The Department of War has suspended the rollout of CMMC Phase II while a newly established Reform Task Force reviews the program. Contractors now have a limited opportunity to influence the future of CMMC before recommendations are finalized.
CMMC Is Paused, But Cybersecurity Requirements Are Not
Just months before CMMC Level 2 requirements were scheduled to take effect, the Department of War announced the immediate suspension of Phase II implementation and established a CMMC Reform Task Force to conduct a 60-day review of the program. Existing Phase I self-assessment requirements remain in place while the Department evaluates how to reduce compliance burdens and improve implementation across the Defense Industrial Base (DIB).
For many contractors, the announcement brings temporary relief, but it also creates uncertainty.
Companies have already invested significant time, money, and resources preparing for third-party certification. Others have delayed pursuing contracts while attempting to understand evolving compliance requirements. Now, with another major shift in policy, contractors have an opportunity to help shape what comes next.
Why This Matters
The Department has issued a Request for Information (RFI) seeking direct feedback from industry to support the CMMC Reform Task Force’s recommendations.
This is more than a routine comment period.
It is an opportunity for defense contractors to explain what has worked, what has not, and what changes are needed to create a cybersecurity program that protects sensitive information without placing unnecessary burdens on small and mid-sized businesses.
Another Change May Be Coming
At the same time, the Department’s 2026 Unified Regulatory Agenda indicates an intent to update CMMC from NIST SP 800-171 Revision 2 to Revision 3.
That means many organizations that have already aligned their compliance efforts with Revision 2 could soon face additional implementation challenges if the underlying cybersecurity requirements change.
For contractors already navigating compliance, this adds another layer of complexity, and another reason to ensure policymakers understand the practical impacts these changes have on industry.
Questions Contractors Should Be Asking
If your company has been working toward CMMC Level 2 compliance, consider documenting experiences such as:
- Which CMMC requirements have been the most expensive or difficult to implement?
- What has your organization spent on third-party assessments or consulting?
- How has the repeated start-and-stop approach affected business planning and contract opportunities?
- How much time and internal labor have already been devoted to CMMC readiness?
- Which requirements create unnecessary administrative burden without improving cybersecurity?
Real-world feedback is exactly what the Department has requested.
GCP Wants to Hear From You
GCP is gathering feedback from contractors across the Defense Industrial Base to better understand the challenges organizations have experienced throughout the CMMC process.
Whether you plan to submit your own comments or would like your concerns considered as part of GCP’s broader industry response, we encourage you to reach out.
Responses to the Department’s Request for Information are due August 14, 2026.
For assistance or to discuss your experience, contact:
David Mullis
David.Mullis@govcontractpros.com
Stay connected with GCP for additional webinars, regulatory updates, and practical guidance as the future of CMMC continues to evolve.
Resources
- Department of War Press Release
- CMMC Program Updates (DoW CIO)
- Request for Information (SAM.gov)
- 2026 Unified Regulatory Agenda
- NIST SP 800-171 Revision 2
- NIST SP 800-171 Revision 3
