The Pentagon suspended its Cybersecurity Maturity Model Certification (CMMC) Phase II audit mandate on 13 July, freeing more than 120,000 small US defence contractors from third-party assessments that federal analysis priced at up to $593,800 (£444,000) each.
The Department of War halted the requirements immediately, nearly four months before their 10 November 2026 start date, along with all pending and future CMMC milestones across its solicitations and contracts. Chief Information Officer Kirsten Davies ordered a 60-day study of the programme's future.