The Pentagon's Biggest Cyber Rule Came Due This Week. It Never Showed Up.

Tuesday, November 10, 2026, was supposed to be one of the most consequential compliance deadlines in the history of American defense contracting. Under the program's published rollout schedule, it was the day Phase 2 of the Pentagon's Cybersecurity Maturity Model Certification program — CMMC — took effect. From that day forward, whenever a contract carried the CMMC requirement and involved Controlled Unclassified Information, the default was that a contractor had to pass an independent third-party cybersecurity assessment before it could win the award.

The deadline arrived. Nothing happened.

Phase 2 has been in suspended animation since July 13, when the Department of War's Chief Information Officer, Kirsten A. Davies, announced its "immediate suspension" in a press release titled "Forging the Arsenal of Freedom." The department promised a 60-day top-to-bottom review by a newly created CMMC Reform Task Force. That review window closed in mid-September. Two months later, the task force's report remains unpublished, the department has declined to answer journalists' questions about it, and the start date of the biggest cybersecurity mandate ever imposed on the defense industrial base came and went without so much as a status update.

For a rule that took seven years to build, the silence is the story.

Seven years of rulemaking, one memo to stop it

CMMC was born in 2019, during the first Trump administration, as the Pentagon's answer to a problem it had publicly admitted it could not fix with trust alone: sensitive military technical data was leaking out of the defense supply chain, not through the Lockheeds and RTXs of the world — whose networks are hardened and government-assessed — but through the tens of thousands of small subcontractors who machine the parts, write the code, and handle the engineering drawings.

The fix was audacious in scope. Every company touching Controlled Unclassified Information would implement all 110 security controls in NIST Special Publication 800-171. Self-assessment first, then — this was the teeth — independent certification by an accredited third-party assessor (a "C3PAO" in the program's jargon) as a condition of contract award. The rollout was phased: self-assessments from November 10, 2025. Third-party assessments by default from November 10, 2026. CMMC requirements in essentially all applicable defense contracts by November 10, 2028.

Phase 1 happened on schedule last year. Phase 2 is the one that died in the drawer.

The department's stated reason was cost. In announcing the suspension, Davies said the program's "prohibitive compliance costs, severe shortages in third-party assessment capacity, and complex regulatory timelines" were "actively forcing innovative new entrants and small businesses to opt out" of defense contracts. The Small Business Administration — which publicly applauded the suspension the same day — put numbers on it: more than 120,000 small businesses in the defense industrial base would have needed to comply through a system supported by only about 100 approved assessors, at an estimated $593,800 per third-party certification and $388,600 for a self-assessment.

Those numbers deserve scrutiny — they bundle the cost of actually implementing security controls with the cost of having someone check the work. But the capacity math was never in dispute: 120,000 companies cannot pass through 100 assessors in any timeline the regulation contemplated. The queue was the argument.

Briefings like this are what a free AlphaBriefing membership gets you — join free at AlphaBriefing.com.

The rest of this briefing is free — it just requires a free AlphaBriefing account: the compliance economy that just got stranded mid-build, why the enforcement risk moved to the Justice Department instead of disappearing, the leaked task force options that point to a narrower restart, and the watch list of dates that decide what comes back.

Create your free account → — 30 seconds, no card.