● Covered by 1 source · 2 reportsMedium impact
Pentagon Suspends CMMC Phase 2 Pending Review to Address Contractor Challenges
Key points
- CMMC Phase 2 suspension pauses third-party assessments.
- Phase 1 self-assessments remain mandatory.
- The 60-day review will gather industry feedback.
- Existing cybersecurity requirements still apply.
- A task force will recommend future measures.
Pentagon Suspends CMMC Phase 2
The Pentagon has opted to suspend the implementation of Phase 2 of the Cybersecurity Maturity Model Certification (CMMC). This phase required mandatory third-party assessments, scheduled to begin in November. The decision comes after feedback from industry participants citing high costs and scalability challenges for the assessment process, particularly affecting small and mid-sized firms.
Continuous Compliance Obligations
While the suspension halts the third-party audits, the Department of War stresses that Phase 1 self-assessment obligations and existing regulations remain in effect. Companies handling controlled unclassified information (CUI) are still expected to maintain cybersecurity standards as outlined in previous regulations.
CMMC Reform Task Force to Lead Review
To address the challenges, a newly established CMMC Reform Task Force will conduct a comprehensive review over 60 days. This task force is tasked with gathering industry feedback and providing recommendations to potentially streamline the certification process, making it more accessible, especially for smaller businesses.
Industry's Dual Reactions
The industry's response to CMMC Phase 2's suspension is mixed. While some experts warn about the risks of self-assessment without independent verification, the consensus suggests exploring ways to balance security needs with practical, scalable solutions for compliance. The task force will need to consider these varied perspectives as they reformulate the program.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
The Pentagon has suspended the mandatory third-party assessment requirement for CMMC Phase 2, addressing scalability issues and high compliance costs for small firms. A CMMC Reform Task Force will assess the program over the next 60 days, while existing self-assessment requirements remain in place.
The Pentagon has suspended the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements, originally scheduled for November, to review the program. This decision aims to facilitate contracting for small businesses while maintaining existing cybersecurity standards for contractors handling government information.