The Pentagon has suspended phase two of its Cybersecurity Maturity Model Certification (CMMC) program, which was due to take effect in November 2026, initiating a 60-day review of the entire framework. Officials cited a shortage of approved third-party assessors and concerns that compliance costs could push smaller manufacturers out of defense contracting as key reasons for the pause. A newly formed task force will gather industry feedback and propose streamlined security measures, while contractors must still meet existing phase one requirements and baseline cybersecurity standards.
