On July 13, 2026, the Department of War (DoW) announced the suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements. Originally, these requirements were scheduled to go into effect on November 10, 2026. While the DoW promises this change will allow the department to review the requirements and prioritize speed to capability, lowering barriers for small, medium, and non-traditional businesses, businesses that were already working toward compliance may be wondering what they should do next.
Most importantly, small firms should not treat the pause as a reason to stop preparing. The safer assumption is that the requirements are still coming, even if the timing has shifted. Contractors and subcontractors may be tempted to think they have more time, and pause progress. Continue to convey the need to move forward to prevent a last-minute scramble later.
The bottom line is businesses hoping to continue contracting with the government should use this delay to get ready, because the underlying obligations have not gone away. To do this efficiently, consider these next steps:
- Finish the basics now. Create strong access controls, multifactor authentication, limited admin rights, device inventory, backups, and a way to show proof that controls are in place. For small businesses, documentation is just as important as the control itself.
- Keep a simple readiness file. Collect policies, screenshots, training records, access reviews, and notes about fixes that have been completed. If a business is asked to self-assess or enter information into Supplier Performance Risk System (SPRS), that paperwork will save time and reduce confusion.
Remember, this pause gives small defense contractors breathing room, but it does not remove the need to prepare. Keep moving on scoping, access control, documentation, and basic cybersecurity hygiene now, so you are not caught off guard later.
If you need help preparing for Phase II, contact your CTSBDC advisor—or, if you are not already registered, request your own no-cost business advisor. CTSBDC advisors can also help Connecticut small businesses understand the early steps of government contracting, including business readiness, certifications, financial preparation, and growth planning. If your business is considering federal or state contracting opportunities, CTSBDC can help you identify what to prepare now and connect you with the right procurement and innovation resources for more specialized contracting and proposal support.
For innovative companies, CTSBDC’s SBIR/STTR Accelerator offers additional support for businesses exploring non-dilutive federal funding to research, develop, and commercialize new products or technologies. The free six-week virtual program helps eligible Connecticut small businesses better understand SBIR/STTR requirements, assess their business concept, define their technical innovation, prepare for commercialization, and strengthen their ability to pursue competitive federal grant opportunities.