# DoD Reassesses CMMC Implementation

A DoD CMMC task-force review outlines near- and longer-term options for addressing the program’s pause, including restarting Phase 2 for a narrower contractor population within 90 days, improving Controlled Unclassified Information marking and assessment guidance, and considering NIST SP 800-171 Revision 3. The review does not remove contractors’ existing 800-171 obligations; it leaves implementation details uncertain while potential rulemaking, including a possible 270-day Plan of Action and Milestones period, remains under consideration.

- Contractors should continue meeting applicable NIST SP 800-171 obligations during the CMMC pause and document cybersecurity controls and associated costs.
- A narrower Phase 2 restart could affect which contractors need assessments first; firms in the defense supply chain should evaluate how the proposed scope could affect their readiness.
- Procurement teams and industry stakeholders should account for uncertainty around assessment guidance, possible adoption of Revision 3, and potential POA&M changes when planning compliance support and contract costs.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 27, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Key Quotes
> Pausing CMMC without notice has been difficult. If the department wants third-party certifiers in the future, they will have a hard time to gin up capacity to do that.
> — Eric Crusius, partner at Hunton

### Sources
- [
        RFI offers path forward for DoD with CMMC - Federal News Network](https://federalnewsnetwork.com/defense-news/2026/10/rfi-offers-path-forward-for-dod-with-cmmc) - Federal News Network