In a strategic move aimed at accelerating warfighter readiness, the Pentagon has decided to partially suspend cybersecurity requirements for the defense industry. The decision specifically targets third-party assessments, which have been cited as an onerous burden, particularly for smaller defense firms. Kirsten Davies, Chief Information Officer, stated that this action supports Secretary of War Pete Hegseth’s directive to aggressively scale readiness across the force.
Farewell to complex audits: Prioritizing mission speed over administrative hurdles
The suspension affects the Phase II requirements of the Cybersecurity Maturity Model Certification (CMMC), originally scheduled to take effect on November 10, 2026. Pentagon officials emphasized that while the legal obligation for industry partners to protect federal data remains a non-negotiable priority, the goal is to eliminate the „red tape” hindering industrial growth. Michael Duffey, Undersecretary of Defense, confirmed that active solicitations and contracts will be amended immediately to halt the requirement for complex third-party audits.
The compliance bottleneck: Why the CMMC model hindered small business innovation
Internal data revealed a massive structural flaw in the program: over 100,000 businesses required assessments, yet only about 100 accredited assessors were available to conduct them. This mismatch made it mathematically impossible for small to medium-sized businesses to achieve compliance by the original deadline. A task force has been initiated to conduct a comprehensive 60-day review of CMMC, seeking to synthesize industry feedback and recommend realistic measures that lower the barrier of entry for non-traditional companies.
Data protection remains mandatory: Shifting to self-assessment under NIST standards
Despite the suspension of audits, officials insisted that cybersecurity standards are not being lowered. During the review period, the Pentagon will continue to enforce baseline compliance through the NIST SP 800-171 Rev 2 standard via self-assessments. The focus will shift toward tangible cyber hygiene rather than administrative overhead. This decision addresses long-standing complaints from defense firms that the CMMC regimen created insurmountable obstacles for companies lacking the vast resources needed for high-level bureaucratic testing.
