# DoD Suspends CMMC Phase II Requirement

On July 13, 2026, the Department of Defense suspended the CMMC Phase II requirement after defense contractor HX5 completed a Level 2 assessment. The timing and form of any future requirements remain uncertain as DoD conducts a reform review. The source also reports a limited pool of assessors and waitlists exceeding a year, making the suspension relevant to contractors weighing cybersecurity investments and assessment scheduling.

- **Why this matters:** Contractors should not treat the suspension as a signal to abandon security improvements; the source describes them as an ongoing compliance and business-readiness investment.
- Companies that have not completed an assessment can account for the reported assessor capacity constraints when planning security work, while recognizing that the future requirement and its timeline are uncertain.
- DoD procurement and industry teams should distinguish the current suspension from any future CMMC requirements and base readiness planning on the department’s reform review.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 14, 2026

### Government Entities
- Department of Defense (DoD)

### Vendors
- HX5 (CMMC Level 2 assessment subject; defense and aerospace services contractor)
- Redspin (CMMC assessment firm)

### Sources
- [Margarita Howard's HX5 Passed Its CMMC Audit. Then the Pentagon Suspended the Requirement. - TechBullion](https://techbullion.com/margarita-howards-hx5-passed-its-cmmc-audit-then-the-pentagon-suspended-the-requirement) - TechBullion