CMMC L2
2026-09-20DoD has suspended CMMC Phase II implementation and is shifting enforcement focus to NIST 800-171 Rev 2 compliance, fundamentally altering the regulatory landscape for defense contractors. CMMC 2.0 remains the authoritative framework, but practitioners must now navigate the transition period and understand how revised NIST standards integrate with certification requirements.
- →DoD Suspends CMMC Phase II Implementation: Practitioners must immediately reassess certification timelines and prioritize NIST 800-171 Rev 2 compliance over previously planned CMMC Phase II readiness activities.
- →Shift to NIST 800-171 Rev 2 as Primary Enforcement Mechanism: Organizations need to audit current controls against the revised NIST standard to identify gaps and remediation priorities before DoD enforcement intensifies.
- →CMMC 2.0 Framework Remains Authoritative but Timeline Uncertain: Practitioners should maintain CMMC 2.0 knowledge and infrastructure investments while clarifying with contracting officers how Phase II suspension affects their specific compliance obligations.
Conduct an immediate gap analysis against NIST 800-171 Rev 2 and request written clarification from your contracting officer on whether Phase II suspension affects your current compliance deadlines.
On August 25, 2025, the 48 CFR CMMC rule cleared regulatory review. According to ISI,[further explanation needed] it published on September 10, 2025. On July 13, 2026, the Pentagon temporarily paused CMMC Phase 2 from going into effect, claiming the current process had become too bureaucratic and burdensome on defense companies A CMMC Reform Task Force is expected to conduct a review of the entire program and submit a report of its findings and recommendations. ## Criticism [edit] [...] 20.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 program is the next iteration of the CMMC cybersecurity model. It streamlines requirements to three levels of cybersecurity and aligns the requirements at each level with well-known and widely accepted NIST cybersecurity standards. ### Tags Topics: Information and Communications Technology Supply Chain Security ## Related Resources Publication ### 2026 Minimum Elements for a Software Bill of Materials (SBOM) External
. The defense industrial base (DIB) faces increasingly frequent and complex cyber-attacks. On July 13, 2026 the DoW suspended the implementation of Phase II of the CMMC and established a CMMC reform task force. During this period the DoW will enforce cybersecurity compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments. [...] Phase II requirements, which was originally scheduled for November 10, 2026. All Phase I self-assessment requirements remain firml