Paused, Then Silent: What the CMMC Limbo Is Doing to the Ecosystem Built to Support It

Cybersecurity Maturity Model Certification (CMMC) Unlocked · Oct 22, 2026 · 6m

After the Department of War paused CMMC Phase 2 and froze later phases, an unpublished reform report and lack of a new timeline left contractors and the assessment and training ecosystem unable to plan. The episode examines layoffs, canceled assessments, sunk costs and the risk of rebuilding capacity later, alongside evidence that assessor capacity may have been adequate and examples of other federal program freezes; it closes with a call for DoW to publish its findings and a reminder that contractors’ cybersecurity obligations and False Claims Act exposure remain.