# Defense Contractors Continue CMMC Preparation

A Redspin survey of 131 defense industrial base contractors found that 47% are continuing cybersecurity and CMMC preparation despite the U.S. Department of War’s July pause of CMMC Phase 2, which had been scheduled to take effect in November 2026. The pause changes the expected implementation timing, but the survey indicates that many contractors still see business value in maintaining readiness for DFARS 252.204-7012 and NIST SP 800-171 and pursuing CMMC Level 2 validation.

- Contractors can use the pause to assess their CMMC preparation plans while preserving readiness for existing DFARS and NIST obligations.
- The survey points to uneven cybersecurity spending across the supplier base, which may affect prime contractors’ assessments of subcontractor readiness.
- Organizations pursuing Level 2 validation should account for the paused Phase 2 schedule and use revised implementation guidance when available to inform timing and investment decisions.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 13, 2026

### Government Entities
- U.S. Department of War (DoW)

### Sources
- [Almost Half of Defense Contractors Pressing Ahead With CMMC Despite Phase 2 Pause | Corporate Compliance Insights](https://www.corporatecomplianceinsights.com/news-roundup-october-13-2026) - Corporate Compliance Insights