# DoD Pauses Part of CMMC Level 2 Rollout

In July 2026, the Department of Defense paused part of the Cybersecurity Maturity Model Certification (CMMC) rollout schedule. CMMC Level 2 applies to defense contractors handling Controlled Unclassified Information and is based on 110 requirements from NIST SP 800-171 Revision 2. The schedule change means contractors should confirm current DoD guidance and the requirements in each relevant contract before committing to a formal assessment by a Certified Third-Party Assessment Organization (C3PAO). A-LIGN, Coalfire, and Lazarus Alliance are identified as providers to compare, but their current authorization and assessment scope require confirmation.

- Contractors handling CUI should use their specific contract and current DoD guidance to determine whether and when a formal Level 2 assessment is required; the signal does not specify a new deadline.
- Companies evaluating assessment support can compare A-LIGN, Coalfire, and Lazarus Alliance, while verifying each provider’s current authorization and the scope of services offered.
- The pause affects planning for assessment readiness and related cybersecurity services, but the signal identifies no contract award, funding amount, or solicitation.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 28, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- A-LIGN (CMMC C3PAO assessment provider)
- Coalfire (CMMC assessment and readiness services provider)
- Lazarus Alliance (CMMC C3PAO assessment provider)

### Sources
- [CMMC Level 2 Requirements and C3PAO Guide (2027) - Technology Org](https://www.technology.org/2026/10/28/cmmc-level-2-c3pao-guide) - Technology Org