Where CMMC stands right now

CMMC third-party assessments are paused. The underlying cybersecurity requirements are not.

On July 13, 2026, the Department of War paused the transition to CMMC Phase 2 and stood up a 60-day Reform Task Force to review the program. During this period, DoW Program Managers cannot write Level 2 (C3PAO) and Level 3 (DIBCAC) assessments into new solicitations as a condition of award, and existing requirements are being stripped at the next option exercise or modification. 

However, as stated in memo 26-P-1023, the Department will continue to enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select government-led assessments.

Here is what still applies to defense contractors and subcontractors:

• DFARS 252.204-7012 safeguarding and 72-hour incident reporting requirements
• NIST SP 800-171 Rev 2, all 110 requirements and 320 assessment objectives, as required under DFARS 7012 since 2017
• Phase 1 CMMC Level 1 (Self) and Level 2 (Self) requirements remain in force, as they have since November 10, 2025
• Primes will still flow down CMMC requirements and ask suppliers for assurance of NIST 800-171 Rev 2 compliance
• A current SPRS score and an annual affirmation from a senior official, both of which carry False Claims Act exposure if they do not match your environment

The work that determines whether you can keep doing defense business is the same work it was on July 12: scope where CUI actually lives, keep NIST 800-171 Rev 2 implemented in the live environment, maintain an SPRS score a senior official can stand behind, and be ready for verification whenever it returns.

Not sure where you stand against the 110 requirements? Our CMMC Level 2 compliance checklist walks through what you need in place now, pause or no pause.

To help you stay current on your CMMC and other cybersecurity contractual obligations, we built the news tracker below. 

Latest CMMC news and updates

Every week we monitor DoW announcements, federal rulemaking dockets, Cyber AB and assessor ecosystem updates, False Claims Act enforcement actions, and congressional activity affecting the Defense Industrial Base (DIB).

Each entry below is a short, dated summary of what changed, with links to primary sources and to the full write-up in our 2026 news log.

August 14, 2026: CMMC reform RFI comment window closes

The Department of War's request for information, "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base," closed at noon Eastern. Five of its seven questions asked about cost and administrative burden. Responses feed the CMMC Reform Task Force, whose report is due to the DoW CIO around early October (15 days after the 60-day program review ends). Read the full entry on the reform RFI.

August 7, 2026: Defense connector maker discloses phishing breach

IEH Corporation, which manufactures hyperboloid connectors used on THAAD, PATRIOT, and AMRAAM platforms, disclosed in an SEC Form 8-K that an attacker compromised an employee's Microsoft 365 mailbox and could access engineering documentation and potentially export-controlled technical information. The company reported no evidence of exfiltration. The incident changes no CMMC policy, but it is a reminder that DFARS 7012 incident reporting obligations did not pause when assessments did. Read the full entry on the IEH disclosure.

July 23, 2026: FAR CUI rule comment period closes

FAR Case 2017-016, the governmentwide CUI and NIST SP 800-171 Rev 3 proposal, closed comments. If finalized it would apply immediately, with no CMMC-style phased on-ramp. Contractors with both defense and civilian work should not read the Phase 2 pause as cover for this rule. Read the full entry on the FAR CUI rule.

July 22, 2026: House passes FY2027 NDAA with CMMC small business language

H.R. 8800 passed 216 to 212 and includes a provision directing a Pentagon briefing on CMMC's impact on small businesses. The Senate companion, S. 4784, stalled after a July 14 procedural vote and would create a CMMC Level 2 assessment grant program capped at $100,000 per award. Conference is expected after Congress returns in September. None of this is law yet. Read the full entry on the FY2027 NDAA.

July 16, 2026: Elbit tells suppliers to keep going during the pause

Most primes did not send new supplier notices in the week after the announcement. Elbit Systems of America did, urging suppliers to keep meeting existing cybersecurity requirements and to confirm the applicable requirement with their Elbit America buyer before scheduling or cancelling a C3PAO assessment. RTX makes a similar point on its supplier cybersecurity page. The pause is a pause in the Department's own designations, not a release from a prime's flowdown. Read the full entry on the prime notices.

July 15, 2026: Cyber AB confirms the assessment ecosystem stays open

The Cyber AB clarified that this was only "another momentary pause" to the rollout of the CMMC program, specifically to Phase 2. C3PAO assessments, training, and exams remain available to organizations that want them. Read the full entry on the Cyber AB statement.

July 13, 2026: DoW puts CMMC Phase 2 on hold and program under review

DoW CIO Kirsten Davies paused the transition to Phase 2, scheduled to take effect November 10, 2026, and put the program under a 60-day review as well. The Department cited cost and assessor capacity, pointing to Small Business Administration figures of roughly $593,800 for third-party certification against about $388,600 for a self-assessment, with more than 120,000 DIB small businesses affected and roughly 100 approved assessors. Two memoranda under public case 26-P-1023 implement the pause. For the full breakdown of what changed and what primes still require, see CMMC Phase 2 on Hold, or read the full entry on the suspension.

July 4, 2026: Rev 3 transition rule appears on the Unified Agenda, still unpublished

The Fall 2025 Unified Agenda listed RIN 0790-AM01 as an interim final rule that would amend 32 CFR Part 170 to move CMMC from NIST SP 800-171 Rev 2 to Rev 3. As of August 14, 2026 it has not appeared in the Federal Register, 32 CFR 170 has not been amended, and no DFARS class deviation has been issued. Rev 2 remains the enforced standard. For why an agenda listing is not a requirement, see what it would take to change CMMC, or read the full entry on RIN 0790-AM01.

June 18, 2026: LOGZONE settles False Claims Act cybersecurity allegations

The Huntsville contractor paid $507,144 to resolve allegations that it billed two Navy contracts from May 2021 to March 2025 without implementing required NIST SP 800-171 controls. LOGZONE had posted a perfect SPRS score of 110; a DCMA DIBCAC assessment scored the same environment at negative 170. The case was government-initiated rather than whistleblower-driven, which is unusual. Read the full entry on the LOGZONE settlement.

What we are watching

• The Reform Task Force report, due to the DoW CIO and USD(A&S) between mid-September and early October 2026. This is the next real beat in the story.
• RIN 0790-AM01 in the Federal Register. Until it publishes, Rev 2 is the standard.
• NDAA conference, expected after Congress returns in September.
• Additional DIB incident disclosures. We add these only when a company filing or government source confirms a covered defense information nexus.