US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors

The DoD has suspended CMMC Phase II requirements originally due in November 2026 and will create a CMMC Reform Task Force to conduct a 60-day review aimed at reducing compliance costs and bureaucratic burdens while aligning cybersecurity requirements with acquisition transformation goals; meanwhile, enforcement will rely on NIST SP 800-171 self-assessments and select government-led assessments. Experts warn contractors should continue preparing for compliance despite the pause, viewing it as temporary breathing room rather than a relaxation of standards.