Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 11 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Silicon Valley

Washington, D.C.

The Department of War (DOW) has suspended the upcoming phase of its Cybersecurity Maturity Model Certification (CMMC) program designed to increase cybersecurity standards and compliance for the defense industrial base. In a <a href="https://dodcio.defense.gov/Portals/0/Documents/Library/CMMC-ReformMemo.pdf" target="_blank" rel="noreferrer noopener">memorandum</a> issued on July 13, DOW announced the suspension of Phase 2 of the CMMC program, scheduled to begin this November, while the agency examines whether the program aligns with its priorities. Although the memorandum pauses implementation of Phase 2 requirements, it makes clear that contractors must continue to adhere to CMMC Phase 1 requirements, including Levels 1 and 2 self-assessments.

contentpilot/introduction

DOW issued regulations implementing the <a href="https://www.thompsonhine.com/insights/cmmc-2-0-implementation-rule/" target="_blank" rel="noreferrer noopener">CMMC 2.0 framework</a> in September 2025, which established three levels of cybersecurity requirements. Contractors at CMMC Level 1 and some at Level 2 must conduct a self-assessment of compliance with specified cybersecurity standards. Most contractors at Level 2 must engage a third party to conduct a compliance assessment. For contractors at CMMC Level 3, DOW would certify compliance with applicable cybersecurity requirements. Phase 1 of CMMC 2.0, which began in November 2025, requires contractors at Levels 1 and 2 to submit their self-assessments to DOW reflecting their certification to compliance with applicable cybersecurity standards. Under Phase 2, contractors were to complete third-party assessments of cybersecurity compliance.

core/paragraph

In its July 13 memorandum, DOW suspends the November 2026 transition deadline for Phase 2, noting that although the CMMC program is intended to enhance security, it has imposed “significant and often prohibitive burdens” on the defense industrial base, particularly small businesses and non-traditional contractors. In addition, the memorandum states that all pending and future CMMC implementation milestones for DOW solicitations and contracts are held in abeyance until further notice. It further notes that DOW activities and personnel shall only include the CMMC Level 1 or 2 self-assessment requirements in procurement documents, and that all other cybersecurity clauses in contracts remain in force.

The memorandum establishes a “CMMC Reform Task Force” to conduct a complete review of the CMMC program over a 60-day period. The task force is responsible for redesigning the agency’s approach to cybersecurity compliance by the defense industrial base supply chain to adhere to the DOW secretary’s acquisition priorities. The memorandum notes that the task force’s recommendations should focus on “a reformed cybersecurity and operational resilience framework that prioritizes speed to capability, lower barriers for small, medium, and non-traditional businesses, and replaces prohibitive, third-party models with scalable, realistic security measures.”

Although many contractors may be relieved by this development, it does not mean that the government’s goal of improving cybersecurity in the defense industrial base is entirely on hold. While DOW’s memorandum suspends the next phase of CMMC 2.0, contractors must continue to follow applicable cybersecurity standards. The memorandum notes that DOW will maintain enforcement of baseline compliance with NIST SP 800-171 Rev. 2 requirements through contractor self-assessments and select government-led assessments. It also states that contractors must continue to adhere to the requirements for cybersecurity compliance set forth in DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

core/heading

While DOW’s July 13 memorandum halts implementation of the upcoming phase of CMMC 2.0 while the agency considers the program, contractors should be aware of ongoing cybersecurity compliance obligations and the implications for compliance failures.

Existing compliance requirements remain in force. The memorandum makes clear that although implementation of CMMC Phase 2 is suspended, the requirements of Phase 1 continue to apply to contractors. As a result, contractors must follow Phase 1 requirements for CMMC Levels 1 and 2 self-assessments. Further, as noted in the memorandum, the requirements of DFARS 252.204-7012 remain in force, so contractors must ensure that they meet NIST SP 800-171 requirements.

core/list-item

Penalties for false certifications. Because the memorandum underscores continued compliance obligations with DFARS 252.204-7012, contractors should not relax their vigilance with respect to NIST SP 800-171 compliance. Under its Cyber-Fraud Initiative, the Department of Justice seeks to investigate and prosecute contractors under the False Claims Act for noncompliance with applicable cybersecurity standards.

core/list

Our Government Contracts and Privacy &amp; Cybersecurity groups will continue to monitor developments related to the implementation of the CMMC 2.0 program and can assist with questions regarding the implications of DOW’s memorandum.

core/separator

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2026/07/Government-Contracts-and-Privacy-Cybersecurity-Update-DOW-Suspends-CMMC-Program-Phase-2.pdf

DOW Suspends CMMC Program Phase 2; Contractor Obligations Remain

Services