Topic · cmmc

CMMC

Cybersecurity Maturity Model Certification — DoD's three-level contractor assessment program under 32 CFR Part 170.

RSS feed ↗

trade-press
House NDAA mandates vulnerability disclosure, extends CISA 2015
The vulnerability disclosure requirement marks the first time Congress has imposed the practice on contractors as a condition of federal work, rather than encouraging it as a best practice.
The House passed its fiscal 2027 NDAA 216-212 on July 22, packing in a nine-year CISA 2015 extension through 2035 and a first-of-its-kind mandate requiring federal contractors to adopt vulnerability disclosure policies. The bill also directs the Pentagon to brief Congress on CMMC's impact on small businesses. CISA 2015's current authorization expires September 30, leaving the Senate and reconciliation between now and then. The vulnerability disclosure mandate, carried by Rep. Nancy Mace's Federal Contractor Vulnerability Disclosure Act, shifts the practice from encouraged best practice to a condition of doing business with the federal government.
THU
trade-press
Contractors continue CMMC assessments through DoD pause
A paused mandate still leaves contractors choosing between preserving sunk C3PAO spend and betting against whatever regime follows.
Federal News Network reports that Professional Services Council President Stephanie Kostro says PSC members already midway through Cybersecurity Maturity Model Certification (CMMC) assessments are staying with Certified Third Party Assessment Organizations (C3PAOs) despite DoD’s suspension. PSC has 400 member companies, about 40% with Defense Department work. The lesson is operational: companies have sunk assessment costs, protected government information to secure and no evidence that contractor cybersecurity requirements are disappearing.
TUE
trade-press
DoD CMMC pause leaves NIST SP 800-171 burden intact
The audit calendar moved; the control stack and executive signature risk did not, which is the part contractors actually pay for.
Federal News Network reports DoD paused Phase 2 third-party Cybersecurity Maturity Model Certification reviews, but defense contractors still must implement NIST SP 800-171 under DFARS 252.204-7012 and provide senior-official affirmations. Primes, subs and certified third-party assessment organizations get timeline uncertainty, not a compliance holiday. The expensive work remains the 110-plus controls, with False Claims Act and whistleblower exposure waiting for contractors that read “pause” as “stop.”
TUE
trade-press
DoD freezes third-party CMMC assessments for 60-day review
A program built to prove contractor discipline just admitted its own cost model may be undisciplined.
DoD suspended all Cybersecurity Maturity Model Certification third-party assessment requirements while it runs a 60-day review, Federal News Network reports. The review includes a request for information and listening sessions aimed at small business cost concerns. Contractors, subcontractors, C3PAOs and assessors now have stalled certification timelines, plus the more useful problem: DoD has finally stopped treating implementation pain as a communications issue.
MON
trade-press
DoD suspends CMMC third-party assessments indefinitely
Small-business cost pressure has stopped the verification model DoD built after deciding self-attestation was failing.
Federal News Network reports that DoD has suspended Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements indefinitely and opened a 60-day program review, with recommendations expected by late September. Primes and subcontractors face frozen certification pathways, while CMMC Third-Party Assessment Organizations (C3PAOs) lose near-term assessment revenue. DoD is reopening the verification model it built because contractor self-attestation did not work.
JUL 17
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
Contractors face CMMC, fixed-price squeeze across federal market
The risk shift is not theoretical when small businesses must certify cybersecurity and document hours before invoices move.
Federal News Network’s interview with Barbara Kinosky frames the last 18 months of acquisition changes as a combined squeeze on contractors: mandatory Cybersecurity Maturity Model Certification, changes to small-business set-asides and fixed-price contracting as the default. Kinosky said small businesses are absorbing new compliance cost, while some fixed-price work now requires time cards and invoice-level proof of hours before payment.
JUN 16
trade-press
CMMC forces defense contractors to produce assessment evidence
The hard part was never writing the policy; it was proving the controls existed when award pressure arrived.
Federal News Network’s interview with CyberSheath CEO Emil Sayegh says Cybersecurity Maturity Model Certification pressure is now showing up through contracting officers, primes and Supplier Performance Risk System scores. Defense contractors and subcontractors handling controlled unclassified information are being pushed to move from plans to evidence. The useful warning is narrow: an assessor, or even a self-assessment, will not credit an Excel roadmap as implementation.
JUN 5
trade-press
House NDAA amendment targets CMMC cost burden
Congress is no longer just watching CMMC rollout mechanics; it is asking whether the market structure is pricing out small suppliers.
Inside Cybersecurity reports that House Armed Services advanced the fiscal 2027 National Defense Authorization Act, 44-12, with a Rep. Jeff Crank amendment requesting a Defense Department briefing on Cybersecurity Maturity Model Certification reforms by March 1, 2027. The amendment cites excessive regulatory burdens, small-business disadvantage, and fee transparency concerns involving the Cyber AB and CMMC Third-Party Assessment Organizations. Primes, subs, assessors, and the Cyber AB get the message: CMMC cost is now a Hill oversight target.
JUN 5