战争部暂停网络安全认证第二阶段：原定11月10日生效，承包商自评要求不变
美国战争部于2026年7月13日宣布，立即暂停网络安全成熟度模型认证（CMMC）第二阶段要求的过渡实施。该阶段原定于2026年11月10日生效，要求处理受控非密信息的国防承包商在获得合同前通过第三方评估机构的二级认证评估。战争部同时宣布，第一阶段的自我评估要求全部保留，现行全部招标与合同中的待定及未来 CMMC 实施节点一并暂停。
战争部首席信息官 Kirsten A. Davies 表示，此举是为落实战争部长 Pete Hegseth 关于降低中小企业合规门槛的指示，部门同步启动一项为期60天的研究，重新审视该计划的未来。Davies 说，强有力的网络安全与运行韧性对保护美国创新、支撑作战人员战备仍然至关重要，部门相信国防工业基础可以在减少不必要行政繁文的同时做到两者兼顾。
战争部负责采办与保障的副部长 Michael Duffey 表示，部门有减少官僚程序的战略必要，首席信息官的决定在维持严格安全基线的同时，消除了令企业不堪重负的成本，让创新者与竞争在国防供应链中继续生长。
战争部称，现行 CMMC 计划本为提升国防工业基础的网络安全，但实际造成了高昂的合规成本与行政负担；包括小企业管理局报告在内的数据显示，合规压力正把创新企业挤出国防工业基础，可能延误关键能力交付作战人员的时间。Davies 办公室为此设立 CMMC 改革工作组，对认证计划进行自上而下的全面审查，汇总部门就合规挑战发布的公开信息征询所收到的行业反馈，在60天内向首席信息官提交最终报告，提出更现实、可扩展的安全措施。
暂停期间，战争部将依据 NIST SP 800-171 修订版第2版标准，通过企业自我评估与政府抽选评估执行网络安全合规，把重点放在实际的网络卫生上，而非行政负担上。
战争部同时强调，此次暂停并不免除企业保护联邦数据的义务：所有国防承包商与分包商仍须按《国防联邦采办条例补充规定》第252.204-7012条的合同义务，保护其所处理的受覆盖国防信息。（来源：美国战争部）
Department of War Suspends CMMC Phase II: Rollout Set for November 10 Halted, Self-Assessments Stay
The U.S. Department of War announced on July 13, 2026, the immediate suspension of the transition to Phase II requirements of the Cybersecurity Maturity Model Certification (CMMC) program. Phase II had been scheduled to take effect on November 10, 2026, and would have required defense contractors handling controlled unclassified information to obtain Level 2 certification through third-party assessments as a condition of contract award. The Department said all Phase I self-assessment requirements remain firmly in place, and that pending and future CMMC implementation milestones across Department of War solicitations and contracts are also suspended.
Kirsten A. Davies, the Department's Chief Information Officer, said the move supports Secretary of War Pete Hegseth's directive to reduce compliance barriers for small and medium sized businesses, and that the Department is initiating a 60-day study of the future of the program. Davies said robust cybersecurity and operational resilience remain critical to protecting American innovation and supporting warfighter readiness, and that the defense industrial base can achieve both while unnecessary government red tape is reduced.
Michael Duffey, Under Secretary of War for Acquisition and Sustainment, said the Department has a strategic imperative to reduce bureaucracy as it builds the Arsenal of Freedom, and that the decision maintains a strict security baseline while removing paralyzing costs and keeping innovators and competition growing in the defense supply chain.
The Department said the current CMMC program, though designed to enhance defense industrial base cybersecurity, has instead created prohibitive compliance costs and bureaucratic burdens. Recent data, including reports from the Small Business Administration, confirmed that CMMC compliance is forcing innovative companies out of the defense industrial base, which will delay delivery of critical capabilities to warfighters. The Chief Information Officer's office is establishing a CMMC Reform Task Force to conduct a top-to-bottom review of the certification program, synthesize industry feedback from a public Request for Information on compliance challenges, and deliver its final report to the CIO within 60 days with realistic, scalable security measures.
During the interim period, the Department will enforce cybersecurity compliance with the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments, focusing on tangible cyber hygiene rather than administrative overhead.
The Department stressed that the action does not eliminate the requirement for companies to protect federal data: all defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012. (Source: U.S. Department of War)
来源：美国战争部
发布：GSM·美国（发布链接）
图片来源：图：五角大楼，美国战争部总部（联邦固定图库）。 / Photo: The Pentagon, headquarters of the U.S. Department of War (federal asset library).
GSM Global · 本篇英文版 English edition of this story
