Imprimis Inc. Customer Advisory (July 14, 2026)
DoD Announces Review of CMMC Assessment Requirements
The Department of Defense (DoD) has announced a pause in the planned rollout of third-party Cybersecurity Maturity Model Certification (CMMC) Level 2 assessments conducted by Certified Third-Party Assessment Organizations (C3PAOs) while it conducts a 60-day review of the overall CMMC program.
===
Imprimis Inc. Customer Advisory (July 14, 2026)
DoD Announces Review of CMMC Assessment Requirements
The Department of Defense (DoD) has announced a pause in the planned rollout of third-party Cybersecurity Maturity Model Certification (CMMC) Level 2 assessments conducted by Certified Third-Party Assessment Organizations (C3PAOs) while it conducts a 60-day review of the overall CMMC program.
This is a pause for 60 days. The program has not terminated.
CMMC Level 2 Self-Assessments will continue to be required where applicable and remain part of the current DoD implementation, and full and complete implementation of NIST 800-171 is expected as of this time. You may recall that NIST 800-171 has identical cybersecurity requirements to CMMC Level 2.
What This Means for Defense Contractors
• The certification portion of the compliance process has been put on hold for 60 days- everything else remains.
• Compliance and the protection of CUI remain key requirements and certification will be back again after the DoW review.
• The good news is DoW wants to reduce the cost of certification and concentrate on cybersecurity.
Imprimis Inc.'s Position
We have seen this program change many times- from 51 requirements from the NIST 800-53 catalog in 2013, to NIST 800-171( 2015), to CMMC through 2 versions, from “just check a box” to self-attestation and now to certification, through at least four different administrations.
The program has changed, but it has never gone away. Nor will it.
The need for cybersecurity is here to stay. Compliance and proof of compliance, in some manner, will be required by the government, and rightly so. Our recommendation is to stay the course, just don’t call the C3PAO yet.
Our Commitment to Clients
Imprimis Inc. remains committed to helping contractors establish practical, cost-effective, and well-documented cybersecurity programs that satisfy today's requirements while positioning them for future regulatory changes. Our focus continues to be on helping clients achieve and maintain compliance- at their pace, demonstrate readiness through objective evidence, and build defensible security programs that support long-term success within the Defense Industrial Base.
We will continue monitoring developments closely and provide updates as additional guidance is released by the DoD/DoW.
Additional Resources
• DoW News Release: Forging the Arsenal of Freedom – Department of War Suspends CMMC Phase II Requirements
• Additional Program Information: Brilliant Basics Initiative
Disclaimer: This communication is provided for informational purposes only and should not be construed as legal advice. Contractors should review applicable contract requirements and consult appropriate legal or compliance professionals regarding their specific obligations.
About Imprimis Inc.
Imprimis Inc. provides the DIB with the tools, training, and expertise necessary to "Turn Technology into Capability." Their flagship i2ACT 4.0 Assessment Compliance Software is utilized by contractors nationwide to manage, maintain, and prove cybersecurity compliance in the most demanding regulatory environments. For More Information about Imprimis: https://www.imprimis-inc.com/home/history
#
Mike Schmidt
Business Development Director
Imprimis, Inc.
Colorado Springs, CO
Email: mike.schmidt@imprimis-inc.com
Phone: 719-463-0333 x 5