As of 1 September 2026, CMMC remains in a critical transition. The Department of War CIO has suspended the transition to Phase 2 through 1 December, while retaining NIST SP 800-171 Rev. 2 obligations, SPRS reporting and affirmation, and the ability to conduct government-led assessments. This week, DoW CIO Kirsten Davies discussed the reform effort at DIBX on 26 August.
What I would tell an Intuitus client today
Not this: “CMMC has been paused, so wait.”
This
“The Department has paused expansion of CMMC certification while it redesigns how compliance will be validated. Your obligation to protect CUI, implement NIST SP 800-171 Rev. 2, maintain an accurate SPRS assessment and affirm your cybersecurity posture remains. The safest strategy is therefore to continue closing security gaps while avoiding unnecessary spending driven solely by the previous Phase 2 certification timetable.”
Strategic opportunity
If CMMC evolves away from periodic certification toward risk-based or continuous validation, external attack-surface intelligence, third-party risk, ransomware susceptibility, credential exposure, dark-web intelligence and continuous monitoring become more — not less — relevant.
The next milestone
Watch September very closely. The original 13 July announcement gave the CMMC Reform Task Force 60 days to deliver its final report to CIO Davies. That report — or the policy announcements following it — could be the most consequential change to CMMC since the 2024/2025 final rules.
What this means for the DIBCAC / CIO relationship
| Who | What they are doing |
|---|---|
| DoW CIO | Redefining CMMC policy and future architecture |
| CMMC Reform Task Force | Evaluating RFI responses and developing recommendations |
| Acquisition & Sustainment | Ensuring acquisition implementation aligns with the suspension |
| DIBCAC | Remains the government’s high-assurance cybersecurity assessment capability |
| C3PAO ecosystem | Remains in existence, but expansion of mandatory certification through Phase 2 is suspended |
| DIB contractors | Remain responsible for protecting CUI and accurately representing their cybersecurity posture |
If the revised CMMC model moves toward a risk-based system where most companies self-attest but the government selectively validates higher-risk suppliers, this distinction becomes critical. This is not yet announced policy, but the current structure makes such an approach entirely plausible.
The strategic shift I see emerging
From certification, compliance and contract eligibility to cybersecurity, operational resilience, risk validation and mission assurance.
DoW’s July announcement emphasized replacing bureaucratic compliance with “scalable, resilient cybersecurity measures.” Davies’ DIBX discussion reinforced modernizing digital infrastructure, reducing compliance friction, and creating a secure and agile ecosystem.
Reform discussion will focus on some combination of:
- Risk-based assessments
- Stronger self-attestation
- Selective government validation
- Continuous cybersecurity evidence
- Reduced burden for low-risk and small suppliers
The exact formula remains unknown until the Task Force reports.
Key takeaways
- CMMC is in transition, not elimination.
- Your cybersecurity obligations remain in force.
- Risk-based validation and continuous monitoring are rising in importance.
- Stay informed and be ready to adapt quickly when new guidance is released.
Intuitus is here to help you navigate change, reduce risk, and protect your mission.
Notice: this update is compiled from third-party resources and public information available as of 1 September 2026. Policies and dates are subject to change. Intuitus is not affiliated with the Department of War, DIBCAC, or any government entity.