Blog · Cybersecurity

What the CMMC Phase 2 Pause Leaves in Place for Contractors

Chris A. Grable · July 16, 2026

On 13 July, DOW and Small Business Administration leaders announced a pause on Phase 2 of the Cybersecurity Maturity Model Certification program. Phase 2 is where certification shifts from the contractor to an outside assessor. Some companies will read the announcement as relief. The specialists quoted in the reporting read it differently, and the contract language supports them.

Update, 31 October 2026: this analysis reflects the July announcement. The department's implementing memorandum of 13 July 2026 and later deviation guidance govern how the pause applies, and each contract's obligations depend on the clauses it actually incorporates. Check the current direction and your contract before relying on the summary below.

What the pause actually stops

As announced, the pause applies to the third-party assessment gate. It does not remove or suspend the clauses that already sit in existing contracts, and those clauses carry their own obligations:

A contractor whose contract incorporates these clauses owes the same safeguarding and self-assessment duties after the announcement as before it.

Why the specialists expect assessments to return

The experts' shared view is that the requirement will come back in some form. DOW may conclude that an outside assessor is unnecessary, but in their view it still needs evidence that contractors meet the standard, and self-assessment alone has not supplied enough of it.

The risk in standing down

A company that halts its security program because audits paused is betting that the requirement goes away. The more likely outcome is that checking resumes under a different mechanism, measured against the same clauses. That company would then face a gap it chose to open.

UDC recommends that contractors keep their safeguarding work and self-assessments current under the existing clauses, and treat the pause as time to close gaps rather than a reason to stop.