CMMC Phase II is Paused. Your Cybersecurity Obligation is Not.

The Department of War’s decision to suspend Phase II of the Cybersecurity Maturity Model Certification program has brought both relief and uncertainty to the Defense Industrial Base (DIB).

Phase II was expected to expand third-party assessments for contractors handling Controlled Unclassified Information, or CUI. Instead, the DoW has paused Phase II and later implementation milestones while it reviews the program’s cost, complexity and ability to scale across the defense supply chain.

The pause may change when and how contractors are assessed. It does not remove their responsibility to protect sensitive government information or meet existing contractual obligations. Download our viewpoint to learn more about what this pause means.