CMMC L2
2026-09-12CMMC compliance timelines have shifted with the suspension of Phase 2 assessments and consolidation of requirements under DFARS 252.204-7021, eliminating parallel assessment obligations. Simultaneously, emerging vishing attacks on Microsoft Teams represent a critical social engineering threat that directly challenges CMMC security control implementation, particularly around access controls and incident response.
- →CMMC Phase 2 Suspension and DFARS Consolidation: Contractors must immediately reassess audit timelines and contract eligibility strategies, as parallel assessments are no longer required and all obligations now consolidate under a single DFARS clause.
- →Coordinated Vishing Attacks Targeting Microsoft Teams Users: Practitioners must strengthen CMMC access control and incident response procedures to address this emerging social engineering vector that exploits Teams-based communication channels.
- →Updated CMMC Compliance Timeline for Contractor Planning: Organizations need to revise their compliance roadmaps and audit scheduling based on the new Phase 2 suspension, affecting both near-term and long-term contract performance obligations.
Review your organization's CMMC compliance calendar against the Phase 2 suspension immediately and conduct a social engineering risk assessment focused on Teams-based vishing threats to validate access control and user awareness controls.
Feb 2026 Regulatory Update: Contractors now fulfill their assessment obligations through CMMC under DFARS 252.204-7021, rather than through parallel 7019/7020 requirements. DFARS 252.204-7019 has been deleted and DFARS 252.204-7020 has been renumbered to 252.240-7997. The basic self-assessment and SPRS upload requirements under the old 7019/7020 framework have been eliminated. These changes are part of the broader FAR overhaul effort to remove regulatory redundancy. DFARS 252.204-7012 and the [
A recent article released by the Palo Alto Threat Research Center found that, between January and April 2026, a coordinated effort by threat actors was successful in launching vishing attacks using Microsoft Teams accounts to compromise companies across multiple industries....<BR />By: <a href="https://www.jdsupra.com/profile/Robinson_Cole_Data_Privacy_Security_Insider/">Robinson+Cole Data Privacy + Security Insider</a>
On July 13, 2026, the Pentagon suspended CMMC Phase 2 — the stage that would have required a third-party audit before you could win most contracts involving controlled unclassified information (CUI). The November 10, 2026 date everyone was racing toward is off the calendar, along with the later Phase 3 and Phase 4 milestones. [...] Phase 2, which would have made third-party certification mandatory on November 10, 2026, is suspended as of July 13, 2026, along with Phases 3 and 4. During the revie