DOD halts cybersecurity requirements for CMMC Phase 2

Phase 2 — the third-party C3PAO assessment requirement due November 10, 2026 — is suspended pending a 60-day reform task force, and officials left open that the program could be cancelled outright. Phase 1 self-assessments and DFARS 252.204-7012 still apply, and the task force reports to the CIO around mid-September, so this one has a near-term follow-up date.

Read the article
DefenseScoop — Brandi Vincent and Mikayla Easley, July 13, 2026