U.S. Department of War suspends CMMC Phase 2

The U.S. Department of War (DoW) has suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. Originally scheduled to begin on November 10, 2026, Phase 2 would have required many defense contractors to pass a Level 2 assessment by a CMMC Third-Party Assessment Organization (C3PAO) as a condition for contract awards.

While the suspension pauses the rollout and the requirement for third-party certification as a condition of award, it does not change existing contract requirements regarding the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The DoW has established a CMMC Reform Task Force to conduct a 60-day review of the program.

In response to the evolving regulatory landscape, Associated Builders and Contractors (ABC) has launched a free Cybersecurity Maturity Model Certification Roadmap for contractors. The roadmap is designed to help contractors within the Defense Industrial Base navigate certification for Phase 1 and prepare for future requirements involving the management of sensitive information.