The stated goal of the Cybersecurity Maturity Model Certification program is to strengthen suppliers’ data security. To do this, the CMMC program creates a framework for them to show they adequately protect sensitive information under Department of War contracts. See our posts in our sister blog here and here for additional background. The framework requires implementation of cybersecurity controls at various levels (Levels 1-3) depending on the sensitivity of information, and to undergo related assessments and provide affirmations regarding compliance.
On July 13, 2026, the DoW dropped a major announcement regarding the CMMC program, stating the immediate suspension of CMMC Phase II requirements. These were originally scheduled to be effective November 10, 2026. It also suspended all pending and future CMMC implementation milestones across DoW solicitations/contracts.The department also announced it will perform a 60-day review of the program and published a Request for Information (“RFI”) seeking feedback from companies. All responses to the RFI are due by 12pm ET on Friday, August 14, 2026. Responses will be accepted via electronic means only to: whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.
The suspension currently impacts only Phase II, which incorporates the Level 2 third-party assessment requirement in applicable solicitations/contracts as a condition of award. The suspension has no effect on CMMC Phase I, which has been in effect since November 10, 2025. Phase I incorporates Level 1 and Level 2 self-assessment requirements in applicable solicitations/contracts as a condition of award.
Putting It Into Practice: This is a major announcement that very likely means that CMMC as we know it will be changing. Companies should continue to treat contractual requirements (including CMMC self assessment) and baseline cybersecurity obligations as fully in force. It is also worth considering a submission in response to the RFI. Sheppard is closely following the CMMC suspension and related developments and will continue to provide updates as they become available.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
