The suspension halts the third-party assessment requirement for defense contractors handling Controlled Unclassified Information (CUI), but cybersecurity obligations and potential FCA exposure remain.
By Anne W. Robinson, Kyle R. Jefcoat, Dean W. Baxtresser, Morgan L. Maddoux, Drew Diachenko, Chris Caulder, Ysa Gomez-Gonzalez, and Pascal Jakowec
In a July 13, 2026, memorandum (CMMC Reform Memorandum) and press release, the US Department of Defense (Department of War) suspended Phase 2 of the Cybersecurity Maturity







