As of November 3, 2026

For small and midsize defense contractors, cybersecurity compliance has never been just a policy question. It affects whether a company can afford to compete, how much time its staff can spend on its actual work, and whether it can keep sensitive government information safe without building an enterprise-sized IT department.

That is why one phrase in the Department of War’s July 13 CMMC announcement deserves close attention: “lowering barriers for small, medium, and non-traditional businesses.” The Department did not announce that cybersecurity requirements are going away. It announced a pause in the planned move to CMMC Phase II while it reviews the program and considers how to preserve security while reducing unnecessary cost and friction.

For smaller businesses, that distinction matters. The question is not simply whether CMMC is paused. It is what a lower-barrier approach could look like—and what contractors still need to do while the Department works through that question.

What the Department announced

The Department of War announced that it was immediately suspending CMMC Phase II requirements, which had been scheduled to begin on November 10, 2026. The announcement also said that Phase I self-assessment requirements remain in place and that a CMMC Reform Task Force would review the program. During the interim period, the Department said it would enforce the NIST SP 800-171 Revision 2 baseline through self-assessments and select government-led assessments.

The Department’s CMMC information page describes the program as paused in Phase I. It lists Level 1 self-assessments and Level 2 self-assessments among the assessment requirements during this period. The Department’s announcement also states that the pause does not remove contractors’ obligations under DFARS 252.204-7012 to safeguard covered defense information.

In other words, the pause changes the planned assessment path. It should not be read as permission to stop protecting covered information or to disregard the requirements in a particular contract.

Why “lowering barriers” matters

A large contractor may have dedicated cybersecurity staff, compliance counsel, and a budget for outside assessors and consultants. A small machine shop, engineering firm, software company, or specialty supplier may have a handful of employees—and one person wearing several IT hats.

For that smaller organization, the burden can come from more than the price of a formal assessment. It may include the time needed to interpret requirements, document processes, identify where covered information is handled, secure systems, train staff, and maintain evidence. Conflicting instructions or unclear markings can add extra work and uncertainty. Those costs can affect whether a company decides to pursue defense work at all.

The Department’s stated goal—reducing barriers while maintaining robust cybersecurity—recognizes a real challenge: a program can have sound security goals and still be difficult for smaller suppliers to implement consistently. Making the path clearer and more proportional could help more capable businesses remain in the defense industrial base, while keeping protections focused on the information and systems that need them.

What a lower-barrier approach could mean

The Department has not yet announced a replacement framework or a final list of reforms. The following are practical possibilities to watch for, not confirmed policy changes:

• Clearer contract requirements. Contractors need to know what information is covered, which security requirements apply, and what evidence is expected. Consistent instructions could reduce rework and guesswork.
• More consistent CUI identification and marking. The DoW CIO has reported that industry feedback and listening sessions raised concerns about inconsistent government CUI designation and portion markings. Clearer handling instructions could help suppliers scope protection correctly.
• A more manageable path for smaller organizations. The Department may consider ways to make implementation and assessment more achievable for small and non-traditional businesses. What that means in practice remains to be determined.
• Less duplicated administrative work. If organizations can demonstrate that safeguards are operating through clear, reusable evidence, they may spend less time recreating documentation and more time maintaining effective security.

These are examples of what a lower-friction program might address. They are not a forecast of the Department’s final decisions. Contractors should rely on official DoW guidance and their contract documents for current requirements.

What contractors should do now

A pause in Phase II is a reason to review your plan, not to put cybersecurity on hold. Practical next steps include:

1. Read the contract. Identify the clauses and cybersecurity obligations that apply to your company. Ask your contracting officer or prime contractor to clarify any conflicting or unclear direction.
2. Know where covered information lives. Identify the systems, users, vendors, and workflows that store, process, or transmit Federal Contract Information or Controlled Unclassified Information.
3. Keep improving the fundamentals. Maintain access controls, multifactor authentication where required, secure configurations, patching, backups, incident response, and staff awareness. Good security reduces risk whether an assessment is scheduled or not.
4. Keep your evidence current. Policies, inventories, procedures, training records, and system documentation should reflect how your environment actually works. Accurate records make it easier to manage changes and respond to assessments or contract questions.
5. Avoid expensive decisions based on speculation. Before making major purchases or abandoning work already underway, confirm what your active contract requires and check for current official guidance.

The Department’s official announcement and its CMMC resources page are good starting points. Requirements can depend on contract language and later official direction, so confirm how they apply to your specific situation.

The standard to watch

The most useful measure of CMMC reform will be whether it makes requirements easier to understand and implement without leaving sensitive information exposed. Lowering barriers should mean removing avoidable confusion, duplicated effort, and costs that do not improve security. It should also mean giving businesses a realistic path to protect information and show that their safeguards work.

For small and non-traditional suppliers, that balance could determine whether they can continue contributing to defense work. For the Department, it is a chance to make cybersecurity both more practical and more resilient across the industrial base.

The Phase II pause is confirmed. The shape of any replacement approach is still under review. Until official changes are published and incorporated into applicable contracts, contractors should protect covered information, follow their current obligations, and watch for authoritative updates.

---

This article is for general information and is not legal or contract-specific advice. Always verify requirements against your contract and current official guidance.

Suggested excerpt: The Department of War paused CMMC Phase II while reviewing how to lower barriers for small and non-traditional defense businesses. Here is what the pause changes, what remains in force, and what contractors can do now.

Suggested SEO description: CMMC Phase II is paused, but cybersecurity obligations remain. Learn what the Department’s “lowering barriers” goal could mean for small defense contractors—and what is confirmed today.