-party risk
• Build an actionable roadmap toward assessment readiness
• Maintain a defensible record of continuous compliance activities

Cyberator does not replace an authorized CMMC assessor or grant certification. It helps contractors perform the critical work that comes before the assessment: understanding requirements, resolving gaps, organizing evidence, and keeping the program on track.

Turn the delay into a readiness advantage

The suspension of the CMMC Phase 2 transition provides breathing room, not an exemption. NIST SP 800-171 obligations remain, self-assessment requirements may still appear in procurements, and the broader direction of travel toward verifiable cybersecurity performance has not changed.

Defense contractors should use this period to strengthen controls, improve documentation, validate evidence, and address weaknesses before certification becomes a contract-critical deadline.

Do not wait for the next deadline to discover where your gaps are. Schedule a Cyberator demonstration and see how your organization can build a clear, manageable path toward CMMC readiness.

This article is provided for general informational purposes and does not constitute legal or contracting advice. Contractors should review applicable solicitation and contract language and consult qualified advisors regarding their specific obligations.