The Department of War suspended CMMC Phase 2 in July 2026, but NIST SP 800-171 requirements remain in force for defense contractors. The pause only affects third-party certification, while self-assessments and SPRS scores are still legally required. Experts advise firms to complete gap assessments and fix security basics rather than waiting for a new Phase 2 date. A task force is reviewing the program, with potential changes including a narrower scope and updated NIST standards.
Read the full story at clarkschaefer.com.
Photo: geralt / Pixabay
