Erin Verna
Erin Verna is a Principal Product Marketing Manager at Akamai. She has spent the past six years focused on Zero Trust architectures and has more than a decade of experience in the application security field.
© 2026 Akamai Technologies
Key takeaways
-
The Department of War (DoW) suspended their Cybersecurity Maturity Model Certification (CMMC) timeline by pausing the deadline for Phase II requirements (accreditation via mandatory Certified Third-Party Assessment Organizations, C3PAOs) — originally scheduled to take effect on November 10, 2026.
-
As the newly formed CMMC reform task force focuses on streamlining the CMMC 2.0 program, the need for heightened cybersecurity standards hasn’t changed.
-
The reality is that risks are only accelerating in today’s threat landscape, especially as AI enables attackers to orchestrate multi-vector, hypervolumetric, and application-layer attacks.
-
As a result, it’s critical to remain focused on extending Zero Trust security to the edge of app, API, and workload levels.
Reducing program backlogs, not cybersecurity standards
Though CMMC II requirements are paused while the task force focuses on streamlining the program, that doesn’t mean your compliance strategy stalls. Any organization in the defense industry that handles Controlled Unclassified Information (CUI) — including commercial contractors, research centers, and government facilities — must remain aligned with current CMMC assessment mandates as well as relevant contract terms.
Maintaining compliance: 4 essential considerations for CMMC strategy
Here are four important things to keep in mind:
All CMMC Phase I self-assessment requirements remain firmly in place and fully enforceable. Maintain active compliance with current baseline security protocols.
Compliance remains strictly aligned with the NIST SP 800-171 Rev. 2 framework. Continue to demonstrate adherence to baseline cybersecurity requirements. There is still a responsibility to align with mandates of the DFARS 252.204-7012 clause, requiring continuous adherence to the 110 security controls of NIST SP 800-171.
At its core, CMMC relies on Zero Trust principles. Mature your Zero Trust architecture approach to help you meet interim DoW requirements and long-term security architecture goals.
CMMC certification levels depend on government-led assessments. Expect appropriate oversight from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) — which continues to carry out many of these assessments — and other assessors during this pause.
An interim action plan
To help your team stay on track, ensure that you satisfy the immediate Phase I self-assessment and National Institute of Standards and Technology (NIST) standards.
The table lists good ways to tie five major compliance milestones to approaches and solutions that deliver on core Zero Trust requirements.
| Milestone | Target action | Supporting approach/solutions |
|---|---|---|
1. Enforce identity and access perimeters |
| Access control and Zero Trust: Follow the principle of “least privilege” to ensure identity-based, per-request access via ZTNA within the enterprise but also at the tactical edge (mapping to the identification, authentication, and access control families of NIST SP 800-171). This should also include DNS security to block known malicious domains (e.g., botnets, phishing links, and malware-injection sites). The National Security Agency provides Akamai GovShield for Protective DNS at no cost to small and medium-sized Defense Industrial Base (DIB) contractors to help meet these security standards. |
2. Ensure enclave and transmission security |
| Network segmentation and data protection: Prevent lateral movement within your network through microsegmentation and protect CUI during transmission. |
3. Automate oversight and tracking |
| Audit and accountability: Use DNS Posture Management to automate alignment to security frameworks and monitor system configuration. |
4. Perform NIST SP 800-171 self-assessment |
| Phase I self-attestation baseline: Satisfy the mandatory core hygiene checking required by the DoW during Phase II suspension. For additional guidance, refer to the NIST risk management framework. |
5. Upload scores to SPRS |
| Stay up to date: Maintain your active standing for any pending RFI and future DoW contracts. |
Use this table to help ensure that your solutions meet Zero Trust requirements
Preventing unauthorized data exposure
As defense contractors begin using AI assistants and automated agents to process complex proposals and engineering data, CUI and FCI access paths are becoming dynamic and machine-driven. Traditional boundary controls cannot audit how large language model pipelines retrieve local data. Extending Zero Trust to the edge ensures that automated AI workflows, service-to-service APIs, and nonhuman identities strictly adhere to NIST SP 800-171 least-privilege policies — preventing unauthorized data exposure before compliance audits take place.
The bottom line
While CMMC Phase II is paused, it’s vital to stay committed to the strongest defense. By prioritizing automated auditing, strict network segmentation, and Zero Trust access control, you can stay on track with Phase I self-assessment mandates while remaining ready for any future CMMC Reform Task Force guidance — including any future government-led assessments for organizations pursuing higher CMMC levels.
At Akamai, we can help you navigate CMMC and this latest shift. We partner with defense organizations worldwide to help strengthen their overall Zero Trust posture across all environments, from the enterprise to the tactical edge. To learn more about our Zero Trust defense solutions and how you can achieve your compliance and security goals, reach out to one of our experts today.
About the Author(s)