DoD pauses CMMC Phase II assessments while contractors keep cybersecurity duties

By Atlas Watchline Staff · Regulatory · August 31, 2026

The Defense Department has paused CMMC Phase II third-party assessments while it reviews the program, but existing cybersecurity obligations for contractors remain in place, according to a PR Newswire release and Magna5’s Bill Osborne.

The Department of Defense has paused Cybersecurity Maturity Model Certification Phase II requirements while a reform task force reviews the program, according to a PR Newswire release dated Aug. 31, 2026. The release says the change delays certain third-party assessments, but it does not remove the cybersecurity obligations defense contractors already face.

Contractors working with the Defense Department still must keep their compliance work current. The release says Phase I remains in effect, including self-assessment requirements, and that the department will continue enforcing NIST SP 800-171 Revision 2 through contractor self-assessments and selected government-led assessments.

According to the release, Level 1 self-assessments still cover 15 safeguarding requirements from Federal Acquisition Regulation clause 52.204-21 and are conducted annually. Level 2 self-assessments still measure 110 security requirements in NIST SP 800-171 Rev. 2, are conducted every three years with annual affirmation, and are entered into the Supplier Performance Risk System, or SPRS.

For contracts covered by Defense Federal Acquisition Regulation Supplement clause 252.204-7012, contracting officers must verify a current NIST SP 800-171 DoD Assessment score in SPRS before certain awards, contract extensions or option exercises, the release says. It also says a paused third-party assessment schedule does not make an inaccurate or outdated score irrelevant.

Bill Osborne, vice president of Defense Sector Services at Magna5, is quoted in the release saying contractors should not treat the pause as permission to stop protecting required information. The release says Magna5 is a national managed IT, cybersecurity, cloud and compliance services provider.

The release says companies that are not already scheduled and fully prepared for an assessment may choose to wait while the department reviews the program. It also says contractors should keep scope, evidence and reporting current.

Background in the release points to a broader transition issue for defense contractors. It says DoD continues to use NIST SP 800-171 Rev. 2 for current CMMC obligations, while an upcoming FAR clause could require Rev. 3 for other federal contracts. The release says contractors working across multiple agencies may need to manage both versions at once.

What happens next is tied to the department review. The release says the pause affects the timing of certain third-party assessments, not the underlying requirements for defense contractors. It also says contractors should watch for NIST SP 800-171 Rev. 3 entering future federal contracting requirements.

Sources

• PR Newswire release, Aug. 31, 2026

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.