Pentagon hits pause on contractor cybersecurity rule

The Pentagon has paused the rollout of its Cybersecurity Maturity Model Certification framework, a regime that would have required defense contractors to undergo independent security audits before winning certain contracts. The freeze affects the third-party assessment requirement that was set to phase in across the industrial base. A new task force will now review the program.

The pause arrives after years of delayed implementation and contractor frustration. CMMC was designed to verify that companies handling sensitive defense data meet baseline cybersecurity standards, moving beyond self-attestation. But the compliance burden—particularly for small and mid-size suppliers—has drawn pushback, and the rulemaking process stretched longer than expected.

Inside Defense reports that the task force will assess the program's structure and timeline. The Pentagon has not announced when assessments might resume or what changes may follow. For contractors who invested in preparation, the delay introduces fresh uncertainty. For those who hoped the requirement would never land, it offers temporary relief but no long-term clarity.

The move reflects a broader tension in defense procurement: the need to harden supply chains against intrusion versus the friction that new mandates create for an ecosystem already strained by budget pressure, talent shortages, and regulatory load. The task force is expected to report findings in the coming months, but the pause itself signals that the Pentagon is reconsidering pace, scope, or both.