CMMC Phase II Suspension Requires Reconsideration of Such Requirements in Solicitations

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights.

With respect to solicitations that have already been issued or will be issued during the coming CMMC Reform Task Force review of CMMC, contractors should work to ensure that agencies remove reference to CMMC Phase II requirements from the solicitation. While the onus is on agencies to modify their solicitations to comply with the memo, should agencies not remove such requirements, a risk remains that agencies could enforce the as-written evaluation criteria and any unsuccessful offerors impacted by such application would face an uphill battle attempting to challenge application of unambiguous solicitation terms. As such, offerors should use the Q&A process and even consider a pre-award protest to secure removal of CMMC Phase II requirements.  

For procurements in which the proposal submission due date has already passed, but award has not yet been made, contractors that had been unable to comply with the CMMC requirements applicable at the time of proposal submission and, therefore, had not submitted an offer, may now have a potential argument that they were improperly excluded from the competition — although the nuances of such an argument will depend on whether the procurement is subject to the Federal Acquisition Regulation (FAR) Overhaul or the pre-overhaul FAR. 

For procurements subject to the pre-overhaul FAR, FAR 15.206(a) provides that, “[w]hen, either before or after receipt of proposals, the Government changes its requirements or terms and conditions, the contracting officer shall amend the solicitation.” For procurements subject to the FAR Overhaul, RFO 15.106(a) merely provides that, “[w]hen the Government changes its requirements or terms and conditions, the contracting officer must amend the RFP” but that “[a]mendments issued after the established time and date for receipt of proposals must be issued to all offerors that have not been eliminated from the competition.” Nonetheless, both versions of the FAR mandate cancellation of a procurement — regardless of the stage of the acquisition — for requirements changes that are so substantial it exceeds what prospective offerors reasonably could have anticipated as a change to the solicitation and additional sources likely would have submitted offers had the change been in the solicitation. See RFO 15.106(e)(2); FAR 15.206(e).

Under these provisions, contractors that were prevented from competing for procurements based upon the now-suspended CMMC requirements should consult with their counsel about whether it may be possible to challenge an agency’s failure to cancel and resolicit for its needs in light of these changed requirements.