Pentagon Halts CMMC Phase 2 Certification; 60-Day Review Freezes Third-Party Audits
The suspension is a tactical retreat that buys time but doesn't resolve the underlying tension: DoD wants supply-chain visibility, contractors want cost certainty, and the audit industry can't scale fast enough to certify thousands of firms. If the 60-day review produces a lighter-touch framework, contractors win and supply-chain risk increases.
If it produces a stricter one, the compliance cost gets pushed downstream to smaller subs and non-traditional suppliers, which narrows the industrial base further. Either way, the pause signals CMMC Phase 2 as originally designed was not operationally viable — a rare admission from the Pentagon about an acquisition reform that backfired.
Defense contractors face a compliance timeline freeze that could cascade into FY27 contract negotiations.
The suspension signals the Pentagon acknowledges CMMC Phase 2 was unworkable in its current form — likely due to cost, audit capacity, or contractor pushback — but the 60-day window creates uncertainty about whether the restart will impose stricter or looser standards. Primes like Lockheed Martin, RTX, and Northrop Grumman have already invested in compliance infrastructure; a redesigned framework could render those sunk costs obsolete or require new spending.
Watch for the Pentagon's revised CMMC framework announcement by mid-September: if it tightens requirements, contractors must accelerate remediation before FY27 awards. If it weakens them, the current pause becomes a de facto victory for the industrial base.
What triggered the halt — cost overruns in the audit ecosystem, contractor non-compliance rates exceeding DoD thresholds, or political pressure from the Hill? The article doesn't say. That's the real story.
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.