Training & Education

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.