Government Contracts Intelligence Briefing

Under regulations issued last October, Phase 2 of the Department of Defense/War’s Cybersecurity Maturity Model Certification (CMMC) program was set to begin on November 10, 2026. Instead, the Chief Information Officer’s (CIO) pause, enacted on July 13, 2026, remains in effect with no announced end date.

Phase 2 would not have required CMMC in all contracts as a default (that was due to begin on November 10, 2028), but would have instead defaulted to requiring third-party assessments when CMMC was placed in a contract (after approval by a program manager) and Controlled Unclassified Information was expected to be part of contract performance.

The announced pause was to be followed by a 60-day study period. That study period lapsed in mid-September. Despite that, nearly six weeks later, the CIO has not provided updates or guidance for contractors selling products and services to the Department of Defense/War.

What is Currently Required?

It is important to remember that Phase 1, along with the underlying security controls, is still in effect. This means that:

• Contractors with Federal Contract Information must still comply with the security controls in Federal Acquisition Regulation (FAR) 52.204-21 and, if CMMC is required, successfully complete a Level 1 self-assessment.
• Contractors with Controlled Unclassified Information must still comply with the security controls in NIST SP 800-171 (revision 2) and, if CMMC is required, successfully complete a Level 2 self-assessment.

The CIO noted in announcing the pause that the underlying security controls remain firmly in place. That means that contractors should not be complacent or assume enforcement is no longer active (it is). And companies throughout the supply chain should not pause plans for becoming compliant with NIST SP 800-171 (which has been, and continues to be, the subject of Department of Justice (DOJ) investigations). 

What Should Contractors Expect?

With respect to third-party assessments under CMMC, the CIO’s eventual announcement can take one of three paths:

1. The continuation of third-party assessments as originally required (with a delay);
2. Limitation of third-party assessments to certain types of Controlled Unclassified Information (or a phase-in period depending on the type of information); or
3. Elimination of third-party assessments.

The third path could be the most challenging for the Department because rulemaking rescinding that requirement would have to overcome 10 years of rulemaking that had justified third-party assessments.

There are also other possible outcomes. During the pause, the CIO released a Request for Information regarding the controls in 800-171 and which ones were the most difficult to implement. The CIO has also emphasized the protection of Operational Technology in the months since. It is possible new or changed underlying security requirements emerge after the pause and, if that is the case, like with the change to third-party assessments, rulemaking would be required. Also, changes by the Department of Defense/War would again make security controls inconsistent across the government and cause additional compliance complications to contractors that support the Pentagon and other executive branch agencies.

Practical Information for Contractors

No matter what happens with the CMMC Phase 2 pause, compliance with the security controls in a contractor’s prime contract or subcontract is still required and contractors would be wise to continue to work toward full compliance (or maintain compliance if fully compliant). 

Also, large prime contractors may still require third-party assessments (even in the absence of a Pentagon requirement). Because of that, companies in the defense supply chain should monitor requirements from prime contractors irrespective of guidance from the Pentagon.