The Pentagon has suspended the next phase of the Cybersecurity Maturity Model Certification (CMMC) program and is inviting small businesses to provide information on the cost and burdens of the program.
The CMMC program’s goal is to verify that contractors with the Department of Defense (DoD) are fulfilling their obligations to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) by meeting standardized cybersecurity requirements. These requirements vary depending on the type and sensitivity of the information. The program has three tiers with escalating security requirements.
On July 13, the Department announced it was immediately suspending Phase II of the program, which had been set to take effect Nov. 10, 2026, and would have required many contractors handling sensitive but unclassified information to obtain third-party cybersecurity assessments. The Department said that the move is meant to reduce compliance barriers for small and midsized defense contractors, citing a bottleneck of more than 100,000 companies needing assessment against only about 100 accredited third-party assessors, as well as compliance costs the SBA estimated could reach roughly $593,800 per certification. Phase I self-assessment requirements remain in effect during the suspension.
To guide the review, the Department has launched a CMMC Reform Task Force and issued a public Request for Information (RFI) seeking industry feedback on the program’s cost drivers, administrative burdens, and which security controls actually deliver meaningful protection versus paperwork. The RFI specifically asks companies to identify their top five most burdensome compliance costs and to weigh in on using existing commercial cybersecurity tools, expanding self-attestation, and other ways to streamline requirements.
Responses to the RFI due by noon Eastern on Aug. 14. The Task Force is expected to deliver recommendations to the department’s CIO within 60 days of the suspension.
Click here for more information on the RFI and how to submit comments.