DoD CMMC Review Draws 997 Responses, but Key Requirements Remain in Place

The Department of Defense (DoD) is reviewing its Cybersecurity Maturity Model Certification (CMMC) program after receiving 997 responses to its request for information. Of those responses, 509 came from the defense industrial base, giving DoD substantial feedback from the contractors and suppliers that would be affected by implementation. The response volume signals significant industry interest, but it does not itself establish a policy change or determine what DoD will recommend following its review.

Respondents described costs and implementation challenges as being tied primarily to the underlying NIST SP 800-171 controls. The reported average CMMC assessment cost among the respondents cited was $47,000. That figure should not be treated as the total cost of achieving and sustaining compliance: contractors need to distinguish the assessment expense from the broader work of implementing, documenting, and maintaining the required security controls. For procurement planning, that distinction matters because readiness costs can extend beyond the assessment event and affect bid pricing, staffing, and contract execution.

DoD’s review findings and final recommendations are still pending. The source reporting also notes that the department plans CMMC listening sessions as questions continue around the review. Former official performing the duties of DoD CIO Katie Arrington said, “When it comes to the challenges of CMMC, DoD is still back to ground zero because there was nothing in the RFI that talked about moving away from those requirements.” Her comment underscores that the RFI responses, as described, do not indicate that DoD intends to remove the underlying requirements. Contractors should therefore avoid assuming that the review will eliminate or materially relax existing control obligations.

For companies pursuing DoD work, the near-term acquisition milestone is the expected appearance of CMMC Level 2 requirements in DoD contracts beginning in November 2026. This is not a universal certification deadline for every vendor. The effect will depend on the specific solicitation, contract clauses, and work involved. Contractors should review applicable requirements as they appear, assess their current NIST SP 800-171 implementation status, and budget separately for control implementation and assessment. Until DoD issues final guidance, monitoring official updates and contract-specific language is more prudent than making compliance decisions based on speculation about the review’s outcome.

• DoD received 997 RFI responses, including 509 from the defense industrial base.
• Respondents identified cost and implementation challenges primarily with the underlying NIST SP 800-171 controls.
• The reported average CMMC assessment cost among respondents cited was $47,000; it is not a measure of total compliance costs.
• DoD’s review findings and final recommendations remain pending, and the RFI responses do not establish a final policy decision.
• CMMC Level 2 requirements are expected to begin appearing in DoD contracts in November 2026.
• November 2026 is not a universal certification deadline; contractors should evaluate the clauses and requirements in each relevant opportunity.
• Budget planning should separate assessment fees from the costs of implementing and maintaining security controls.
• Track DoD guidance and applicable contract clauses while the review continues; do not assume the RFI signals that requirements are being removed.