While We Wait: The CMMC Rollout Pause & Paths Forward

A recent two-part series of articles from Jason Miller at the Federal News Network has raised questions about the current pause in CMMC rollout. From concerns about the current state to potential program improvements, we’ll summarize the key points and provide guidance on what’s required of DIB contractors.

Context: CMMC Phase 2 Rollout Paused

In July 2026, the U.S. Department of Defense/Department of War (DoD/DoW) announced it was pausing Phase 2 of the CMMC phased implementation plan scheduled to begin on November 10, 2026. Originally, this would have resulted in Level 2 assessments by a CMMC third-party assessor organization (C3PAO) beginning to be included as a requirement within applicable DoD solicitations where Controlled Unclassified Information (CUI) is involved.

The DoD’s press release indicated the goal was to reassess the CMMC program’s requirements in order to address what it referred to as “prohibitive compliance costs and bureaucratic burdens,” particularly those impacting small businesses. It also announced a 60-day study of the future of the CMMC program.

The DoD Acquisition & Sustainment Office simultaneously issued a memo instructing contracting officers and program managers not to include CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) requirements in solicitations, stating that only CMMC Level 1 (Self) and CMMC Level 2 (Self) designations may be used. The memo went further by stating any active solicitations including the now-prohibited designations must be amended accordingly.

Responses to the Pause

The sudden and unexpected change has yielded feelings of relief for SMBs struggling to achieve compliance and undergo C3PAO assessments, as well as much confusion and consternation throughout the DIB. While the 60-day review period has come and gone, members of the DIB have not received clear guidance from the DoD on the future of CMMC and third-party assessment requirements.

Regardless, defense contractors handing CUI are still required to implement the practices described in NIST SP 800-171 Revision 2 and complete a CMMC Level 2 self-assessment in order to be eligible for future contracts and renewals.

Skepticism Regarding Justifications for Pause

Part one of the Federal News Network series raises concerns from DoD insiders, who requested anonymity due to concerns of retribution. The concerns indicate that DoD Chief Information Officer (CIO), Kirsten Davies, wants to eliminate the CMMC program entirely.

When the pause was announced, the DoD opened a request for information (RFI) in an effort to solicit feedback regarding the CMMC program. However, there has been criticism of the RFI for broadly requesting information about NIST SP 800-171 requirements and implementation (which are mandated by DFARS 252-204-7012) instead of the CMMC program, itself, which is the verification mechanism intended to ensure those requirements are met (codified in 32 CFR 170).

Feedback from Industry

A review of RFI responses indicates the biggest challenges faced by members of the DIB are the cost of implementation, inconsistent validation of practices between assessors, a lack of clear guidance from DoD, and over-marking of CUI by the DoD.

With respect to cost, the only new line item introduced by CMMC is the potential need for assessment by a C3PAO, given that implementation of the NIST SP 800-171 practices has been required since late 2017. As for assessments, the article indicates costs have come down over the past year as more assessors have become certified, reducing the pressure on supply relative to demand.

Former acting DoD CIO Katie Arrington suggested letting the CMMC program stand up and then figuring out how to improve it. By continuing to push back the requirement, the DoD incentivizes contractors to delay achieving compliance and leaves national security information vulnerable in the face of ever-increasing threats.

According to the article, a former DoD official stated, “I don’t think [DoD CIO] Davies understands or gets the urgency or the risk of not keeping data confidential. She thinks as long as we go to battle with five weapons and the enemy has four, then we win.”

From Russia and Ukraine trading cyberattacks on critical infrastructure, Israeli infiltration of the supply chain for pagers and walkie-talkies used by Hezbollah, and Chinese exfiltration of fighter jet schematics, the past several years have shown that modern warfare no longer occurs exclusively on the frontlines and industry partners must be protected.

Potential Paths Forward

In the second article of the series, Miller notes that the CMMC task force categorized the recommendations it reviewed from RFI responses across 3 groupings:

• Group 1: Meaningful improvements which don’t require rulemaking.

• Group 2: Improvements that could be made by the DoD CIO, but would be more challenging, costly, and time-intensive which may or may not involve rulemaking.

• Group 3: Reasonable suggestions which the DoD CIO would not have the authority to implement.

In brief, the task force proposed restarting CMMC Phase 2 with “a narrower population” over 90 days while working on longer-term changes through rulemaking.

Recommendations & Improvement Options

Within the second article, there are several common themes. Combined with a deluge of commentary from members of the indstry, the broad recommendations surfaced.

• Manage ambiguity caused by inconsistent implementation among assessors, primes contactors, and the CMMC program management office (PMO), potentially via OSCAL automation. Implementation difficulty could be reduced through publication of system configurations templates (e.g., STIGs). Finally, the DoD could review DIBCAC data regarding the most-failed practices [file download] observed during assessments and provide specific guidance for challenge areas.

• Address inconsistent marking of CUI by the military services and defense agencies and the DIB through training, marking tools, security classification guides and constraining CUI flowdown (e.g., providing VDIs/hardcopy). As outlined in the draft FAR CUI rule, use a standard form (SF XXX) to explicitly identify CUI for contracts and minimize contractor responsibility

• Provide funding for small businesses through something like an SBA loan program which incentivizes small businesses to remain in good cyber standing (e.g., forgive the debt after so many years if the business continues working with the federal government and remains compliant). Katie Arrington stated this would likely be lower cost to the government than current loses from intellectual property theft. Providing additional insights into existing free/low-cost tools/programs, such as the “attack surface management” and “continuous automated pentesting” programs provided by the NSA for the DIB, would also be beneficial for SMBs.

• Make the assessment process more efficient by reducing the required number of assessment team members from 3 to 2, which would result in substantially lower assessment costs. Providing explicit guidance for assessors to confirm CMMC credit for comparable requirements (e.g., from ISO 27002) would further level of effort, especially when combined with automated processes like OSCAL.

• Fix the scoring + POA&M system to eliminate “hard fail” requirements and allow any to be POA&M-able. This would place more emphasis on the “maturity” aspect of CMMC and significantly reduce the level of apprehension among DIB members as they approach the assessment process.

• Implement NIST 800-171 Revision 3 to align with the forthcoming FAR CUI Rule, which will put DIB contractors in a bind of needing to comply with both versions. According to NIST, Revision 3 adds new tailoring criteria to reduce potential redundancy and improve clarity, includes more clear alignment with NIST 800-53, and provides outcome-oriented guidance to better support implementation. The DoD PMO has even published ODPs for Rev 3, further reducing ambiguity during both implementation and assessment.

What’s Next for Defense Contractors

Pending additional guidance from the DoD, members of the DIB should remember that implementing NIST 800-171 remains a requirement and companies could face False Claims Act issues for knowingly submitting inaccurate self-assessments, such as contract cancellation, financial penalties, and even criminal charges.

Regardless of whether the DoD chooses to reinstate third-party certification requirements,  completing one makes it harder to argue that a company was reckless or intentionally filing a false claim if they experience a cyberattack, and primes contractors may still require C3PAO assessments as a way to limit their exposure to flowdown liability from their subs.

Finally, implementing CMMC practices genuinely reduces the risk of experiencing a successful cyberattack. Companies should not approach the preparation process in a half-hearted manner and, instead, commit to protecting themselves, their partners, and their customers through robust, risk-based cybersecurity programs.

In the meantime, we'll keep an eye on the horizon and continue providing updates as the situation develops! Subscribe to our newsletter below to ensure you get them delivered straight to your inbox.

About Triumvirate Cybersecurity

Triumvirate Cybersecurity is a CyberAB Registered Practitioner Organization (RPO) which specializes in cyber compliance for small and mid-size government contractors. Based in Dayton, Ohio, we help organizations make sense of requirements, implement effective security programs, and achieve compliance with confidence so they can get back to what they do best!

Ready to chart your path to cybersecurity and compliance? Reach out through our Contact page or directly via email to info@triumviratecyber.org.