← Back Contractor Insights CMMC Phase 2 Remains Paused: What's Next? November 10, 2026Last Updated: November 11, 2026 3 Minute ReadNovember 10, 2026Author: Eric CruciusOriginally published on Hunton Website: https://www.hunton.com/government-contracts-intelligence-briefing/Under regulations issued last October, Phase 2 of the Department of Defense/War's Cybersecurity Maturity Model Certification (CMMC) program was set to begin on November 10, 2026. Instead, the Chief Information Officer's (CIO) pause, enacted on July 13, 2026, remains in effect with no announced end date.Phase 2 would not have required CMMC in all contracts as a default (that was due to begin on November 10, 2028), but would have instead defaulted to requiring third-party assessments when CMMC was placed in a contract (after approval by a program manager) and Controlled Unclassified Information was expected to be part of contract performance.The announced pause was to be followed by a 60-day study period. That study period lapsed in mid-September. Despite that, nearly six weeks later, the CIO has not provided updates or guidance for contractors selling products and services to the Department of Defense/War.What is Currently Required?It is important to remember that Phase 1, along with the underlying security controls, is still in effect. This means that:Contractors with Federal Contract Information must still comply with the security controls in Federal Acquisition Regulation (FAR) 52.204-21 and, if CMMC is required, successfully complete a Level 1 self-assessment.Contractors with Controlled Unclassified Information must still comply with the security controls in NIST SP 800-171 (revision 2) and, if CMMC is required, successfully complete a Level 2 self-assessment.The CIO noted in announcing the pause that the underlying security controls remain firmly in place. That means that contractors should not be complacent or assume enforcement is no longer active (it is). And companies throughout the supply chain should not pause plans for becoming compliant with NIST SP 800-171 (which has been, and continues to be, the subject of Department of Justice (DOJ) investigations).What Should Contractors Expect?With respect to third-party assessments under CMMC, the CIO's eventual announcement can take one of three paths:The continuation of third-party assessments as originally required (with a delay);Limitation of third-party assessments to certain types of Controlled Unclassified Information (or a phase-in period depending on the type of information); orElimination of third-party assessments.The third path could be the most challenging for the Department because rulemaking rescinding that requirement would have to overcome 10 years of rulemaking that had justified third-party assessments.There are also other possible outcomes. During the pause, the CIO released a Request for Information regarding the controls in 800-171 and which ones were the most difficult to implement. The CIO has also emphasized the protection of Operational Technology in the months since. It is possible new or changed underlying security requirements emerge after the pause and, if that is the case, like with the change to third-party assessments, rulemaking would be required. Also, changes by the Department of Defense/War would again make security controls inconsistent across the government and cause additional compliance complications to contractors that support the Pentagon and other executive branch agencies.Practical Information for ContractorsNo matter what happens with the CMMC Phase 2 pause, compliance with the security controls in a contractor's prime contract or subcontract is still required and contractors would be wise to continue to work toward full compliance (or maintain compliance if fully compliant).Also, large prime contractors may still require third-party assessments (even in the absence of a Pentagon requirement). Because of that, companies in the defense supply chain should monitor requirements from prime contractors irrespective of guidance from the Pentagon. Eric Crusius Managing Partner, Hunton Andrews Kurth LLPA regulatory attorney who focuses his practice on a wide range of government contract matters, including bid protests, claims and disputes, and compliance and sub-prime issues, Eric has extensive experience in government contract litigation. He has successfully prosecuted and intervened in numerous bid protests before the US Court of Federal Claims (USCFC), US Government Accountability Office (GAO), boards of contract appeals, and other federal agencies. He counsels clients regarding the Service Contract Act (SCA), Davis-Bacon Act and other labor issues, domestic preferences, export controls, cybersecurity, subcontracting and teaming agreements, and compliance with the Federal Acquisition Regulation (FAR) and other agency regulatory requirements, such as the Defense Federal Acquisition Supplement (DFARS). Eric also represents contractors in investigations and suspension and debarment proceedings, as well as in federal and state courts. Besides helping government contractors through contracting compliance and litigation issues, Eric provides strategic and practical advice with matters connected to cybersecurity and privacy in the government contracting space. Among other things, Eric counsels clients on obligations in the FAR (such as FAR 52.204-21) and on agency-specific requirements from the Department of Defense (DOD), Department of Homeland Security (DHS), Department of Veterans Affairs (VA), and others, including the Cybersecurity Maturity Model Certification (CMMC) program and Federal Risk and Authorization Management Program (FedRAMP). Eric also guides companies through cybersecurity incident responses and litigation, including potential ramifications under the False Claims Act (FCA). Eric is a government contracting thought leader, having appeared on Government Matters and Federal News Network, and has featured at conferences to provide his insight with respect to emerging issues. EDUCATION JD, Hofstra University School of Law BA, Social Science, Hofstra University, with honors Related What Is the FAR? A Beginner's Guide to the Federal Acquisition Regulation November 11, 2026 Understanding the Federal Acquisition Regulation (FAR) is essential for government contractors. Learn what the FAR covers, how it is organized, and how to navigate requirements throughout the federal contracting lifecycle. Inside the Mock CPSR: What We Find Before DCMA Does November 6, 2026 Discover the most common purchasing system weaknesses uncovered during mock CPSRs. Join FPS and J.A. White for a complimentary webinar exploring file deficiencies, compliance gaps, and how to prepare before DCMA reviews your system. Shield and Spear - Government Contracts and Trade Controls Intelligence Brief November 3, 2026 Explore the latest government contracting and trade compliance developments in this intelligence brief from Hunton. Topics include GAO bid protests, CMMC, DOJ enforcement, export controls, defense contracting opportunities, regulatory updates, and upcoming deadlines. The False Claims Act Risk Landscape: What Government Contractors Need to Know Now - Join Us for Complimentary Webinar October 30, 2026 False Claims Act enforcement is on the rise, with record recoveries and growing whistleblower activity. Join FPS on December 4 for a complimentary webinar covering emerging FCA risks, DOJ enforcement trends, recent executive orders, and practical compliance strategies for government contractors.
3 Minute ReadNovember 10, 2026Author: Eric CruciusOriginally published on Hunton Website: https://www.hunton.com/government-contracts-intelligence-briefing/Under regulations issued last October, Phase 2 of the Department of Defense/War's Cybersecurity Maturity Model Certification (CMMC) program was set to begin on November 10, 2026. Instead, the Chief Information Officer's (CIO) pause, enacted on July 13, 2026, remains in effect with no announced end date.Phase 2 would not have required CMMC in all contracts as a default (that was due to begin on November 10, 2028), but would have instead defaulted to requiring third-party assessments when CMMC was placed in a contract (after approval by a program manager) and Controlled Unclassified Information was expected to be part of contract performance.The announced pause was to be followed by a 60-day study period. That study period lapsed in mid-September. Despite that, nearly six weeks later, the CIO has not provided updates or guidance for contractors selling products and services to the Department of Defense/War.What is Currently Required?It is important to remember that Phase 1, along with the underlying security controls, is still in effect. This means that:Contractors with Federal Contract Information must still comply with the security controls in Federal Acquisition Regulation (FAR) 52.204-21 and, if CMMC is required, successfully complete a Level 1 self-assessment.Contractors with Controlled Unclassified Information must still comply with the security controls in NIST SP 800-171 (revision 2) and, if CMMC is required, successfully complete a Level 2 self-assessment.The CIO noted in announcing the pause that the underlying security controls remain firmly in place. That means that contractors should not be complacent or assume enforcement is no longer active (it is). And companies throughout the supply chain should not pause plans for becoming compliant with NIST SP 800-171 (which has been, and continues to be, the subject of Department of Justice (DOJ) investigations).What Should Contractors Expect?With respect to third-party assessments under CMMC, the CIO's eventual announcement can take one of three paths:The continuation of third-party assessments as originally required (with a delay);Limitation of third-party assessments to certain types of Controlled Unclassified Information (or a phase-in period depending on the type of information); orElimination of third-party assessments.The third path could be the most challenging for the Department because rulemaking rescinding that requirement would have to overcome 10 years of rulemaking that had justified third-party assessments.There are also other possible outcomes. During the pause, the CIO released a Request for Information regarding the controls in 800-171 and which ones were the most difficult to implement. The CIO has also emphasized the protection of Operational Technology in the months since. It is possible new or changed underlying security requirements emerge after the pause and, if that is the case, like with the change to third-party assessments, rulemaking would be required. Also, changes by the Department of Defense/War would again make security controls inconsistent across the government and cause additional compliance complications to contractors that support the Pentagon and other executive branch agencies.Practical Information for ContractorsNo matter what happens with the CMMC Phase 2 pause, compliance with the security controls in a contractor's prime contract or subcontract is still required and contractors would be wise to continue to work toward full compliance (or maintain compliance if fully compliant).Also, large prime contractors may still require third-party assessments (even in the absence of a Pentagon requirement). Because of that, companies in the defense supply chain should monitor requirements from prime contractors irrespective of guidance from the Pentagon.
