CMMC Phase Two Rollout Remains Paused for Industry
Defense contractors face ongoing uncertainty as the DOD determines the next steps for its cybersecurity certification program.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Should the federal government mandate strict cybersecurity standards for all contractors doing business with them?
The Cybersecurity Maturity Model Certification (CMMC) program is facing operational friction as the second phase of its rollout remains paused. Industry stakeholders are currently awaiting a formal decision from the Department of Defense CIO to determine the program's next trajectory.
Why it matters
The uncertainty surrounding the CMMC ecosystem complicates compliance planning for defense contractors navigating federal security requirements. Delays in program advancement impact how businesses prepare for pending audit mandates.
The assessment ecosystem currently lacks clarity on phase two execution, compared to the established guidelines of phase one. Key operational benchmarks for full certification remain undefined until federal authorities resolve the ongoing pause.
The players
Cyber AB
The accreditation body responsible for managing the CMMC assessment ecosystem and certifying third-party auditors.
Matthew Travis
The chief executive officer of the Cyber AB who oversees the organization's strategic engagement with defense industry stakeholders.
DOD CIO Davies
The Department of Defense Chief Information Officer tasked with finalizing the future steps for the CMMC program.
The details
The Cyber AB, the organization responsible for overseeing the CMMC assessment ecosystem, held its annual CS5 East conference to address these structural challenges. Participants examined the mechanisms governing third-party auditor oversight and the certification protocols required for contractors handling sensitive defense data. These mechanisms are currently being reassessed by the Department of Defense to address gaps in the existing framework.
Timeline
October 20-24, 2026: The Cyber AB held its annual CS5 East conference.
October 22, 2026: Matthew Travis delivered welcoming remarks at the conference.
The Tech Race
This pause in the CMMC program represents a critical pivot point for the defense industrial base as it transitions to mandatory cybersecurity standards. The current status contrasts with the program's original objective to standardize security audits across all tiers of the defense supply chain.
Defense contractors should monitor upcoming communications from the Department of Defense to adjust their compliance timelines accordingly. Until a decision is reached, organizations currently preparing for phase two certification may face extended administrative delays.
The takeaway
The trajectory of federal defense procurement security depends on the forthcoming resolution from the DOD regarding phase two of the certification process. Contractors should track future announcements from DOD CIO Davies to refine their long-term compliance strategy.
Further reading
For broader trends in federal security mandates, visit our Cybersecurity section.
Source note: This article includes information reported by Inside Cybersecurity.
Live Poll
Should the federal government mandate strict cybersecurity standards for all contractors doing business with them?
