Defense Tech BaseCMMC Phase II suspension: what to check before choosing support
The CIO's July 13, 2026 announcement suspends Phase II requirements and says Phase I self-assessment requirements remain in place.
What this means for your next step
Start with the requirement in your actual solicitation or contract. The announcement changes the Phase II rollout; it does not say every cybersecurity obligation has ended.
Before commissioning work, ask a provider to distinguish support for current contractual requirements from preparation for a future assessment. Request a scope that identifies the covered systems, information, deliverables, and assumptions about the rollout.
Consultants, managed service providers, and assessment organizations perform different roles. Compare those roles before comparing prices. Recheck the official CIO announcement and linked implementation memos when making a decision.