CMMC Phase 2 Update

Phase 2 Is Temporarily Paused

The Department has temporarily paused the transition to CMMC Phase 2 during a 60-day review period.

While certain third-party certification and assessment activities are paused, your organization’s existing cybersecurity and contractual obligations remain in effect.

What You Need to Do Now

  • Stay Compliant: Maintain current requirements.
  • Check Readiness: Identify gaps.
  • Close Gaps: Fix deficiencies.
  • Prepare: Be ready for Phase 2.

Requirements Still Matter

Organizations should continue to follow applicable:

  • CMMC Phase 1 requirements
  • NIST SP 800-171 requirements
  • DFARS cybersecurity obligations
  • Current contractual security requirements

Use the Pause to Prepare

This pause provides additional time to strengthen your cybersecurity posture, organize documentation, address compliance gaps, and prepare for future CMMC Phase 2 requirements.

Phase 2 is paused. Your cybersecurity responsibilities are not.