Client Alert—CMMC Level 2 November Deadline Suspended Indefinitely

On July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Level 2 third-party assessment requirements, which were originally scheduled to come into effect on November 10, 2026. The announcement clarified that all CMMC Level 1 and CMMC Level 2 self-assessment requirements, which have been in effect since November 10, 2025, will remain in place. The Pentagon intends to conduct a comprehensive review of the CMMC program, raising fresh uncertainty about the long-term direction of cybersecurity compliance obligation