Department of War action delays certain CMMC Phase II assessment requirements, but defense contractors and subcontractors remain responsible for protecting federal data and maintaining required cybersecurity controls.
IRVINE, CA, July 15, 2026. Dochterman Insurance, a specialized brokerage focused exclusively on American manufacturers, today issued guidance for manufacturers seeking to understand the practical impact of the Department of War’s July 13, 2026 announcement suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements.
The most important message for manufacturers is straightforward: the Department of War has paused the next phase of certain CMMC assessment requirements, but it has not removed the obligation to protect federal data.
CMMC Phase II was originally scheduled to take effect on November 10, 2026. That phase would have expanded the use of third-party assessments for many companies seeking CMMC Level 2 certification. The Department of War has now suspended that Phase II rollout while it conducts a broader review of the CMMC program.
However, the Department’s announcement makes clear that all Phase I self-assessment requirements remain in place. During this interim period, the Department has stated that it will continue enforcing cybersecurity compliance with NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments, with an emphasis on practical cyber hygiene rather than unnecessary administrative burden.
“Manufacturers should not mistake a pause in Phase II for a pause in responsibility,” said Michael Dochterman, CEO of Dochterman Insurance. “The government may be reviewing how CMMC is assessed, but the underlying need to protect federal data remains. For manufacturers in the defense supply chain, this is not the time to stop. It is the time to get organized, understand your exposure, strengthen your controls, and be prepared to demonstrate your cybersecurity posture.”
What Changed
The Department of War has suspended the CMMC Phase II rollout that would have broadened the requirement for many CMMC Level 2 companies to undergo assessment by a Certified Third-Party Assessment Organization, often referred to as a C3PAO.
In plain English, this means some manufacturers that were preparing for a mandatory outside assessment by November 10, 2026 may now have more time while the Department reviews and potentially reforms the program.
What Did Not Change
The pause does not eliminate cybersecurity requirements for defense contractors and subcontractors. Companies that handle federal contract information, covered defense information, or controlled unclassified information still have obligations under their contracts and applicable federal clauses.
The Department specifically stated that defense contractors and subcontractors remain contractually obligated to safeguard covered defense information under DFARS 252.204-7012. That clause is central to the obligation to protect sensitive defense information and to report certain cyber incidents.
In addition, Level 1-style safeguards for Federal Contract Information remain part of the compliance landscape through Phase I self-assessment requirements. For many manufacturers, these controls represent the basic security foundation customers expect: controlling access, protecting systems, limiting unauthorized users, safeguarding information, and maintaining responsible cyber practices.
Why NIST SP 800-171 Still Matters
For manufacturers that handle Controlled Unclassified Information, NIST SP 800-171 Rev. 2 remains the practical security framework. It is substantially aligned with the CMMC Level 2 control set. That means the core cybersecurity work has not gone away simply because the timing of certain third-party assessments has changed.
Put simply: the assessment process may be under review, but the security controls still matter.
Manufacturers should continue focusing on practical, measurable controls such as multi-factor authentication, endpoint detection and response, secure backups, patch management, email security, incident response planning, employee training, access control, encryption, and network segmentation.
What Manufacturers Should Do Now
Dochterman recommends that manufacturers use this interim period productively rather than waiting for the final CMMC reform outcome.
- Determine whether the company handles Federal Contract Information, Controlled Unclassified Information, covered defense information, export-controlled technical data, or sensitive customer engineering files.
- Review current contract language, purchase orders, flow-down clauses, and customer security questionnaires to understand what is actually required.
- Complete or update the applicable self-assessment and confirm that required records, scores, and affirmations are accurate.
- Assess current cybersecurity controls against NIST SP 800-171 Rev. 2 where Controlled Unclassified Information is involved.
- Prioritize remediation of high-impact gaps such as MFA, endpoint protection, secure backups, patching, access control, incident response, email security, and network segmentation.
- Document the environment through policies, procedures, a System Security Plan, a Plan of Action and Milestones, training evidence, backup testing records, and incident response materials.
- Coordinate cybersecurity improvements with cyber insurance strategy, because underwriters increasingly evaluate the same controls when determining available terms, pricing, and coverage conditions.
“This announcement may reduce near-term assessment pressure for some companies, especially small and mid-sized manufacturers,” Dochterman said. “But it does not change the direction of the market. Prime contractors, OEM customers, federal buyers, and cyber insurers all want evidence that manufacturers can protect sensitive data. The companies that keep moving now will be in a stronger position when the Department completes its review.”
A Practical Bottom Line
For manufacturers, the practical impact of the Department of War announcement can be summarized this way:
- Paused: The Phase II expansion of certain CMMC third-party assessment requirements.
- Still active: Phase I self-assessment requirements.
- Still active: The obligation to protect covered defense information under DFARS 252.204-7012.
- Still relevant: NIST SP 800-171 Rev. 2 as the primary cybersecurity framework for companies handling Controlled Unclassified Information.
- Still important: Strong cyber controls for customer qualification, contract eligibility, operational resilience, and cyber insurance underwriting.
Dochterman’s position is that manufacturers should welcome the additional time, but not waste it. The pause gives companies an opportunity to reduce confusion, improve cybersecurity in a practical way, and align compliance, operations, and insurance before the next phase of the federal program is finalized.
About Dochterman Insurance
Dochterman Insurance is a specialized brokerage focused exclusively on American manufacturers, serving metal manufacturing, plastics manufacturing, heat treating, and metal distribution and service centers across the continental United States.
The firm’s singular focus on manufacturing gives it deep familiarity with the operational, contractual, cyber, and insurance risks manufacturers face. Dochterman helps manufacturers navigate cybersecurity and insurance issues tied to NIST SP 800-171, CMMC, Controlled Unclassified Information, federal contracting requirements, customer security expectations, and cyber insurance underwriting.
Dochterman Insurance is endorsed by the NTMA, the Metal Treating Institute, PAC-WEST, and the CAM Workforce Foundation.
For more information, visit Dochterman.com, email info@dochterman.com, or call (626) 217-9000.
Media Contact
Dochterman Insurance
Michael Dochterman, CEO
2020 Main St., Suite 210
Irvine, CA 92614
Phone: (626) 217-9000
Email: michael@dochterman.com
Web: Dochterman.com
Source Note
This release references the Department of War’s July 13, 2026 announcement, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements,” including the Department’s statements that Phase I self-assessment requirements remain in place, that NIST SP 800-171 Rev. 2 compliance will continue to be enforced through self-assessments and select government-led assessments, and that contractors and subcontractors remain obligated to protect covered defense information under DFARS 252.204-7012.
This communication is provided for informational purposes only. It is not legal advice, does not issue or guarantee CMMC certification, and does not bind or modify insurance coverage. Cyber insurance terms, pricing, and availability are subject to carrier underwriting, eligibility, policy terms, loss history, and market conditions.
