RFI offers path forward for DoD with CMMC

While the future of the Cybersecurity Maturity Model Certification is unclear, the Defense Department has a host of options to not only save face after its self-imposed, months-long pause, but also to address several of its publicly expressed concerns.

Current and former federal officials and industry experts say DoD’s reasons for pausing CMMC have little to nothing to do with the actual program, but they are all about the underlying security control requirements outlined in National Institute of Standards and Technology Special Publication 800-171.

And while rewriting SP 800-171 is a long process and moving away from it altogether is possible, but difficult, there are several initiatives DoD could implement over the short and medium term to address real or perceived concerns.

“Industry identified several common approaches to easing these burdens, and of the recommendations, several are feasible in the short term, while others would require more time and effort to implement, if approved,” states a summary of DoD CMMC task force findings in early September.

In the summary of responses to the CMMC request for information DoD issued in July, which Federal News Network obtained, the task force outlined three sets of reform options:

• Those that the DoD CIO could make “meaningful improvements without rulemaking.”
• Those that the DoD CIO could make improvements, but are more difficult, costly, longer term and may or may not involve rulemaking.
• Those that are reasonable improvement suggestions but are not under the DoD CIO’s purview or authority.

Among those that the DoD CIO could make meaningful improvements without rulemaking include addressing ambiguity in CMMC because of inconsistent implementation among assessors, primes contactors and the CMMC program management office. Another option would be to implement NIST 800-171 Revision 3, which has been on hold since DoD CIO Kirsten Davies took over in December. And they could address a long-standing complaint of inconsistent marking of controlled unclassified information (CUI) by the military services and defense agencies and by the defense industrial base (DIB).

Suggested changes that fit under category two, costly or more difficult, include extending the plan of action and milestones (POA&M) compliance requirements, creating templates and configuration settings to make acceptance testing easier and addressing reciprocity with other security compliance programs where there are competing requirements and potentially unacknowledged overlap, such as with ISO 27001.

Additionally, the task force offered five sets of recommendations, some of which mirror earlier suggestions like finalizing the move to NIST SP 800-171 Revision 3, and to begin a second revision to address the new direction from the CMMC Reform Task Force. What that new direction is wasn’t detailed in the documents.

Three timelines for changes

Over a 90-day period, the task force says DoD could restart Phase 2 of CMMC with a narrower population, while working on longer-term recommendations through the rulemaking process. It could work with the CMMC Accreditation Body (Cyber AB) and the Cybersecurity Assessor and Instructor Certification Organization (CAICO) to provide more guidance to assessors and consultants and to increase consistency.

Another recommendation is to publish assessor availability statistics and continue efforts to grow the ecosystem.

And finally, the DoD CIO could expand POA&M eligibility to 270 days, which the task force recognizes would require rulemaking but could be added to current “in process” amendment.

The task force also outlined actions the DoD CIO could take over the next 6-12 months and over the next year-plus to address rulemaking ideas.

For example over the next six months, the task force recommended providing explicit assessment guidance to confirm credit for comparable and relevant requirements in ISO 27001. Another option would be to minimize the volume of CUI sent to prime contractors and assist the DIB in doing the same with subcontractors through training, marking tools, security classification guides and constraining CUI flow down by extending virtual desktop interface-type solutions or hardcopy.

DoD says the RFI respondents highlighted concerns about the inconsistency of CUI marking and the associated ambiguity or burden in determining whether and which systems should be secured.

“If published, an already planned Federal Acquisition Regulations rule would include establishment of a new standard form for clearly articulating the CUI data to be shared (and safeguarded) during the performance of a contract,” DoD wrote in the summary. “The existing draft rule has the potential to drastically reduce the burden on industry, especially small businesses, by narrowing the population that must comply with NIST 800-171. Of all the RFI recommendations, those related to improving clarity in CUI marking has the greatest potential to narrow the DIB population subject to NIST 800-171 implementation and cybersecurity related costs.”

Ove the next year, the task force recommended DoD publish approved configurations and templates, similar to security technical implementation guides (STIG) for common platforms, developing assessment criteria and rule content for machine readable evidence using OSCAL and advocating for grants, subsidies and/or tax credits.

“Many respondents requested availability of free tools, grants, subsidies or tax credits to ease the burden of cybersecurity implementation and compliance. Of these, the department could develop free tools, subject to funding availability,” DoD stated in the task force summary. “For grants, subsidies or tax credits, the department could advocate on behalf of the DIB but could not unilaterally address these recommendations.”

Federal News Network repeatedly asked DoD to comment on the RFI results, the review process and Davies’ overall feelings about CMMC, sending 15 specific questions. DoD declined to comment.

Current and former federal officials and industry experts say few of these ideas are new and many have been something DoD has considered or concepts vendors have recommended over the last five or more years.

Katie Arrington, who was performing the duties of the DoD CIO before the Senate confirmed Davies, has been a vocal supporter of CMMC and rolled it out during the first Trump administration. She said DoD could roll out CMMC and then focus on improving it.

“I believe the audit process can be streamlined and refined. But it has to start in order to refine it,” Arrington said in an interview with Federal News Network. “There are things in SP-800-171 that are past their prime. Things like better identity and access management, data labeling and tagging and using AI can help. But you have to start the program in order to refine it and make it your own. That is the part that I think Davies is missing.”

Arrington, who now is a quantum technology evangelist at IonQ, said defining what data is CUI in greater specificity is one initial step. She said developing an AI tool that DoD contracting officers could run against a solicitation to determine what is CUI would be straight forward.

At the same time, she said the department could use AI to improve the labeling and tagging of data.

Over the longer term, Arrington said DoD, which never performed a proper cost realism study, could determine what the actual costs are to comply with not just CMMC, but NIST 800-171.

“We begged the acquisition community to do a study for the last nine years, which usually happens prior to milestone A when buying weapons systems. They do a market study for how much it should cost to come up with an estimated cost. It’s not clear why they aren’t or haven’t done that,” she said. “When we make you implement NIST 800-171, how much do we think it will cost? Then we can build that cost into the program estimate.”

Arrington said for every program, not just CMMC, there would be a known security cost and that would allow companies to build those costs into their rates.

Creating a small business loan program

A former government official with knowledge of CMMC added DoD overlooked, or ignored, the fact that implementing SP 800-171 was cost prohibitive.

“There were indicators that this was an issue several years ago,” the source, who requested anonymity for fear of retaliation, said. “When DoD initiated Defense Federal Acquisition Regulation clause 252 204-7012, a regulatory analysis was not part of the rulemaking process in 2016. In 2017, when the first Trump administration updated the rulemaking process to include the requirement to do a regulatory impact analysis to understand how much it will cost people to implement 800-171, it never got done.”

At the same time, the FAR Council CUI rule does have a regulatory impact analysis. While it’s not finalized, the source said it is not as comprehensive, especially when considering the requirements of the DIB.

The idea of loans or grants is another that has been floated around for many years.

Arrington said the Small Business Administration could easily set one up with an incentive for small firms to remain in good cyber standing.

“If the small business is working with the federal government and they stay in good standing based on a cyber audit, the government would forgive the debt after so many years,” she said. “We are losing so much of our budget in research and development and intellectual property every year. Every time ransomware takes someone down, they write it off as a loss. How much are we losing from that? Writing off a loan program would pale by comparison.”

Eric Crusius, a partner with the law firm Hunton, said a loan program or some sort of grant for third-party assessors would be an easy win for DoD.

“If folks are looking for an easy win and to save money, this would expand the DIB pretty quickly,” Crusius said. “The cost for C3PAOs would be a fraction of the Pentagon’s budget and in exchange for a more secure contracting base and one that attracts innovative companies.”

Unlike a loan or grant program, DoD has developed cyber services over the years to help the DIB, but few were aimed specifically at CMMC.

Sources pointed to the National Security Agency’s penetration testing program as a free tool for the DIB, but CMMC and 800-171 don’t require it.

Sources also said the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) program highlights the top 10 most frequently failed controls in its assessments, but it hasn’t provided any services to help solve those challenges.

Adopting SP 800-171, Rev 3 sooner

The Army developed the Next-Gen Commercial Operations in Defended Enclaves (NCODE) for small businesses as a way to help these firms improve their cybersecurity postures.

The Army has not paused NCODE, but sources say the CMMC pause is impacting its use.

“DoD had recognized the problems with CMMC and were making good progress. There were programs to help small companies get there. DoD had worked with cloud service providers to be able to develop solutions that were lower cost,” said the former government official. “There are about 2,500 companies that have Level 2 CMMC and the vast majority are small. Most of the C3PAOs had dance cards filled through rest of 2026 and into 2027. But when Davies paused it, everyone pulled back until they find out what will happen. The ecosystem has lost momentum, lost cybersecurity improvements, and now people have stopped paying attention because her message showed disinterest.”

At the same time, DoD and SBA have set up a new program to help small business manufacturing companies have easier access to federal work. Arrington said while that’s an important program, without a cybersecurity regiment, those companies, their intellectual property and DoD data are at risk.

“Who do you think China will go after?” she said.

Crusius and others suggested that making the assessment process more efficient is easily within reach.

For example, Crusius said DoD could change the mix of how many individuals it takes to do the assessments. Currently, he said, the assessment team is made up of three people, but if DoD could reduce it to two people, that would eliminate costs.

Another suggestion from an industry source would be to fix the CMMC scoring system.

The industry source said finalizing Revision 3 of 800-171 would go far in addressing these challenges.

“It is more simple and straight forward. But right now DoD is pinned to 800-171 Rev 2, which is more than 10 years old. There were many things that were good cyber practices back then, but there has been multiple years since Rev 2 came out and DoD has yet to update program and move to Rev 3,” the source said. “Rumor is the rule to move to the next version of 800-171 was on Davies’ desk, but she instead of doing that suspended the program. If she had moved forward, we would be in that transition now. But because they went with a suspension, there is no realistic way to move defense contract requirements over to Rev 3 before the FAR CUI rule is out that calls for Rev 3.”

DoD’s delay in moving to 800-171 Rev 3 is putting contractors in a bind, the source said. Contractors, the person said, will be held to two different standards under federal regulations.

“Either defense contractors have two baselines or DoD will have to rapidly catch up and shorten or eliminate the transition to Rev 3. That will cause additional cost and burden on contractors,” the source said. “It’s a stunning mismanagement of what is going on. It all smacks of political expediency. It sounds like they said a lot of stuff that sounds good, but once the smoke cleared, it hurts the people they wanted to help.”

The source also said the task force’s suggestion around training and clarifications are spot on. The person said sharing of lessons learned, better data and reporting all would help ease the burden of the program.

Davies also has other options that don’t entail more cost, time or burden. The 7012 clause creating CMMC includes the ability for the DoD CIO to issue waivers or variances for what it takes to protect CUI. The source said this option exists outside CMMC and has been available for a decade.

“Why not tell people to ask for a waiver? She can pick what requirements are or are not required right now. CMMC assessments can verify what is required. If one or more requirements are too burdensome or don’t make sense anymore, Davies could just issue a waiver. There is no acknowledgement that this authority exists or has been considered,” the source said. “Within CMMC, there is the ability to issue waivers at the contract level. DoD can approve CMMC waivers for an entire contract class. They could say, ‘no requirements for six months at all.’ Or they could put a hold on certain requirements. But how many waivers have been requested or granted? Has anyone used these mechanisms in the program to manage the program? Or was just suspending it the moment our lack of understanding told us there is a problem the easiest way? It’s all unbelievable.”

DoD’s new cyber campaign

In July, shortly after suspending CMMC, Davies released a new cyber campaign called Brilliant at the Basics. DoD says it outlines 10 “foundational core practices” for both IT and OT systems. DoD says these 10 practices will help the DIB “fortify your enterprise, reduce technical debt and ensure the secure, rapid delivery of superior technology directly to the warfighter at the tactical edge.”

Among the core practices are things like using phishing resistant multi-factor authentication, risk-based vulnerability management and having a resilient back up and disaster recovery architecture.

Sources say while the Brilliant at the Basics concept is generally fine, it’s unclear if Davies realizes it will end up costing vendors as much as or more than CMMC and 800-171.

“Phishing resistant multi-factor authentication is a specific requirement that doesn’t exist in the NIST catalog of security controls used to create contractor controls for protecting CUI,” said the industry source. “The Brilliant at the Basics are great for security, but usually these things cost money and the DoD CIO says she suspended CMMC because it costs too much money. It doesn’t make a lot of sense.”

Sources say if Davies scraps CMMC altogether or reduces it in a significant way, the impact will be felt across industry and DoD alike.

Arrington said it was clear industry self-assessments failed and cybersecurity isn’t getting any easier.

“Everyone needs to be Level 2 for their own insurance policy. If everyone is certified Level 2, then it reduces their liability,” she said. “This is true for prime contractors and for many subcontractors. We are already seeing prime contractors using CMMC to protect themselves because ultimately, they are liable if something goes wrong.”

While 58% of the respondents to DoD’s RFI said self-assessments have improved their cybersecurity, 43% said it was a check-the-box exercise. But DoD pointed out in the report that less than 20% responded to the question in the RFI.

“Self-assessments do not provide assurance with risk mitigation. They are good for measuring a company’s internal position around cyber maturity, but to prove to the government that you are controlling and protecting your information, a self-assessment can’t prove that,” said a federal official familiar with CMMC.

Future of DIB trust, confidence

Sources say any dramatic actions to CMMC will further ruin trust and confidence in DoD among the DIB.

The industry source said it would be hard for vendors to take DoD seriously that it cares about requiring proof from industry about their cybersecurity posture.

“DoD would tacitly be admitting if you are loud enough about proving what you are doing in contracts around cybersecurity, DoD will back off,” the source said. “That seems to be the story of CMMC. Industry complains, and DoD makes concessions to industry. There seems like it’s a non-stop parade of capitulating to companies who don’t want to prove that they are doing what they were getting paid for. It’s tantamount to condoning the fraud.”

Additionally, it’s unclear what a cancellation or dramatic change would mean for the more than 2,300 companies who achieved Level 2 certification.

The source said Davies has insinuated that these companies’ efforts were not in vain, but what it means from a policy and contracting standpoint going forward is unclear.

Crusius said many of the C3PAOs are suffering, laying people off and even potentially going out of business.

“Pausing CMMC without notice has been difficult. If the department wants third-party certifiers in the future, they will have a hard time to gin up capacity to do that,” Crusius said. “A lot of companies are taking the position that they will not spend money if they don’t need to. But a lot of companies are conflating the pause of third-party assessments with the lack of a need to comply with the underlying security controls. The DoD CIO said these controls are in place and that certainly hasn’t changed. Companies know third-party assessments are not real for now, so they are cutting back on contracts to get security controls in place. They see this as license to do what they want. Even unintentionally, this sends a dangerous message to companies doing business with the Pentagon.”

The federal official added there will be a massive gap in the DIB if CMMC is terminated or changed, and it will be one that will last years.

“DoD spent seven years building up and begging this ecosystem to participate. So to go in this decision, is no one even considering effects on it? There is some responsibility on the shoulders of DoD,” the person said. “They will destroy CMMC and any trust the DIB had in the DoD. They have already did this with CMMC 1.0 and now it feels like they are about to pull the rug out from under the DIB again.”

Even if CMMC goes away or is significantly changed, Crusius said companies should keep in mind that NIST 800-171 remains a requirement and companies could face risks from the False Claims Act, from contract cancellations for not meeting the standards and negative contract performance assessment ratings.

“Third-party certifications help minimize risks to companies. It would be harder to argue that a company was reckless or intentionally filing a false claim if they have a third-party audit. That is another reason to get third-party assessment. It’s not a perfect inoculation, but it would help,” he said.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.