On July 13, the DOD/DOW announced an immediate suspension of CMMC (Cybersecurity Maturity Model Certification) Phase II implementation, which had been scheduled to take effect on November 10, 2026. Remember that CMMC (including the third party certifications at Levels 2 and 3) was the way DOD/DOW was going to enforce/validate that DOD/DOW awardees were compliant with NIST 800-171.
NOTE 1: ALL NIST 800-171 requirements are still in force. NOTE 2: Do not confuse the “Phase II” language in the CMMC implementation with any SBIR/STTR “Phase II” proposal/award requirements. These two very different programs are unfortunately using the same term to mean two completely different requirements.
The DoD is launching a 60-day review of the CMMC program and creating a CMMC Reform Task Force. The task force will:
-Review industry feedback.
-Evaluate compliance challenges.
-Recommend more scalable and practical cybersecurity requirements.
-Deliver a report to the Department CIO within 60 days.
If your organization was preparing for the CMMC Level 2 certification as the Phase II implementation was going to require, these 3rd party certification requirements are currently on hold. However, you should continue maintaining compliance with existing cybersecurity obligations, including NIST 800-171 controls and contractual data-protection requirements, while the Department reviews and (potentially) redesigns the CMMC program.
The current CMMC Level required for a specific DOD / DOW SBIR/STTR award is determined by the Topic of that award. The required CMMC measures must be implemented prior to any award, meaning awards can be held up without CMMC compliance.
We are proud to partner with Totem Tech on a no-nonsense and affordable solution for CMMC compliance (SBIR CMMC Survival Kit: HRDN-IT),
