DOW Suspends CMMC Phase II Requirements

The U.S. Department of War (DOW) issued two memoranda on July 13, 2026, announcing the immediate suspension of Phase II of the Cybersecurity Maturity Model Certification (CMMC) program. Phase II, originally scheduled to take effect on November 10, 2026, would have required contractors handling Controlled Unclassified Information (CUI) to obtain independent third-party assessments from CMMC Third Party Assessor Organizations (C3PAOs) as a condition of contract award.

The first memorandum – "Removing Barriers to Defense Industrial Base Expansion" (CIO Memo), issued by DOW's chief information officer (CIO) – directed the suspension and established the CMMC Reform Task Force. The CIO Memo characterized the current CMMC program as imposing "significant and often prohibitive burdens" on defense contractors, "especially small businesses and non-traditional contractors."

The second memorandum – "Implementing Department of War Chief Information Officer's Suspension of the Advancement to Cybersecurity Maturation Model Certification Phase 2 Requirements" (Implementation Memo), issued by DOW's Under Secretary of Defense for Acquisition and Sustainment – provided implementation guidance to contracting officers on how to handle active solicitations and existing contracts.

DOW framed the suspension as consistent with Secretary of War Pete Hegseth's Acquisition Transformation Strategy and Executive Order (EO) 14265, "Modernizing Defense Acquisitions and Spurring Innovation in the Defense Industrial Base" (signed April 2025), which prioritize speed to capability and lower barriers to entry for the defense industrial base. Some civilian agencies, including the U.S. Small Business Administration (SBA), have issued a supporting statement, citing compliance costs affecting more than 100,000 small businesses, with individual compliance costs approaching $600,000.

The full DOW press release is also available online.

What Remains in Effect

The suspension is narrowly scoped to CMMC Phase II's third-party and government-led assessment mandates. Contractors should not misinterpret this announcement as a relaxation of existing cybersecurity obligations. The following requirements remain in full force:

• Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting). All existing contract clauses remain operative, including the 72-hour cyber incident reporting requirement.
• Federal Acquisition Regulation (FAR) 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems). Applicable to all contractors handling Federal Contract Information (FCI).
• National Institute of Standards and Technology Special Publication (NIST SP) 800-171 Rev 2 Compliance. Contractors must continue to implement the 110 security controls and maintain documentation (System Security Plans, Plans of Action and Milestones).
• Supplier Performance Risk System (SPRS) Score Submissions. Self-assessment scores must continue to be posted and maintained in the Supplier Performance Risk System.
• Annual Affirmations. Senior officials must continue to certify compliance annually. These affirmations remain the primary government enforcement mechanism.
• Phase I CMMC Requirements. DOW Program Managers may still include CMMC Level 1 or Level 2 self-assessment requirements in procurement requests. DOW may also still require a C3PAO assessment as a condition of award at its discretion under Phase I authority.

The CMMC Reform Task Force and Request for Information

The CIO Memo establishes a CMMC Reform Task Force tasked with conducting a "top-to-bottom" 60-day review of the CMMC program. The Task Force's objectives are aligned with EO 14265 and the Acquisition Transformation Strategy, with a particular focus on reducing compliance burdens while maintaining adequate cybersecurity standards for the defense supply chain.

Concurrent with the Task Force's formation, DOW issued a request for information (RFI) seeking industry input on seven key areas:

1. What are the primary cost drivers and compliance burdens associated with CMMC implementation?
2. Which cybersecurity controls are most effective at protecting CUI in practice?
3. Which controls impose the greatest burden relative to limited security improvement?
4. What commercial cybersecurity solutions could DOW accept in lieu of current requirements?
5. How can the self-assessment process be streamlined while remaining meaningful?
6. Do self-assessments improve cybersecurity posture in practice?
7. What policy reforms would reduce barriers for small and non-traditional businesses?

RFI responses are due by 12 p.m. ET on August 14, 2026, and must be submitted by email. Contractors are strongly encouraged to participate in this process, as the Task Force's findings will directly inform whatever program framework replaces or modifies CMMC Phase II.

Impact on Active Solicitations and Contracts

The Implementation Memo provides specific direction to contracting officers regarding existing procurements and contracts:

• Active Solicitations. Solicitations containing Level 2 (C3PAO assessment) or Level 3 requirements will be amended to remove those requirements "as soon as possible."
• Existing Contracts. Contracting officers are directed to issue modifications removing suspended requirements prior to the next option period or next scheduled administrative modification.
• Interim Period. Contractors on existing contracts containing CMMC requirements beyond Phase I will need to continue meeting those requirements until formal modifications are issued. The timeline for modifications may vary by contracting office.
• No Waivers. No waivers will be granted under the CMMC Program during the review period.

Notably, contractors should not unilaterally cease compliance activities on existing contracts merely because the Phase II deadline has been suspended. Until a formal contract modification removes the requirement, the existing contractual terms remain binding. Contractors should document the status of any pending C3PAO engagements and preserve the ability to resume assessment timelines if the program is reinstated in modified form.

Compliance Risk Considerations

Counterintuitively, the suspension of third-party assessments increases – rather than decreases – compliance risk in the defense industrial base, including potential liability under the False Claims Act (FCA).

Under the now-suspended Phase II framework, a C3PAO assessment would have provided a documented, third-party record of a contractor's compliance posture. With self-assessment and annual affirmation as the primary compliance mechanism, the evidentiary burden and legal risk returns to the contractor and senior executive who sign the affirmation. Each contractor must be familiar with the applicable cybersecurity requirements and accurately assess its implementation and compliance with these requirements. 

The FCA Legal Framework

• Annual affirmations submitted to SPRS are certifications made directly to the federal government.
• Under 31 U.S.C. Section 3729, a false certification – including one made with "reckless disregard" for its truth or falsity – can trigger treble damages and per-claim penalties.
• The FCA's "knowingly" standard is deliberately broad: It reaches actual knowledge, deliberate ignorance and reckless disregard of the truth.
• Qui tam provisions allow whistleblowers (including current and former employees) to bring suits and share in any recovery.

Recent Enforcement Activity

The U.S. Department of Justice's (DOJ) Civil Cyber-Fraud Initiative, launched in 2021, has made cybersecurity self-certifications a recurring enforcement target. Recent enforcement actions demonstrate the government's commitment to this space, including a $4.6 million settlement for submitting inflated SPRS scores and a separate $875,000 settlement for failure to implement required cybersecurity controls and submission of false assessment scores.

Overall FCA settlements and judgments exceeded $6.8 billion in fiscal year (FY) 2025. Senior executives signing annual affirmations should treat these certifications with the same rigor and legal significance as financial certifications under the Sarbanes-Oxley Act.

The FAR CUI Proposed Rule: The Broader Regulatory Landscape

Contractors focused exclusively on the CMMC suspension should also be aware of a potentially broader development.

On June 23, 2026, the FAR Council updated its proposed rule to expand safeguarding and incident reporting requirements to all CUI handled under all federal contracts – not just those issued by DOW. If implemented as drafted, the FAR CUI rule would apply NIST SP 800-171-derived requirements to the entire federal contracting ecosystem. For companies operating across multiple federal agencies, any narrowing of CMMC scope for DOW purposes may not offer meaningful relief if the FAR CUI rule imposes comparable obligations government-wide.

Contractors should track both regulatory threads and assess their combined impact on compliance programs and resource allocation.

Valuation and Integration Planning for Mergers and Acquisitions Activity

The CMMC Phase II suspension may have additional implications for mergers, acquisitions and private equity investments involving defense contractors and their supply chains.

For example, the suspension introduces uncertainty into cybersecurity cost modeling for defense-sector transactions. Though the deferral of C3PAO assessment costs (approximately $105,000 per assessment, per DOW estimates) offers near-term savings, the underlying NIST SP 800-171 remediation costs – $148,200 for small businesses and $543,400 for other-than-small businesses in the initial year – remain unchanged.

Buyers should model multiple scenarios: 1) CMMC Phase II returns substantially as designed, 2) a revised framework imposes different but potentially comparable requirements, or 3) the FAR CUI rule effectively extends similar obligations government-wide. Post-acquisition integration plans should account for the possibility that cybersecurity compliance requirements may shift materially within 12 to 18 months.

Further, transaction agreements involving defense contractors should consider addressing the current regulatory uncertainty explicitly. Sellers' representations regarding CMMC compliance should distinguish between the suspended Phase II requirements and the continuing Phase I obligations, DFARS 252.204-7012 compliance and NIST SP 800-171 self-assessment accuracy.

Finally, with third-party C3PAO verification paused, buyers and investors in defense sector transactions may have less independent assurance of a target's cybersecurity compliance, heightening the importance of engaging in detailed technical and legal due diligence to verify SPRS scores and assess FCA exposure before closing.

Intellectual Property and Technical Data Considerations

DOW has framed CMMC as a direct response to the theft of intellectual property and sensitive information from the defense industrial base, citing estimates that malicious cyber activity costs the U.S. economy tens of billions of dollars annually and warning that the aggregate loss of IP and unclassified technical information from the DOW supply chain erodes U.S. technical advantage. CUI includes categories directly tied to intellectual property such as Unclassified Controlled Technical Information, proprietary business information and export-controlled data. With mandatory third-party C3PAO assessments paused, C3PAO assessment grant assistance in the FY 2027 National Defense Authorization Act may be removed, and the DOW will be without a mechanism for catching gaps in technical data handling, access controls and CUI marking practices before they result in a breach or disclosure.

Controlled technical data frequently qualifies as both CUI and export-controlled information under the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR). Industry reporting indicates that CMMC third-party assessments have been surfacing previously unknown ITAR and EAR violations, meaning the C3PAO layer had been functioning as an informal check on export control compliance in addition to cybersecurity. Contractors handling export-controlled technical data should not assume that suspension of the C3PAO requirement reduces their export control exposure; if anything, it removes an assessment process that had been identifying compliance gaps before they escalated into U.S. Department of State or U.S. Department of Commerce enforcement matters.

Contractors should continue treating technical data rights markings, government data rights representations and export control compliance with the same rigor previously applied in anticipation of a C3PAO assessment, and continue C3PAO assessments already underway. Companies engaged in transactions involving defense-sector targets should extend cybersecurity due diligence to confirm that technical data handling and export control compliance have been independently validated – not merely self-reported – consistent with the broader diligence recommendations discussed above.

Practical Recommendations for Contractors

The following steps for clients in the defense industrial base are recommended:

• Do Not Halt Cybersecurity Compliance. The underlying NIST SP 800-171 Rev 2 requirements remain in effect, SPRS scores must be maintained and the suspension does not eliminate the risk of a government-led assessment under CMMC Phase I discretionary authority. Pausing or slowing compliance activities may create gaps that will be difficult and expensive to close later.
• Audit Your Current SPRS Score and Annual Affirmation Accuracy. With self-assessment as the primary enforcement mechanism, the accuracy of your posted score and the integrity of your senior official's affirmation carry heightened legal significance. Ensure your score reflects your actual implementation status – not an aspirational or outdated figure.
• Evaluate C3PAO Engagement Status. If you have a pending or scheduled C3PAO assessment, assess whether to pause, defer or continue. Consider that 1) you may still need the assessment if Phase II returns in any form, 2) a successful C3PAO assessment provides a defensible record against FCA claims and 3) existing contractual requirements are not automatically relieved until formal modification.
• Participate in the RFI. The August 14 deadline is short. Organizations with specific cost data, compliance challenges or constructive reform proposals should submit comments. Industry input will shape whatever program replaces Phase II.
• Assess Subcontractor and Supply Chain Impact. Prime contractors with CMMC flow-down provisions in subcontracts should evaluate whether those provisions remain enforceable, necessary or appropriate pending the outcome of the Task Force review. Communicate clearly with subcontractors about continuing obligations.
• Review FCA Exposure with Counsel. Executives signing annual affirmations should consult with legal counsel to understand their personal and organizational exposure. Consider implementing internal certification processes that document the basis for affirmations.
• Monitor the FAR CUI Proposed Rule. If your company handles CUI for non-DOW federal agencies, the proposed FAR rule may impose similar obligations regardless of CMMC changes. Track both regulatory tracks in your compliance planning.
• Preserve Documentation. Maintain records of your current compliance posture, remediation efforts, Plan of Action and Milestones items, and all communications regarding CMMC status. This documentation may be critical in any future FCA dispute or reinstatement scenario.

Holland & Knight Can Help

Please do not hesitate to contact the authors or your regular Holland & Knight Government Contracts Group contact for assistance navigating the CMMC Phase II suspension, preparing RFI comments or assessing your organization's compliance and FCA exposure. Our team is available to help tailor this guidance to your specific contracts, subcontractor relationships and transaction needs.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.