Pentagon Hits Pause on Contractor Cybersecurity Checks, Citing Too Few Auditors and Too Much Red Tape

Key points

• The Pentagon suspended phase two of the Cybersecurity Maturity Model Certification (CMMC) programme in May 2025, pausing requirements due to take effect in November 2026.
• A newly formed task force will spend 60 days collecting industry feedback before recommending changes aimed at reducing costs for small and non-traditional defence suppliers.
• Officials cited a shortage of approved third-party auditors as one reason the November 2026 deadline was no longer workable.
• Phase one requirements, which took effect on 10 November 2025 and rely on companies self-certifying their own security, remain in force.

Defence suppliers don't have a new deadline to prepare for. They have an old one that just got pulled.

The Cybersecurity Maturity Model Certification, or CMMC, is the framework any company must pass to win a defence contract by proving it handles sensitive government data securely. It covers Federal Contract Information (FCI), meaning basic government business data, and Controlled Unclassified Information (CUI), sensitive material that isn't classified but still needs protection.

CMMC 2.0 runs at three levels. Level 1 covers FCI basics. Level 2 applies CUI protections drawn from NIST 800-171, a widely used federal security standard. Level 3 targets the most sensitive CUI against state-sponsored threats.

Why is this happening now?

There aren't enough approved auditors to actually run the checks on time.

Phase two, originally set to start on 10 November 2026, would have required companies handling CUI to bring in a government-approved third party to audit their security before winning new contracts. When announcing the pause, officials confirmed that too few of those auditors exist to meet that deadline.

Kirsten Davies, the Department's Chief Information Officer, said the move clears bureaucratic obstacles without lowering the security bar. Contractors still have to meet phase one requirements, in force since 10 November 2025, which ask companies to assess and self-certify their own controls.

Michael Duffey, Undersecretary for Acquisition and Sustainment, said compliance costs tied to phase two risked driving smaller manufacturers out of defence work entirely.

The full rollout runs to 2028. Phase three, due November 2027, would introduce Level 3 certification for the most sensitive contracts. Phase four would extend full requirements across all applicable contracts by 2028. A new CMMC review and reform task force will now gather industry feedback before recommending a revised path. SecurityWeek first reported the announcement.

The gap this exposes isn't new. Our story from 13 July 2026, "AI Is Making Rich Organisations Even Safer. What Happens to Everyone Else?", traced the same fault line: well-resourced primes can absorb compliance overhead that smaller suppliers can't.

Should you worry?

For most people, the direct impact is limited. If you work for, or supply goods to, a company in the defence chain, though, this changes whether those companies face formal security audits anytime soon.

The pause isn't a reprieve from accountability; it's a delay in independent verification. Self-certification remains mandatory, and a task force recommendation could tighten rules faster than the original schedule if feedback runs that way. The auditor shortage is the real problem here, and a 60-day review won't conjure qualified assessors from thin air. Watch what the task force actually recommends, not just whether the deadline shifts.

What contractors should do now

• Confirm you're meeting phase one self-assessment requirements, because those haven't changed.
• Track the task force's output over the next 60 days, as revised phase two rules could look very different.
• Map the CUI your business handles now, since that data category sits at the heart of Level 2.
• Document your current security controls while costs are lower and deadlines are softer.