world
Pentagon Suspends Third-Party Cybersecurity Assessments for Defense Contractors
The Defense Department suspended CMMC Phase II requirements that had been set to begin November 10, 2026. Officials cited excessive administrative costs on smaller firms while maintaining that data-protection rules remain in force.
Jul 13, 3:30 PM·1m read1 source
Breaking DefenseAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
The Pentagon suspended the third-party assessment portion of its Cybersecurity Maturity Model Certification program for defense contractors. The change removes a requirement scheduled to start November 10, 2026. Chief information officer Kirsten Davies announced the suspension at a Pentagon briefing.
She said the current version of CMMC places "significant and often prohibitive burdens" on the defense industrial base, especially small and non-traditional businesses.
Background of the program CMMC was first developed in 2019 to limit adversary access to contractor networks. The framework originally used five certification levels; a 2021 revision reduced it to three levels. Phase II would have required both self-assessments and independent third-party reviews every three years.
A July 10 memo stated that administrative compliance should not come at the expense of warfighting capability or industrial-base growth. Davies said the suspension does not remove the legal obligation for contractors to protect federal data. She added that the department is reducing paperwork rather than cybersecurity standards.
The administration has directed agencies to cut regulatory steps that slow equipment delivery and limit industrial-base expansion.
