From The Greentree Group Cybersecurity Team – July 14, 2026 

The Department of War (DoW) has announced the immediate suspension of the planned implementation of CMMC Phase II requirements, which were previously scheduled to take effect on November 10, 2026. The Department has also initiated a 60-day review of the CMMC program to evaluate its future structure and implementation. Phase I self-assessment requirements remain in effect during this review period.  

What Has Not Changed 

Defense contractors and subcontractors remain responsible for protecting Controlled Unclassified Information (CUI) and meeting all applicable cybersecurity requirements.  

Organizations that process, store, or transmit CUI must continue to comply with: 

• DFARS 252.204-7012 safeguarding requirements. 

• NIST SP 800-171 security requirements. 

• Applicable CMMC Phase I self-assessment requirements included in contracts and solicitations.  

• SPRS reporting and affirmation requirements, where applicable. 

What Has Changed 

The Department has suspended the planned transition to Phase II, which would have introduced mandatory third-party CMMC assessments for applicable contracts beginning November 10, 2026. The implementation timeline for Phase II is currently on hold while the Department conducts its review.  

What Contractors Should Do Now 

The Greentree Group recommends that organizations continue pursuing CMMC readiness and cybersecurity maturity efforts: 

• Maintain and improve cybersecurity policies, procedures, and technical controls. 

• Continue implementation of NIST SP 800-171 Rev 2 requirements. 

• Perform and document required self-assessments. 

• Maintain accurate SPRS scores and affirmations. 

• Identify and address outstanding security gaps. 

• Remain prepared for future CMMC updates or revised implementation requirements.  

CMMC Compliance Is Still Required 

Though Phase II has been suspended, the cybersecurity requirements for protecting CUI remain in place. Organizations that continue to strengthen their cybersecurity programs will be better positioned to: 

• Meet current contractual obligations. 

• Reduce cybersecurity and compliance risk. 

• Support future contract opportunities. 

• Quickly adapt to any revised CMMC framework that may result from the Department’s review.  

Bottom Line:  

While the certification deadline has moved, the responsibility to protect CUI has not changed. While the Department reviews the future of the certification program, defense contractors and subcontractors remain responsible for safeguarding CUI and maintaining compliance with existing DFARS and NIST requirements. Continuing CMMC readiness efforts now will help ensure organizations remain protected, compliant, and competitive within the Defense Industrial Base.  

The Greentree Group Cybersecurity Team is available to assist with CMMC readiness assessments, NIST SP 800-171 gap assessments, SPRS reviews, policy development, and compliance strategy discussions. For more info please visit us here. 

 Sources: 

https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/ 

https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf 

https://dodcio.defense.gov/Portals/0/Documents/Library/CMMC-ReformMemo.pdf