DoD Puts CMMC Phase 2 on Hold, Reviews Cybersecurity Compliance Requirements

The Department of Defense (DoD) has taken significant steps to address concerns regarding the Cybersecurity Maturity Model Certification (CMMC) by officially pausing Phase 2 of the program. As outlined in a recent acquisition memo, contracting officers are now directed to eliminate third-party assessment requirements from active solicitations and existing contracts. This decisive move follows a 60-day review revealing significant industry feedback on the compliance costs and administrative burdens associated with CMMC. The pause comes at a critical time, as the Pentagon grapples with how to effectively bolster cybersecurity while reducing barriers for key players, including small and medium-sized enterprises in the defense industrial base.

During this review period, which concluded on September 11, the DoD received more than 1,100 responses from contractors and industry stakeholders, contributing over 10,000 pages of feedback. Sharing insights from this dialogue, DOD CIO Kirsten Davies highlighted a growing consensus among respondents advocating for the suspension of Level 2 requirements and the need for program reforms. Over 50% of the feedback indicated a significant desire to reevaluate the compliance-focused approach, particularly stressing its detrimental impact on smaller firms that struggle under the weight of high compliance costs, which the Small Business Administration estimates can reach $593,800 per certification for those requiring third-party assessments.

Davies has emphasized that a rigid compliance model does not equate to real security, noting that CMMC has led to excessive administrative hurdles and has not sufficiently catered to the unique manufacturing and operational needs of the defense sector. As the Pentagon transitions during this pause, it expects to enforce compliance through NIST 800-171 Rev 2 via self-assessments and targeted government assessments rather than through third-party evaluators. This is part of a broader recognition that the cybersecurity landscape is not static and that a shift from point-in-time assessments to a model of continuous verification is necessary for real resilience.

The implications of this pause on procurement practices cannot be understated. The DoD is signaling a potential paradigm shift, highlighting to procurement professionals that future contract requirements may evolve significantly as they reconsider how compliance relates to security. Moving forward, contractors should stay engaged with the DoD’s reform initiatives, which may influence the landscape of cybersecurity compliance and procurement policies.

Additionally, the decision to halt third-party assessments provides immediate relief to suppliers and lessens operational strains, particularly among small businesses. This moment may serve as an opportunity for these companies to enhance their cybersecurity measures without the immediate pressure of stringent compliance mandates. Still, stakeholders should remain vigilant, as the DoD is actively pursuing a model that aligns more closely with evolving threats without sacrificing security integrity.

As the review process moves forward, the stakes remain high. Industry observers are closely monitoring how the DoD will balance the need for robust cybersecurity measures against the operational realities faced by smaller contractors. The feedback gathered thus far will likely guide the next steps in reinterpreting the CMMC framework, with a focus on practical solutions that address real-world realities for those serving the defense industrial base. Stakeholders are encouraged to remain active participants in this evolving discussion, advocating for policies that can lead to more sustainable compliance measures going forward.

• The DoD's ongoing review indicates potential changes to the CMMC compliance approach.
• Third-party assessment removal from contracts may ease burdens for many small businesses.
• Over $593,800 is the estimated cost for small firms needing third-party assessments.
• Continuous verification models may soon replace current compliance checks.
• More than 50% of industry feedback supports pausing Level 2 CMMC requirements.
• Active engagement with the DoD's reform initiatives is critical for industry stakeholders.
• The focus on operational technology improvements signals a more holistic cybersecurity strategy in future reforms.
• Small business owners should prepare for evolving cybersecurity expectations in upcoming contracts.