Pentagon Pauses CMMC Phase II, Keeps Contractor Self-Assessments

The Pentagon’s pause of the next phase of the Cybersecurity Maturity Model Certification program is more than a temporary procurement adjustment. It is a direct challenge to the assumption that stronger contractor cybersecurity must always mean more audits, more documentation, and higher compliance spending. By suspending the planned expansion of mandatory CMMC Phase II requirements while maintaining the existing self-assessment baseline, the Department of War has opened a short but consequential window to rethink how the defense industrial base proves it can protect sensitive federal information.
The review arrives at a difficult point for defense suppliers. Prime contractors, subcontractors, manufacturers, software firms, engineering shops, and IT providers have spent years preparing for CMMC’s phased rollout. Some have already invested heavily in security controls, System Security Plans, remediation work, managed service providers, and third-party assessment readiness. Others—particularly small businesses—have regarded the certification regime as an expensive barrier between them and federal work.
The fundamental issue is not whether contractors should secure government data. That obligation remains. The issue is whether the present CMMC model offers the most effective combination of security, scalability, accountability, and economic practicality.
For organizations working across Windows environments, Microsoft 365 tenants, Azure workloads, hybrid identity systems, and on-premises networks, the answer will shape security spending well beyond defense contracting. The Pentagon’s next steps could influence how thousands of companies prioritize endpoint hardening, multifactor authentication, audit logging, vulnerability management, encryption, and incident response.

---

Background: What the CMMC Pause Actually Changes​

CMMC was designed to move defense contractors away from a system that relied too heavily on self-reported cybersecurity compliance. The program ties cybersecurity requirements to contract eligibility, with different levels based on the kind of information a contractor handles and the level of risk involved.
At its core, the framework is built around three broad expectations:

• Level 1 focuses on basic safeguarding requirements for Federal Contract Information, or FCI.
• Level 2 applies to organizations handling Controlled Unclassified Information, or CUI, and aligns closely with the security requirements in NIST SP 800-171.
• Level 3 is reserved for a narrower group of companies supporting more sensitive programs and incorporates additional controls based on NIST SP 800-172.

The distinction between FCI and CUI matters. CUI is not classified information, even though it can be highly sensitive and subject to safeguarding and dissemination requirements. Contractors should avoid treating CMMC as a classification system. It is a cybersecurity assurance program designed to protect certain categories of government information within contractor environments.
The Department of War’s July 13, 2026 action suspended Phase II CMMC requirements, which had been scheduled to take effect on November 10, 2026. That pause does not mean that CMMC has been canceled, and it does not erase existing cybersecurity obligations from contracts.
The practical effect is narrower but still significant:

• Phase I self-assessment requirements remain active.
• Contractors may still need to meet CMMC-related requirements included in their solicitations and contracts.
• Existing DFARS cybersecurity obligations remain relevant.
• The Department is reconsidering the expansion of mandatory third-party certification and the model used to validate compliance.
• New solicitations may be revised, delayed, or structured around Level 2 self-assessments rather than immediate third-party assessments.

For the defense industrial base, this is not a permission slip to stop security work. It is a warning that compliance strategy may need to become more flexible.

Why the Existing Model Came Under Pressure​

The case against the current trajectory of CMMC is largely an economic and operational one. The case for it is fundamentally about trust.
Both arguments have merit.

The Small-Business Cost Problem​

For a large defense prime, CMMC preparation may be another major compliance program layered onto an established security organization. Those companies tend to have dedicated governance, risk, and compliance teams; enterprise endpoint management; full-time security staff; formalized asset inventories; and budgets for outside assessors.
For a machine shop, specialty manufacturer, startup, engineering consultancy, or regional IT service provider, the same requirements can be transformative.
The most burdensome costs do not always come from the final assessment itself. They often accumulate across the entire readiness effort:

• Hiring cybersecurity consultants.
• Replacing unsupported Windows systems and legacy applications.
• Implementing centralized identity management.
• Deploying endpoint detection and response tools.
• Documenting security policies and procedures.
• Creating and maintaining a System Security Plan.
• Developing Plans of Action and Milestones for gaps.
• Conducting evidence collection and control testing.
• Training employees and administrators.
• Paying for external assessment services.

The Pentagon has indicated that average Level 2 compliance costs can approach $150,000 per contractor. Actual costs vary substantially based on the company’s size, environment, existing security maturity, use of cloud services, and the scope of CUI handling. Still, the estimate illustrates why smaller suppliers see CMMC as a capital-allocation problem rather than an abstract compliance exercise.
A company deciding between a new CNC machine, an automation system, additional engineering capacity, and a costly cybersecurity certification process faces a real tradeoff. If compliance consumes too much available capital, the government may inadvertently reduce supplier capacity and discourage nontraditional firms from bidding on defense work.
That outcome would conflict with the Department’s broader interest in a resilient and diverse defense industrial base.

Compliance Spending Is Not Always Security Spending​

The criticism from Pentagon leadership is not that cybersecurity spending is wasteful. It is that some compliance spending can become disconnected from real security outcomes.
There is an important difference between paying for:

• Continuous endpoint monitoring,
• Rapid patch deployment,
• Secure backups,
• Identity protection,
• Network segmentation,
• Incident response exercises,

and paying primarily to produce evidence that a control existed at a particular point in time.
A third-party assessment can establish an important baseline. It can expose gaps that an organization overlooked or misrepresented. But it can also become a snapshot of security maturity rather than a durable measure of whether a company can detect, withstand, and recover from an actual intrusion.
This distinction is particularly important in Windows-heavy environments. A contractor may pass a point-in-time review yet still face serious operational weaknesses if it has:

• Inconsistent Windows Update management.
• Overprivileged local administrator accounts.
• Unmonitored PowerShell activity.
• Weak Microsoft 365 tenant configuration.
• Incomplete logging from domain controllers and endpoints.
• Shared privileged credentials.
• Unsupported line-of-business software.
• Flat networks that allow lateral movement.

A strong CMMC replacement should not reward paperwork while missing these practical exposure points.

---

The Case for Keeping Independent Verification​

The strongest counterargument is straightforward: the defense industrial base has not always demonstrated that self-attestation alone is reliable.
Organizations may overestimate their security posture, misunderstand NIST requirements, rely on incomplete documentation, or report scores that do not match their actual implementation. Government assessment teams have repeatedly found substantial gaps between contractor-reported security readiness and conditions discovered during assessments.
That history explains why CMMC introduced independent verification in the first place.

Self-Assessment Has a Trust Gap​

Self-assessment can work when an organization has mature governance, technical expertise, and a strong incentive to report deficiencies honestly. It works less well when a company lacks security staff, is unclear about the scope of its CUI environment, or believes that a low score may threaten contract opportunities.
The challenge is not necessarily bad faith. Many firms struggle with complicated interpretations of requirements such as:

• What constitutes adequate multifactor authentication.
• Whether a cloud service has the necessary government authorizations.
• How to define and maintain the CUI boundary.
• How to manage administrator accounts in a mixed Windows and cloud environment.
• Which logs must be collected, protected, and reviewed.
• How to document inheritance of controls from a managed service provider.

A self-assessment that lacks independent challenge can turn technical uncertainty into false confidence.

Third-Party Assessments Can Identify Blind Spots​

Independent CMMC assessments offer several benefits beyond compliance validation. A capable assessor can identify inconsistent evidence, challenge unsupported claims, and separate a policy statement from actual technical enforcement.
For example, a contractor may have a written policy requiring multifactor authentication but fail to enforce it for legacy VPN access, service accounts, break-glass accounts, or remote desktop gateways. An outside assessment can uncover the difference.
Similarly, a company may claim centralized patch management while leaving production workstations, engineering systems, or specialized Windows devices outside the normal update process. Those exceptions are often where attackers find a foothold.
The Pentagon therefore faces a genuine policy dilemma. Removing third-party assessment entirely could lower barriers to entry, but it could also recreate the original problem that CMMC was intended to solve.

---

Scaling Is the Hardest Operational Challenge​

The defense industrial base is too large and diverse for a one-size-fits-all assurance model. It includes roughly tens of thousands of prime contractors, plus a much larger and more distributed network of subcontractors, suppliers, manufacturers, and service providers.
Even if every organization accepted the cost of CMMC, the assessment ecosystem would still face a capacity problem.

Limited Assessors Create Bottlenecks​

Third-party assessment organizations and qualified assessors cannot appear overnight. A large-scale certification model requires trained personnel, consistent assessment standards, secure handling of evidence, quality assurance, dispute processes, and scheduling capacity across the country.
When demand outpaces supply, several predictable problems follow:

• Assessment lead times grow.
• Prices rise.
• Contractors delay bids or contract performance.
• Smaller firms receive less attention from high-demand assessors.
• Compliance work becomes concentrated around deadlines rather than ongoing security improvement.

This is why the Phase II pause should be understood partly as a scalability review. The government needs an assurance model that can cover a vast supplier population without creating a queue that slows procurement and inflates costs.

Government Assessments Cannot Carry the Entire Load​

An alternative is to rely more heavily on government assessment teams. That approach preserves independence, but it has a similar capacity constraint. Government cybersecurity assessment resources are limited, and they must prioritize the highest-risk contractors and programs.
A government-only model could work as a targeted enforcement mechanism, particularly for higher-risk suppliers or companies with troubling self-assessment results. It is unlikely to provide routine, comprehensive validation for the entire defense industrial base.
The more realistic future is a tiered assurance model that uses multiple forms of verification based on risk, contract value, data sensitivity, and observed security performance.

---

What a Better CMMC Model Could Look Like​

The Pentagon’s 60-day review presents an opportunity to avoid a false choice between burdensome certification and unverified self-attestation. A more modern CMMC approach could retain accountability while reducing repetitive cost and improving security relevance.

A Risk-Based Verification Framework​

Not every contractor presents the same level of cyber risk. A small supplier that receives limited FCI may not require the same scrutiny as a cloud service provider, systems integrator, or manufacturer handling significant volumes of CUI.
A future framework could segment requirements according to several factors:

• Type and volume of government data handled.
• Exposure to controlled technical information.
• Connectivity to government systems or major primes.
• Criticality of supplied products or services.
• History of cyber incidents or assessment deficiencies.
• Use of external cloud, managed security, and IT service providers.
• Business size and operational complexity.

Under that model, Level 2 contractors might not all receive the same treatment. Higher-risk firms could undergo independent assessment, while lower-risk firms could use self-attestation plus automated validation and selective audits.
That would preserve strong oversight where it matters most without treating every company as though it operates a major defense program environment.

Continuous Validation Instead of Point-in-Time Certification​

The most compelling idea raised during the policy discussion is a move toward continuous assurance.
Cybersecurity changes every day. New vulnerabilities emerge, identities are compromised, devices go missing, and cloud configurations drift. A certification that was accurate six months ago may say little about current risk.
Continuous validation could use a combination of:

• Periodic self-attestation by accountable company officials.
• Automated external scanning of public-facing assets.
• Verification of internet-exposed services and known vulnerabilities.
• Evidence of patch and vulnerability management performance.
• Randomized or risk-triggered audits.
• Security incident reporting.
• Targeted technical reviews after major environmental changes.
• Continuous assessment of identity, device, and logging posture.

This model would not replace every detailed assessment. Internal systems and CUI environments cannot be fully evaluated from outside the organization. However, external validation can provide meaningful evidence about whether a contractor is maintaining a basic cyber hygiene standard.
For Windows administrators, that could mean placing greater emphasis on operational telemetry rather than preparing solely for a scheduled evidence review. Endpoint health, Defender alerts, account hygiene, Azure AD or Active Directory activity, patch status, and backup readiness could become more important indicators of security performance.

Use Existing Security Investments More Effectively​

Many contractors already operate security technologies that can support stronger assurance if the government recognizes them appropriately.
A company using Microsoft Defender for Endpoint, Microsoft Sentinel, Intune, Windows Autopatch, Entra ID, vulnerability scanning, and managed detection and response may possess useful security telemetry that is more current than a static compliance binder.
A revised program could reward companies that demonstrate measurable capabilities such as:

• High rates of supported Windows version deployment.
• Prompt remediation of critical vulnerabilities.
• Mandatory phishing-resistant multifactor authentication for administrators.
• Centralized endpoint detection coverage.
• Protected and tested backups.
• Documented incident response exercises.
• Strong asset inventory accuracy.
• Reduced privileged-account exposure.
• Verified encryption for portable devices and sensitive data.

The risk is obvious: telemetry can be manipulated, incomplete, or overly focused on what is easy to measure. A mature program would need safeguards against “dashboard compliance,” where organizations optimize metrics without fixing deeper architectural weaknesses.
Still, outcome-based evidence could make CMMC more useful than a process that rewards a polished policy document over a functioning security operation.

---

The Windows Security Implications for Defense Contractors​

CMMC policy is often discussed in terms of assessments, legal clauses, and acquisition timelines. Yet its implementation lives inside operating systems, endpoints, identity platforms, file shares, collaboration tools, and cloud consoles.
For the many contractors built around Windows infrastructure, the pause should not change the immediate technical priorities.

Identity Is Still the First Control Plane​

A compromised identity remains one of the fastest paths to sensitive data. Attackers who gain administrator access can disable endpoint protections, access file shares, create persistence, move laterally, and exfiltrate data from cloud services.
Contractors should continue to strengthen:

• Multifactor authentication for all remote and privileged access.
• Separate administrator accounts.
• Privileged access management.
• Conditional access policies.
• Elimination of legacy authentication protocols.
• Tight control over service accounts.
• Monitoring for unusual sign-in behavior.
• Regular review of Active Directory and Entra ID privileges.

No forthcoming CMMC redesign will make weak identity security acceptable.

Endpoint Management Must Be Operational, Not Cosmetic​

Windows endpoints remain a major attack surface, especially in organizations that blend office systems with industrial, manufacturing, engineering, and field environments.
Effective endpoint security requires more than installing an antivirus product. It includes:

• Supported operating system versions.
• Timely security updates.
• Hardware and software inventory.
• Disk encryption.
• Application control where appropriate.
• EDR deployment and active monitoring.
• Removal of unused local administrator rights.
• Secure remote access.
• Configuration baselines.
• Incident isolation procedures.

The most difficult environments are often those with specialized devices and older applications. Those systems may have legitimate compatibility limitations, but they still need compensating controls such as network segmentation, restricted administrative access, monitored jump hosts, and carefully managed patch windows.

Evidence Still Matters​

Even under a more flexible CMMC regime, contractors will need to demonstrate that their controls work.
That means security teams should continue building evidence into everyday operations rather than scrambling before an assessment. Good examples include:

• Automated compliance reports from endpoint management platforms.
• Patch and vulnerability remediation dashboards.
• Configuration baseline records.
• Audit logs protected against unauthorized alteration.
• Incident response tickets and exercise results.
• Security awareness training completion records.
• Access review documentation.
• Backup restoration test reports.

The best defense against shifting compliance rules is a security program that produces trustworthy evidence as a natural byproduct of its daily operation.

---

Risks of the Pentagon’s New Direction​

The CMMC pause may reduce immediate pressure, but it introduces its own risks.

Policy Uncertainty Can Freeze Investment​

Some businesses may delay planned security improvements while waiting to see whether third-party certification returns in a different form. That would be a mistake, but it is an understandable reaction when requirements are changing.
The government needs to provide fast, precise guidance about what remains mandatory. Vague messaging creates confusion for contracting officers, primes, subcontractors, assessors, and IT teams.

Existing Investments Could Be Devalued​

Companies that already paid for readiness consulting, certification preparation, tooling, and third-party assessments may feel penalized if the Department substantially weakens or replaces the model.
That concern is not merely financial. The CMMC ecosystem includes assessors, consultants, managed service providers, trainers, and software vendors that have built capabilities around the established program. A sudden redesign could disrupt that market.
The stronger policy choice would recognize prior investments wherever possible. If a company has completed a credible assessment or implemented mature controls, the new model should provide a meaningful path to reuse that work rather than require a full restart.

A Cheaper Program Must Not Become a Weaker Program​

The Department’s stated aim of replacing bureaucracy with scalable, resilient cybersecurity measures is sound. But cost reduction alone is not a security strategy.
An overly simplified self-attestation regime could encourage firms to treat cybersecurity as a contract representation rather than an operational responsibility. Legal accountability is important, but liability after a breach does not restore stolen technical data or undo supply-chain compromise.
The Pentagon must preserve consequences for inaccurate claims, repeated control failures, and unaddressed security deficiencies. Risk-based audits, random validation, and strong enforcement can help maintain credibility without demanding the same assessment burden from every supplier.

---

The Most Likely Path Forward​

A complete abandonment of CMMC appears less likely than a redesign of its most expensive and least scalable elements. The Pentagon still needs a framework for ensuring that contractors protect FCI and CUI. It also needs a way to distinguish between companies that can demonstrate genuine security maturity and those that simply declare compliance.
The likely outcome is a hybrid approach built around several principles:

1. Maintain Level 1 self-assessment requirements for basic safeguarding of federal information.
2. Retain higher scrutiny for higher-risk CUI environments, critical suppliers, and strategically important programs.
3. Reduce repetitive certification costs through reciprocity, shared evidence, inherited controls, and better recognition of credible security services.
4. Expand automated and continuous validation for public-facing exposure, vulnerability management, endpoint health, and identity security.
5. Use targeted government and third-party audits when self-attestation, technical signals, contract risk, or incident history justify deeper review.
6. Measure security outcomes, not merely the presence of policies and checklists.
7. Create clearer implementation guidance for small businesses that lack dedicated compliance teams.

That approach would not make CMMC simple. Protecting defense information across a huge and diverse contractor ecosystem is inherently difficult. But it could make the program more proportionate, more sustainable, and more closely aligned with modern cyber risk.

Conclusion​

The Pentagon’s CMMC overhaul is an opportunity to correct weaknesses in both directions: excessive compliance burden on one side and insufficient verification on the other. The challenge is to avoid treating those problems as mutually exclusive.
Small defense contractors need a cybersecurity path that does not consume the investment capacity required to innovate, hire, manufacture, and compete. At the same time, the Department of War cannot rely on untested claims when supply-chain security, controlled information, and national defense readiness are at stake.
The most durable successor to the current CMMC expansion will be one that treats cybersecurity as a continuous operational discipline. It should reward real improvements in Windows endpoint security, identity protection, vulnerability response, cloud governance, and incident readiness—while reserving the most costly independent assessments for environments where the risk truly warrants them.
That would shift CMMC from a compliance event into something more valuable: an ongoing, measurable demonstration that defense contractors can protect the information and systems entrusted to them.

---

References​

1. Primary source: GovCIO Media & Research
   Published: 2026-07-23T17:16:48+00:00
   
   Loading…

   govciomedia.com