The Pentagon Just Paused Its Cybersecurity Certification Program. Here’s What Everyone Is Missing.
The Pentagon Just Paused Its Cybersecurity Certification Program. Here’s What Everyone Is Missing.
Publish Date: 2026-07-14 01:09:00
Source Domain: www.forbes.com
Secretary of War Pete Hegseth announces a 60-day review of the Cybersecurity Maturity Model Certification (CMMC) program, signaling a shift from emphasizing certification timelines toward reassessing how the Department validates cybersecurity across the Defense Industrial Base.
Getty Images
Few cybersecurity initiatives have generated as much debate across the Defense Industrial Base as the Cybersecurity Maturity Model Certification. Yesterday, that debate took another unexpected turn when Secretary of War Pete Hegseth’s Department of War suspended implementation of CMMC Phase II, established a 60-day CMMC Reform Task Force, and directed the Department to redesign the certification framework while maintaining existing cybersecurity obligations. The decision immediately raised questions about the future of CMMC, the role of third-party assessments, and whether defense contractors should continue investing in cybersecurity readiness.
What Secretary Hegseth’s Team Actually Announced
According to the memorandum signed by the DOD’s Chief Information Officer Kristen Davies, the Department will suspend the November 2026 transition to mandatory Phase II implementation, hold pending implementation milestones in abeyance, limit new procurements to Level 1 and Level 2 self-assessments during the review period, and deliver recommendations for a redesigned framework within sixty days. At the same time, the memorandum explicitly states that existing contractual cybersecurity requirements remain in effect, including compliance with National Institute of Standards and Technology Special Publication 800-171 Revision 2 and applicable Defense Federal Acquisition Regulation Supplement clauses.
In announcing the decision, Under Secretary of War for Acquisition and Sustainment Michael Duffey described the Department’s objective as reducing “paralyzing costs” while preserving innovation and expanding participation throughout the Defense Industrial Base. Chief Information Officer Davies…
