What Defense Contractors Should Know About DOD’s Suspension of CMMC Phase 2 - Latham & Watkins LLP
DOD has suspended CMMC Phase 2, delaying the rollout of cybersecurity certification requirements for defense contractors.
Aforeworn detected this change in the Export Controls & ITAR (DDTC / BIS / DFARS) space on August 3, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated Medium urgency. Defense contractors and subcontractors subject to DFARS cybersecurity requirements. should confirm how it applies to their specific situation before acting. There is a time constraint attached: Not specified in the provided text.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors Export Controls & ITAR (DDTC / BIS / DFARS) continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
The Department of Defense has suspended CMMC Phase 2, which was set to require contractors to achieve specific cybersecurity certification levels.
Who it affects
Defense contractors and subcontractors subject to DFARS cybersecurity requirements.
What you must do
Monitor official DOD announcements for revised timelines and continue maintaining current DFARS 252.204-7012 compliance.
Deadline
Not specified in the provided text.
Never miss a change like this again
Aforeworn watches Export Controls & ITAR (DDTC / BIS / DFARS) around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in Export Controls & ITAR (DDTC / BIS / DFARS)
- Trump Administration Imposes National Security Duties on UAS, in Action Coordinated with FCC and Defense Regulation - JD Supra
- New Additions to Uyghur Forced Labor Entity List - Mirage News
- Automated Commercial Environment (ACE) Electronic Export Manifest for Rail Cargo
- US-CONGRESS S5380: A bill to provide for a ten-year statute of limitations for export control violations under the Export Control Reform Act of 2018.
- US Sanctions 30 Crypto Wallets Tied to Iran's Mabna Institute, Tracing $16.8 Million - finance.biggo.com