DoW pauses CMMC Phase 2 rollout — what we know so far

On July 13, 2026, the Department suspended Phase 2 and froze the remaining implementation milestones pending a task force review. The headline read like a reprieve. Read the memo and it's a change to who verifies your compliance, not whether you have to be compliant.

Phase 2 was scheduled to begin November 10, 2026. It would have made third-party certification by a C3PAO a condition of award for most Level 2 contracts involving controlled unclassified information. Two memoranda issued on July 13 suspended it immediately, stood up a CMMC Reform Task Force to conduct a review, and directed contracting officers on how to unwind the requirement from live procurements.

Phases 3 and 4 are frozen alongside it. What replaces them is genuinely open.

What changed and what didn't

That last point deserves emphasis. The Department did not repeal the CMMC Program rule and did not amend the DFARS. This is a policy pause layered on top of regulation that remains on the books. Requirements are being removed from active solicitations, and from awarded contracts at the next option exercise or scheduled administrative modification — which is to say, not today. Until your contract is actually modified, the clause on it still binds you. Confirm status in writing rather than assuming a requirement has been read out.

Why it happened

Two pressures converged. The first is cost: the Department's own CIO cited Small Business Administration figures suggesting the later phases could run into the billions annually for small and midsize businesses. The second is capacity. Something on the order of a hundred thousand companies would eventually need assessments, against an authorized assessor pool numbering in the low hundreds. The arithmetic never worked, and everyone in the ecosystem knew it.

The Task Force was asked to come back with something more scalable and less burdensome on small and non-traditional suppliers. Industry fed into it through an RFI that closed August 14, with a report expected around mid-September. Officials have not ruled out more dramatic outcomes.

The trap: standing down

The instinct after an announcement like this is to shelve the program and wait for clarity. Three reasons that's the wrong move.

Your legal exposure went up, not down. Removing the third-party assessor removes the only external check on your claim. The affirmation is still required, and it's still your executive signing it.

Your primes don't care about the memo. Flow-down requirements in commercial contracts are contract terms. Many primes have kept their subcontractor security requirements exactly where they were, because their own risk posture didn't change on July 13.

The gap assessment in your files still exists. Documented shortfalls don't disappear because a milestone slipped. If anything, an unremediated finding sitting in a folder for two years reads worse, not better.

What to do in the interim

Keep the substance, relax the calendar. Maintain the 800-171 implementation, keep the SPRS score current, close POA&M items on the schedule you set. What you can reasonably do is stop spending on assessment logistics — scheduling, readiness dry-runs, C3PAO retainers — until the shape of the replacement is known.

And build the record in a form that survives a change of rules. Whatever the Task Force recommends, it will still be about controls implemented, evidence retained, and someone accountable for the claim. A compliance program organized around those three things travels well — and if CMMC sits alongside SOC 2 or ISO 27001 on your plate, multi-framework compliance software is what keeps all of it on one record. A program organized around a specific assessment date does not travel at all.