CYBERSECURITY BREAKING: Pentagon Suspends Phase 2 of CMMC Program By Josh Luckenbaugh iStock illustration The Defense Department announced July 13 that it was suspending the Phase 2 requirements for its Cybersecurity Maturity Model Certification program and that it would be conducting a comprehensive review of the initiative to ensure it aligns with Secretary of War Pete Hegseth’s Acquisition Transformation Strategy. The program, known as CMMC, is meant to be the department’s mechanism for verifying defense contractors are compliant with its cybersecurity requirements. Phase 1 of the program began Nov. 10 of last year and required companies to self-assess compliance at two security levels. Phase 2, which would have begun on Nov. 10, would have seen the introduction in applicable Pentagon solicitations of CMMC Level 2 requirements for companies to be certified by a third-party assessment organization. But while CMMC was designed to enhance the defense industry’s cybersecurity, “instead it has created prohibitive compliance costs and bureaucratic burdens,” according to a Defense Department release. Small Business Administration reports have shown that “CMMC compliance is forcing innovative companies out of the defense industrial base, which will delay the delivery of critical capabilities to the warfighters,” it said. To support Hegseth’s directive as part of his Acquisition Transformation Strategy to reduce compliance barriers for small and medium-sized businesses, the department is suspending CMMC Phase 2 requirements, Pentagon Chief Information Officer Kirsten Davies said. “Robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness,” Davies said in the release. “We believe the [defense industrial base] can achieve both, while we reduce unnecessary government red tape.” Additionally, pending and future CMMC implementation milestones in Pentagon solicitations and contracts will be suspended, the release stated. However, Phase 1 self-assessment requirements remain in place. Meanwhile, Davies is establishing a CMMC Reform Task