Key Points The suspension is real, but temporary: DoD has paused CMMC phase two third-party assessment requirements and launched a 60-day review, but phase one self-assessment requirements remain in effect. Phase two uncertainty doesn't mean zero obligation: Suppliers handling controlled unclassified information still need to meet NIST SP 800-171 standards, regardless of what happens to third-party audit timelines. Small businesses are the stated driver: DoD CIO Kirsten Davies cited compliance costs, assessment capacity shortages, and regulatory complexity as active barriers pushing suppliers out of the defense industrial base. The program will be restructured, not eliminated: The review is explicitly tasked with finding a replacement framework, so suppliers who stop preparing now will be behind when the new requirements land. Use this window deliberately: The 60-day review period is time to close gaps in documentation, cybersecurity hygiene, and internal controls, not time to stand down. DoD Just Hit Pause on CMMC Phase Two The Cybersecurity Maturity Model Certification (CMMC) program hit another inflection point on July 13, 2026. According to Federal News Network , DoD Chief Information Officer Kirsten Davies signed a memo suspending phase two of the CMMC rollout, which would have required third-party assessments across all contracts involving sensitive but unclassified information starting November 10, 2026.