SBA Commends U.S. Department of War’s Suspension of CMMC Phase II for Small Defense Contractors

The U.S. Department of War has suspended Phase II of its Cybersecurity Maturity Model Certification (CMMC) program, originally scheduled for November 2026, following pressure from the SBA and small business stakeholders. The suspension aims to reduce compliance costs (estimated at $388,600-$593,800 per firm) and regulatory barriers that were pushing small defense contractors out of the Defense Industrial Base, while maintaining cybersecurity protections.