CMMC Phase II Is Paused, But Contractors’ Data-Security Obligations Are Not

The recent pause affecting the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase II has understandably generated questions across the Defense Industrial Base (DIB). For many organizations, the immediate reaction has been to ask whether compliance timelines will shift, whether assessment preparation can be slowed, or whether security investments can be deferred until additional guidance emerges. Those questions are understandable. They are also focused on the wrong issue. While implementation timelines may evolve, the underlying security requirements that drove CMMC’s creation have not changed. The Department of Defense still depends on contractors to protect Controlled Unclassified Information (CUI). Adversaries continue targeting defense contractors, supply chains, and critical technology providers. Federal cybersecurity expectations remain in place. And the contractual…