# DoD Pauses CMMC Phase 2 Rollout

The Department of Defense paused Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) rollout on July 13 for a 60-day review. The pause does not suspend existing cybersecurity obligations: contractors handling covered information should continue implementing and validating NIST SP 800-171 Rev. 2 controls and keeping their Supplier Performance Risk System (SPRS) self-assessments accurate. Because prime contractors may set supplier deadlines that differ from the federal rollout schedule, subcontractors should confirm applicable requirements directly with their primes.

- Contractors handling covered information remain responsible for their existing cybersecurity obligations despite the rollout pause.
- Companies should continue validating NIST SP 800-171 Rev. 2 controls and maintaining accurate SPRS self-assessments.
- Suppliers should confirm deadlines and requirements with their prime contractors rather than assume the federal rollout schedule determines their timeline.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 13, 2026

### Government Entities
- Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- L3 Harris (prime contractor)

### Sources
- [For Cybersecurity Certification, a Pause Is Not a Pass :: I-Connect007](https://iconnect007.com/article/151956/for-cybersecurity-certification-a-pause-is-not-a-pass/151953/milaero) - I-Connect007