# DoW Pauses CMMC Phase 2, Retains Obligations

The Department of War has paused CMMC Phase 2, but defense contractors remain subject to applicable cybersecurity obligations already in effect. A proposed FAR rule could extend comparable protections for controlled unclassified information (CUI) across civilian and defense agencies. Contractors and software providers should continue meeting current applicable requirements while preparing for potential NIST SP 800-171 Revision 3 controls, 72-hour incident reporting, subcontractor flowdowns, and cloud security requirements equivalent to FedRAMP Moderate.

- The pause does not suspend existing contractor obligations; companies should continue applying the requirements that currently govern their contracts.
- The proposed FAR rule could broaden CUI safeguards beyond defense procurement, creating potential impacts for civilian-agency contractors as well.
- Contractors and software providers can prepare for the potential controls and reporting, flowdown, and cloud-security provisions identified in the signal without treating proposed changes as already in force.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 27, 2026

### Government Entities
- U.S. Department of War (DoW)
- Federal Acquisition Regulatory Council (FAR Council)
- National Institute of Standards and Technology (NIST)
- Cybersecurity and Infrastructure Security Agency (CISA)

### Sources
- [The CMMC deadline paused, but the obligations didn’t](https://www.devprojournal.com/technology-trends/security/the-cmmc-deadline-paused-but-the-obligations-didnt) - DevPro Journal