Key takeaways
- Defense contractors and other vendors who work with the Department of Defense must now meet CMMC 2.0 compliance requirements to bid on contracts.
- CMMC 2.0 was originally scheduled to be implemented over four phases; however, the department has indefinitely paused Phase II, which required third-party compliance assessments for certain contractors, pending a likely revamp of those requirements.
- During the pause, most other CMMC 2.0 requirements remain in effect.
- Contractors that wish to do business with the Department of Defense should work with an advisor to understand the latest CMMC rules and make changes needed to achieve and maintain compliance.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the newest iteration of the Department of Defense’s (DoD) cybersecurity rules for contractors. This framework aims to ensure that all defense contractors implement necessary cybersecurity safeguards to protect controlled unclassified information (CUI) and federal contract information (FCI).
CMMC 2.0 compliance requirements were originally scheduled to take effect in four phases from November 2025 through 2028. However, in July 2026, the DoD paused Phase II indefinitely, although most other CMMC requirements remain active.
Keep reading to learn what’s changing and how your business may need to adapt.
What is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a cybersecurity compliance framework for defense contractors and other vendors who work with the Department of Defense (informally referred to as the Department of War). CMMC 2.0 is the latest version of the CMMC framework and now appears in all DoD contracts with the goal of raising cybersecurity standards for the defense industrial base (DIB).
Is CMMC compliance mandatory?
DoD contractors who wish to continue bidding on federal defense contracts must meet CMMC 2.0 compliance requirements. However, the Phase II pause means you no longer have to complete a third-party assessment in order to demonstrate compliance.
Who does CMMC 2.0 apply to?
CMMC 2.0 applies to all contractors, vendors and other third-party organizations that do business with the Department of Defense. Especially in light of the Phase II pause, expect that CMMC will continue to evolve in the coming years.
What is the CMMC 2.0 Phase II pause?
On July 13, 2026, the DoD announced it was pausing Phase II of the CMMC 2.0 rollout indefinitely. Phase II, which was supposed to begin on November 10, 2026, originally required organizations handling higher levels of sensitive information to complete third-party CMMC compliance assessments.
However, due to the pause, organizations no longer have to complete third-party assessments to demonstrate CMMC 2.0 compliance. Most other requirements remain in effect, and DoD is continuing to include CMMC in new contracts.
It is likely that DoD will announce significant revisions to the rest of the CMMC rollout at some point in the future.
Before the pause, CMMC 2.0 had originally established a three-year phased implementation period
CMMC 2.0 was originally scheduled to roll out in four phases from 2025 through 2028. While the Phase II pause means the entire rollout schedule will likely be revamped, here is that original schedule as it was first established:
- Phase I: The first phase began on November 10, 2025. During this phase, the DoD can begin to include CMMC 2.0 requirements in new contracts. Contractors will need to meet Level 1 or Level 2 self-assessment requirements as a condition of contract award.
- Phase II: Before the pause, the second phase was originally scheduled to start one year after Phase I, on November 10, 2026. In this phase, contractors handling CUI would have been required to undergo a third-party assessment by a certified assessor organization as a condition of award.
- Phase III: The third phase was scheduled to begin on November 10, 2027. This phase would have involved the DoD itself conducting Level 3 CMMC assessments for contracts involving the most sensitive CUI, but will also likely be revamped in light of the Phase II pause.
- Phase IV: The final phase was supposed to start three years on November 10, 2028. This phase would have marked the full implementation of the CMMC requirements across all applicable solicitations and contracts.
This phased approach was intended to address ramp-up issues, provide runway to train the necessary number of assessors and allow companies the time needed to understand and implement CMMC requirements.
Key clarifications around CMMC 2.0 compliance requirements
As the newest version of DoD cybersecurity rules, CMMC 2.0 provides several key clarifications that are crucial for CISOs and compliance officers at defense contractors to understand. These include:
- The operational plan of action allows contractors to identify temporary vulnerabilities and deficiencies, as opposed to documenting in a plan of action and milestones (POA&M). This allows for management to remediate vulnerabilities or deficiencies identified through the normal operation of detective controls without causing you to go out of compliance.
- Contractors must retain artifacts used in evidence for an assessment for at least six years after the date of their certification assessment. This retention obligation extends to the annual self-certifications that contractors must perform.
- External service providers are not required to have CMMC certification, but are “in-scope” if they store, transmit or process CUI.
- An endpoint hosting a virtual desktop infrastructure (VDI) client configured to disallow processing, storage or transmission of CUI beyond keyboard/video/mouse sent to the VDI client is considered an out-of-scope asset.
How should you implement the CMMC 2.0 cybersecurity framework?
Even with the Phase II pause, most CMMC 2.0 requirements remain in effect. Defense contractors must take several steps to become compliant and properly flow down the compliance requirements to their subcontractors, including:
1. Understand the three CMMC 2.0 levels
Based on the type of sensitive information or CUI your organization handles, you should determine the appropriate CMMC level for your organization. This will guide your compliance efforts and help you identify the specific requirements you need to meet.
The three levels are:
- Level 1: Basic protection of FCI, requiring an annual self-assessment.
- Level 2: General protection of CUI, which can now be achieved through a self-assessment in light of the Phase II pause.
- Level 3: Enhanced protection against advanced persistent threats. This would have required an assessment led by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), starting with Phase III in November 2027, but may now be revamped.
2. Conduct proper scoping of your environment.
Proper scoping of your environment for CMMC 2.0 is crucial because it clearly defines the boundaries where CUI is stored, processed and transmitted within your organization. This allows you to focus security efforts only on the relevant systems and data, minimizing the scope of your assessment and ultimately reducing the cost and complexity of achieving compliance while ensuring the most critical assets are adequately protected. If not done correctly, your entire network could be considered “in-scope” for assessment, leading to unnecessary overhead and potential noncompliance issues.
3. Perform a gap analysis.
Assess your current cybersecurity posture against the CMMC 2.0 standards. Conduct a thorough gap analysis to identify deficiencies in your existing cybersecurity controls. This will help you develop a POA&M to address these gaps and achieve compliance.
4. Implement required controls.
Based on the results of your gap analysis, implement the necessary cybersecurity controls to meet the CMMC requirements. This may involve updating your policies, procedures and technical controls, or implementing new technology.
5. Prepare for assessment.
You’ll need to complete a self-assessment to demonstrate CMMC 2.0 compliance. Before you begin, ensure that you have all the required documentation and evidence in place. This includes maintaining control evidence for six years and being prepared for potential audits by the DoD.
6. Flow down requirements to subcontractors.
Ensure that your subcontractors are also compliant with the CMMC requirements. Flow down the relevant requirements to all subcontractors at every tier and verify their compliance.
By following these steps, defense contractors can help ensure that they are fully compliant with the CMMC 2.0 requirements and are well-prepared to protect sensitive information from evolving cyberthreats. A third-party advisor can help you navigate this process and implement solutions to bring you up to speed.
Read more
We help businesses understand, implement and maintain compliance with CMMC 2.0 requirements. Let’s talk about your current cybersecurity readiness and how you need to evolve. Start a conversation.