Pentagon Suspends CMMC Phase II Requirements Amid Cyber Operations Memo

On August 18, 2026, the Pentagon announced the suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements. This decision coincides with a White House memo that authorizes certain private sector offensive cyber operations. The National Fraud Enforcement Division's enforcement priorities were also outlined in a memo. These developments are part of a broader review initiated by the CMMC Reform Task Force, which will last for 60 days. The changes impact government contractors and private sector entities involved in cybersecurity. The episode of Crowell & Moring's podcast discusses these significant legal and regulatory developments. The implications of these changes could affect compliance and operational strategies for contractors. The DOJ's opinion on executive privilege was also addressed, indicating ongoing legal considerations in cybersecurity operations.

Key Points: • The Pentagon has suspended CMMC Phase II requirements for 60 days. • A White House memo authorizes private sector offensive cyber operations. • The National Fraud Enforcement Division outlined new enforcement priorities.