CloudFit: CMMC Phase II Pause Leaves DFARS, NIST Duties Intact
United States – October 20, 2026 -- CloudFit said the Department of War's pause on parts of the CMMC rollout does not change cybersecurity obligations for the more than 220,000 organizations in the Defense Industrial Base (DIB) that are entrusted with protecting Controlled Unclassified Information (CUI).
CloudFit says DFARS and NIST requirements remain in force
The company said the implementation timeline for portions of CMMC may be changing, but obligations to safeguard sensitive information under DFARS and NIST requirements have not been paused. It added that cyber threats have not paused either.
Cost and complexity block adoption across the DIB
CloudFit argues that compliance mandates alone will not secure the DIB. It says many companies have had to choose between expensive custom implementations, delaying security investments, or attempting compliance on their own. In its view, that model does not scale to the size of the DIB.