Home / Business and Economy / Pentagon Halts Strict Contractor Cybersecurity Rule
Pentagon Halts Strict Contractor Cybersecurity Rule
14 Jul
Summary
- Pentagon suspends cybersecurity certification program for defense contractors.
- Program compliance costs were pushing small suppliers out of military work.
- A new task force will review feedback and deliver recommendations within 60 days.
The Pentagon has announced an immediate suspension of the upcoming phase of its Cybersecurity Maturity Model Certification (CMMC) program. This decision follows months of vocal opposition from small and mid-sized aerospace and defense suppliers who cited prohibitive compliance costs and long audit waits.
The Defense Department's CMMC program, initiated in November 2025, aims to safeguard sensitive government information. The suspended Phase 2 would have mandated third-party audits, a requirement many smaller businesses found financially unfeasible. Pentagon officials acknowledged that the current CMMC compliance was pushing innovative companies out of the Defense Industrial Base.
Pentagon Chief Information Officer Kirsten Davies stated that the suspension addresses these pressures. Under Secretary of War for Acquisition and Sustainment Michael Duffey indicated the change would eliminate "paralyzing costs" and foster continued innovation and competition within the defense supply chain. A newly formed CMMC Reform Task Force is set to solicit industry input and provide recommendations within the next 60 days.
