Story perspectives

DoD Halts CMMC, Pushes 2026 Deadline, Cuts Levels

7/14/2026

Summary

DoD Halts CMMC

The Department of Defense halted Cybersecurity Maturity Model Certification (CMMC) rollout and opened a 60-day task force to redesign it.
Pause pushes November 2026 transition back and limits contracts to Level 1 and Level 2.
CIO Kristen Davies said market can assess a fraction of the 100,000 contractors.
Michael Duffey warned costs could reach 15 percent of small contractors’ budgets.
Managed service providers and consultants face revenue shortfalls while the memorandum retains NIST 800-171 and DFARS duties.

Summary

Pentagon Suspends CMMC

Pentagon’s Cybersecurity Maturity Model Certification (CMMC) rollout began Nov 2025 with Phase 1 self-assessments and slated Phase 2 third-party assessments for Nov 10 2026 before suspension.
Launched in 2019 by U.S. President Donald Trump’s administration, the program was cut to three levels, renamed CMMC 2.0, and eased third-party audit rules by U.S. President Joe Biden’s administration in 2021.
Arrington’s 2025 exit, Bostjanick’s earlier-this-year retirement, and the new Cyber Accreditation Body working with ISACA signal turnover.

History

Historical Context

The Federal Information Security Management Act of 2002 created federal cybersecurity obligations. After a surge in cyber attacks, Congress passed the Federal Information Security Modernization Act, signed by President Barack Obama on December 18 2014, amending the 2002 law. The 416-0 House vote on the 2013 amendment illustrates the bipartisan push that shapes today’s federal cybersecurity framework.

1 of 3

DoD Halts CMMC

The Department of Defense halted Cybersecurity Maturity Model Certification (CMMC) rollout and opened a 60-day task force to redesign it.
Pause pushes November 2026 transition back and limits contracts to Level 1 and Level 2.
CIO Kristen Davies said market can assess a fraction of the 100,000 contractors.
Michael Duffey warned costs could reach 15 percent of small contractors’ budgets.
Managed service providers and consultants face revenue shortfalls while the memorandum retains NIST 800-171 and DFARS duties.

1 / 3