Summarize with AI
Open this article in your favorite AI assistant for a quick summary.
LAS VEGAS, NV, July 16, 2026 - MSPAlliance, the global association and certification body for managed service providers, today applauded the U.S. Department of Defense’s decision to suspend implementation of Phase II of the Cybersecurity Maturity Model Certification (CMMC) program. MSPAlliance said the pause creates an opportunity to improve the program while preserving the cybersecurity protections required throughout the Defense Industrial Base (DIB).
The Department of Defense recently announced a temporary suspension of CMMC Phase II while it reviews the program and evaluates improvements intended to reduce unnecessary compliance burdens without compromising national security.
MSPAlliance said the pause should not be viewed as a retreat from cybersecurity, but as a chance to make CMMC more effective, more accessible, and more closely aligned with the operational realities of the organizations expected to comply.
MSPAlliance has consistently supported the goals of CMMC and the need for stronger cybersecurity across the defense supply chain. At the same time, the organization has warned that the current implementation places disproportionate financial and operational burdens on contractors, particularly small and medium-sized businesses that play a critical role in supporting the U.S. military.
“The Department of Defense has taken an important step by recognizing that cybersecurity and practical implementation must go hand in hand,” said Charles Weaver, CEO of MSPAlliance. “Strong cybersecurity is not achieved through unnecessary bureaucracy. It is achieved through standards that organizations can realistically implement while continuing to innovate and support our national defense.”
MSPAlliance believes the review period offers an opportunity to modernize the certification framework by:
- Reducing unnecessary administrative complexity
- Improving affordability for small and mid-sized defense contractors
- Expanding the availability of qualified assessments
- Maintaining rigorous cybersecurity standards based on measurable outcomes