The Pentagon has suspended the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements, originally scheduled for November, to review the program. This decision aims to facilitate contracting for small businesses while maintaining existing cybersecurity standards for contractors handling government information.
The Pentagon has announced the suspension of Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements, which were slated to begin in November. This pause is part of a 60-day review aimed at reassessing the entire cybersecurity certification process for contractors.
Kirsten Davies, CIO at the Department of War, indicated that the suspension is intended to eliminate bureaucratic hurdles while ensuring that contractors continue to adhere to Phase 1 requirements and existing regulations for government data handling. This move is particularly focused on supporting small and non-traditional businesses in the defense sector.
While CMMC Phase 2 has been suspended, contractors must still comply with Phase 1 requirements, which necessitate self-assessments for specific cybersecurity standards. The decision underscores the importance of maintaining robust cybersecurity practices while addressing concerns over compliance costs that may inhibit smaller firms from participating in defense contracts.
The new CMMC review task force will gather industry feedback to propose revised security measures, aiming to facilitate entry for smaller companies. Phase 2 would have introduced third-party certifications for Level 2 by November 2026, but officials noted a shortage of approved assessors for these evaluations.
The Pentagon's strategic pause aims to revitalize the defense industrial base without compromising cybersecurity standards. Undersecretary of War for Acquisition and Sustainment Michael Duffey emphasized the need to keep smaller manufacturers engaged in defense work, while robust cybersecurity measures remain a top priority.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The Pentagon has suspended the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements, originally scheduled for November, to review the program. This decision aims to facilitate contracting for small businesses while maintaining existing cybersecurity standards for contractors handling government information.