Tag: cmmc 2.0 update

The Department of Defense has suspended the planned rollout of CMMC Phase II, which was set to begin on November 10, 2026, while it conducts a broader review of the program.

Does that mean cybersecurity requirements have gone away? No.

Organizations handling Controlled Unclassified Information (CUI) are still on the hook for existing DFARS safeguarding requirements and NIST SP 800-171 obligations where applicable. Phase I self-assessment requirements also remain fully in effect.

If your organization has been waiting to improve its cybersecurity posture until “CMMC comes back” you’re solving the wrong problem. The goal was never to pass an audit it’s to protect your business and stay eligible to win and retain Department of Defense contracts.

Is CMMC Cancelled?

No. CMMC has not been cancelled.

The Department paused the rollout of Phase II specifically the expansion of mandatory Level 2 third-party (C3PAO) certifications while a review is underway. The underlying cybersecurity framework and contractual security obligations remain firmly in place.

What Exactly Was Delayed?

The pause affects:

• The November 10, 2026 Phase II implementation milestone
• The expansion of mandatory third-party Level 2 assessments
• Future implementation milestones while the review continues

The Department has also stood up a 60-day CMMC Reform Task Force to evaluate the program and recommend changes.

What Did Not Change?

This is the most important question and the one contractors most often get wrong.

These requirements are still very much active:

• ✔ DFARS cybersecurity obligations
• ✔ Protection of Controlled Unclassified Information (CUI)
• ✔ NIST SP 800-171 security controls
• ✔ Existing Phase I self-assessment requirements
• ✔ SPRS reporting requirements where applicable

None of these obligations disappeared just because Phase II was paused.

Why Did the DoD Pause Phase II?

According to the Department, the review is intended to:

• Reduce unnecessary compliance burden
• Improve acquisition speed
• Lower barriers for small and non-traditional contractors
• Focus on scalable cybersecurity rather than excessive bureaucracy

In other words, the Department is reviewing how organizations prove cybersecurity
Not whether cybersecurity matters.

The Bigger Question Nobody Is Asking

Most of the coverage on this topic is stuck on one question: “When will CMMC come back?”

The better question is: “Why were we preparing in the first place?”

If your answer is “because we needed to pass an audit,” you’re thinking about CMMC backwards.

Organizations don’t take million-dollar hits because they failed an audit. They take those hits because they experienced:

• Ransomware
• Intellectual property theft
• Supply chain compromise
• Business interruption
• Contract risk
• Reputational damage

CMMC was never about creating paperwork. It exists because those threats are real, and certification became the mechanism to verify organizations were actually taking security seriously. That distinction matters — and it should shape how you approach the next several months.

What This Means for Defense Contractors

If you’re already preparing: keep going. Nothing about the pause reduces your existing DFARS or NIST SP 800-171 obligations.

If you’ve been waiting: start now. This pause is not a green light to deprioritize security.

If you delayed cybersecurity hoping the rules would change: this is actually your best opportunity. You now have breathing room to strengthen your security program without the pressure of an imminent third-party assessment deadline.

Organizations that use this window wisely will be in a far stronger position when revised certification requirements return and they will avoid the scramble that so many contractors went through the first time compliance deadlines were announced.

What Cyber Command Recommends

At Cyber Command, we don’t believe organizations should build cybersecurity programs just to satisfy an audit.
We believe organizations should build resilient security programs because:

• Cyber attacks don’t wait for regulatory deadlines.
• Contract requirements continue to evolve.
• Strong security reduces operational risk regardless of certification timing.
• Companies that invest steadily avoid expensive, last-minute compliance projects.

Whether the next version of CMMC arrives in six months or eighteen, those investments keep paying off.

Not sure where your organization stands on NIST SP 800-171 or DFARS compliance? Cyber Command helps defense contractors assess their current posture, close gaps, and build a security program that holds up regardless of what happens with CMMC’s timeline. Contact us to talk through where you stand today.

Where to Verify This Information

We’d rather you check the primary sources than take our word for it:

• Department of Defense / CIO – Cybersecurity Maturity Model Certification (CMMC): dodcio.defense.gov/CMMC
• NIST Special Publication 800-171: csrc.nist.gov/publications/detail/sp/800-171/rev-3/final
• Defense Acquisition & Sustainment guidance: acq.osd.mil
• Official announcement on the Phase II suspension and review: war.gov release

Area of Inquiry	What to Ask	Why It Matters
Backup architecture	Do you provide tested, immutable, and offsite backups, and how often do you verify full restoration?	Modern ransomware often targets backup files and management consoles. Recovery depends on copies the attacker cannot alter or reach.
Recovery expectations	What systems come back first, how long should recovery take, and what business functions stay down during that window?	Leaders need realistic recovery priorities, not vague promises.
Monitoring model	Who reviews alerts after hours, and what actions can your team take without waiting for the next business day?	Ransomware activity often starts nights and weekends. Delay increases damage.
Containment capability	What do you do in the first 15 minutes if a device starts encrypting files or a user account shows suspicious behavior?	Fast isolation can limit spread across servers, cloud storage, and shared drives.
Access security	How do you enforce MFA, least privilege, separate admin accounts, and review of stale access?	Identity abuse remains one of the most common paths into ransomware events.
Patch management	How do you handle critical vulnerabilities on firewalls, servers, endpoints, and line-of-business applications?	Attackers regularly use known weaknesses that stayed open too long.
Incident leadership	Who coordinates the response, updates leadership, works with legal counsel, and preserves evidence?	Good tools help. Clear command during a crisis prevents confusion and bad decisions.
Compliance support	How do you support HIPAA, financial data protection requirements, and breach reporting decisions in Florida?	Regulated firms need security work that lines up with legal obligations and documentation needs.
Reporting cadence	What does leadership receive each month, and will someone explain risk changes in plain language?	Owners and executives need clear visibility to make funding and policy decisions.

Listen for direct answers. A capable partner should be able to explain backup isolation, testing frequency, response authority, and recovery trade-offs without hiding behind jargon.

If answers stay high level, assume the service is general IT support with a security label attached. That model can handle help desk work. It usually does not hold up well during a ransomware event.

The right fit for an Orlando business is a provider that can show how prevention, monitoring, access control, and recovery work together. Tested, immutable, and offsite backups should be part of that conversation from the first meeting, because they are often the difference between a controlled outage and a prolonged business shutdown.

If your business in Orlando, Winter Springs, or the broader Central Florida market needs a practical ransomware defense strategy, Cyber Command, LLC can help you assess backup resilience, tighten access controls, improve active monitoring, and build an incident response process that matches how your organization operates.