Is Russia in charge now? What on earth does the DoW mean by “CMMC Phase II is paused”?
July 13, 2026 – a day that will live in infamy
Jk, it won’t really. This is a blip in a program roll out that has had many blips over the years. Some of the blips are really beneficial (removing the delta 20 out of CMMC 1.0, for example). Some are not. None of them will stop what will eventually be the CMMC program in its full (codified, legal) glory.
Jolene
It is important that you all know that yesterday was also Jolene’s birthday.
Holy hell you guys, it’s been a wild 24 hours. The most important thing that happened yesterday, obvs, is that Baby Jolene turned THREE and I am still in shock that she’s not a baby baby anymore. The second most important thing is that DoW issued a press release announcing the immediate suspension of the CMMC Phase II requirements. This is legit insane behavior, but sure, do you, guys.
The link to the press release: Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements > U.S. Department of War > Release | U.S. Department of War
The press release basically says “we can’t let a little thing like paperwork slow us down, we need to do WAR”. It goes on to say that this is being done for small and mid-sized businesses to ensure they can still participate in the space – the SBA had put out a report that compliance with CMMC is forcing innovative companies out of the DIB. This might be true? It’s probably true. Please remember that contractors have been saying they’ve been compliant FOR ALMOST TEN FREAKING YEARS. The thing CMMC is doing is bringing in third-party auditing. The cost of the audit isn’t prohibitive, it’s getting compliant WITH THE THING THEY’VE BEEN LYING ABOUT that’s prohibitive.
Anyway. Yes, we need to be able to move quickly as we respond to threats around the world. Yes, we need to ensure innovators and precision manufacturers and the entire dang supply chain can provide the services and machines the Department needs. And to be fair, it really did seem like SOMETHING was going to break in November 2026 when Phase II rolled out – there are approximately 100 C3PAOs as of this writing, and 200,000 DIB contractors that need to be assessed. That’s a lot of math that doesn’t quite work. That being said… is it the assessment that’s hard? Or is it getting into compliance that’s the ACTUAL brunt of the work? Maybe we have enough assessment orgs but DON’T have enough qualified consultants to help Dibbies get where they need to be.
I’m off track here. Ok, back to what happened yesterday. Press release came out. It’s a short read, go read it. It ends with a link to a new section of the DoW CIO website called Brilliant Basics. We’ll get into that hot mess later.
We also got two memos (cute). One from Kirsten Davies (DoW CIO) and one from Michael Duffey (USD for A&S).
Kirsten Davies said we need to be prepared for war and the current CMMC program doesn’t allow for the rapid scaling of our warfighting capabilities. She is also establishing a CMMC Reform Task Force that will have 60 days to review the program and provide recommendations for a better framework. (lol sure Jan). Listen, the program has ISSUES. But it’s still a whole lot better than what we had before. CMMC-ReformMemo.pdf
Ms. Davies also made a short speech worth listening to, which is posted to the DoW CIO website: CIO – Cybersecurity Maturity Model Certification She’s really on that “this is for the warfighter and the small businesses” line that they’ve got going. Also ended with “peace through technical strength”, so that’s a line we have now.
Michael Duffey basically said the same thing, aligning to Hegseth’s 5 pillars of the Acquisition Transformation Strategy. He also included an attachment that has guidance for Program Managers re: assessments and solicitations. He did explicitly state that the cybersecurity reporting requirements in DFARS 252.204-7012 are still v much alive and well. (good, the DFARS clauses that we think about are a GOOD THING FOR NATIONAL SECURITY) ImplementingSuspensionCMMC-PhaseII.pdf
ALSO yesterday, CMMC disappeared completely for a few hours from the DoW CIO website. It’s back, and it is less: CIO – About CMMC They’ve taken out every mention of what Level 2 (C3PAO) or Level 3 (DIBCAC) assessments might look like. There is an update to the FAQs, but mostly in the “we’re paused in Phase 1” kind of way. These FAQs are important to know, though, so suggest familiarizing yourself: CYBERSECURITY MATURITY MODEL CERTIFICATION Program (CMMC) FREQUENTLY ASKED QUESTIONS
LASTLY (maybe, I’ll probably add to this bc who knows what else will happen): DoW CIO added a new “Brilliant Basics” section to their website. It is… basic. Someone said “what if we took all the meat out of NIST 800-171 and added graphics?” and then put it on an actual Dept website. A fun thing here is that backups are in scope for this Basics thing? Backups are not required in NIST 800-171 (fwiw, back shit up. It’s not that hard and it is wildly important). Brilliant at the Basics
Editorialized
I know I’ve been restrained in my thoughts and feelings, so if you don’t want to hear how I feel, you can stop reading now – you’ve got the gist of what went down yesterday.
THE DFARS IS CORRECT, WE NEED REGULATION ON THE DEFENSE SUPPLY CHAIN. It’s not a coincidence that China produced the J-35 fighter jet after we built the F-35. We KNOW that non-kinetic warfare and industrial espionage are on the rise. The entire war landscape is rapidly changing as our defense contractors build autonomous drones and vessels, AI-powered missiles, and quantum cryptography. If we can’t stay ahead of our enemies, or if we LET OUR DAMN TECHNOLOGY FALL INTO THEIR HANDS, where is our advantage? How are we protecting our troops at home and abroad?
We already saw what happened when self-assessment and self-attestation were the standard. DIB contractors blatantly disregarded the entire framework that was designed specifically to keep the information that they are handling safe. And they LIED ABOUT IT. There are lives at stake when we don’t adequately protect our information. Our technical prowess means nothing if we let it fall into a rival power’s hands. And we KNOW that without third-party accountability, the cybersecurity measures that we have determined are vital DO NOT TAKE PLACE.
We need to keep America, and Americans, safe. That includes safeguarding information across the defense industrial base.
CMMC is taking a beat, as is 100% normal when a new CIO comes in. It is not over, not by a long shot. And all the contractors breathing a sigh of relief about spending time & money on compliance are flat out WRONG and the DoJ is looking forward to having a word with them.
The requirements haven’t changed. They honestly haven’t really changed since Dec 31, 2017. It is BEYOND time for defense contractors to GET THEIR SHIT TOGETHER.
And you guys, Agile IT legit knows how to help. We know this stuff. So LFG.
