independent
DoD Suspends CMMC Phase 2, Launches Reform Review
The second major pause in four years signals structural rethinking (not a tweak) with the scope of review spanning OT, cloud, MSPs, and supply chain obligations.
The Department of Defense suspended CMMC Phase 2 on July 13, 2026, four months before its scheduled November 10 start. Phase 2 would have mandated third-party C3PAO assessments and Level 2 certifications as conditions of award for contracts involving CUI. A Reform Task Force convened in early September to review more than 1,100 RFI comments on assessment scope, cloud and MSP treatment, supply-chain reach, and operational technology applicability. Its report was due to the DoD CIO on September 11 but hasn't been made public. Phase 1 self-assessment requirements and underlying NIST SP 800-171 obligations remain in effect.