The Future of CMMC: A Pause Is Not a Stop

The Future of CMMC: A Pause Is Not a Stop

The future of CMMC is currently under review. In July 2026, the Department suspended the planned transition to CMMC Phase 2 and established the CMMC Reform Task Force to conduct a comprehensive review of the program.

While changes to CMMC may be coming, the underlying cybersecurity obligations have not gone away. Contractors handling Controlled Unclassified Information (CUI) remain responsible for protecting that information in accordance with DFARS 252.204-7012 and NIST SP 800-171, and Phase 1 self-assessment requirements remain in effect.

For organizations in the Defense Industrial Base, the current pause should be viewed as additional preparation time—not a reason to stop preparing. Regardless of how CMMC evolves, strong scoping, accurate self-assessments, properly implemented security requirements, and a defensible cybersecurity program will remain important.

The requirements may change. The need to protect CUI will not.

At Absolute Cyber, we continue to recommend that organizations use this time to understand where they stand, address meaningful gaps, and be prepared for what comes next.