Topic · cmmc

CMMC

Cybersecurity Maturity Model Certification — DoD's three-level contractor assessment program under 32 CFR Part 170.

RSS feed ↗

trade-press
NIST finder connects small businesses to 83 nonprofit cyber programs
The new finder aggregates self-submitted nonprofit programs but doesn't certify the help any listed program delivers.
NIST released a Small Business Cybersecurity Support Programs Finder, an interactive state map and table listing 83 nonprofit programs across all 50 states. The organizations offer local help such as risk assessments, penetration tests, compliance consulting, and incident response; schools and municipal governments can use the directory too. Inclusion is by self-submission, and NIST doesn't certify what any listed program delivers.
OCT 6
trade-press
GAO third panel finds CIRCIA and SEC rules conflict with sector regs
After two rounds of industry feedback, the picture isn't improving: energy, financial, and healthcare participants say reporting thresholds, timelines, and definitions across federal rules can't all be met.
GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrecy Act, and others. Participants from energy, financial services, and healthcare and public health each described reporting thresholds, timelines, and definitions that diverge across the rules they're subject to. Most participants said federal harmonization progress over the past year has been limited. The panel floated establishing a single entity with authority over regulatory consistency.
OCT 3
trade-press
CMMC pause puts point-in-time assessments on the block
The pause leaves nearly 2,000 already-certified contractors wondering what their Level 2 certification is worth as DoD rethinks the point-in-time model.
The Defense Department has frozen new CMMC third-party assessment requirements and launched a reform task force, suspending the Phase 2 ramp that was scheduled to begin November 2026. Phase 1 self-assessment requirements remain in force, but the freeze leaves nearly 2,000 contractors holding Level 2 certifications uncertain about their status. Cyber AB CEO Matt Travis, in a Federal News Network interview, outlined reform proposals that include replacing point-in-time audits with continuous monitoring and reducing assessment teams from three assessors to two for smaller firms, changes he said could be implemented without new rulemaking.
OCT 3
trade-press
CMMC Certification Pauses, but 7012 Doesn't
DoD's class deviation suspends third-party assessments without touching the underlying DFARS safeguarding clause, the NIST 800-171 baseline, or the annual affirmation requirement, and conflating the two is how contractors lose their seat at the table.
The Pentagon issued a class deviation suspending CMMC third-party certification requirements (no more C3PAO assessments for Level 2, no Level 3) but left every underlying cybersecurity obligation intact. DFARS 252.204-7012 safeguarding requirements remain. NIST SP 800-171 Revision 2 controls remain. SPRS scoring remains. And contractors must still file annual affirmations of continuous compliance. Contracting officers have been instructed to update active solicitations to reflect the changes. The Phase 2 transition toward mandatory outside assessments, originally set to ramp up, is now on hold while DoD's 60-day top-to-bottom review of the program concludes.
OCT 3
trade-press
CMMC self-attestation during Phase Two freeze carries FCA risk
Annual compliance affirmations without documented evidence of continuous monitoring could face False Claims Act scrutiny if a breach later exposes control gaps, and the July suspension of third-party assessments extends the window.
DoD's July 13 suspension of Phase Two CMMC mandatory third-party assessments has extended the period in which contractors rely on self-attestation. While the department conducts its 60-day review, Phase One self-assessment requirements remain in force. For contractors handling CUI at Level 2, that means senior officials continue signing annual compliance affirmations under DFARS 252.204-7021. The less-visible risk: if a cyber incident later triggers an investigation and documented evidence of continuous control monitoring isn't there, those affirmations can face FCA scrutiny. The Civil Cyber-Fraud Initiative has already yielded settlements where contractors allegedly misrepresented their implementation of NIST SP 800-171 controls.
OCT 3
trade-press
CMMC workloads displacing security duties, ISC2 survey finds
The Phase II pause has layered uncertainty onto a deeper structural problem: compliance preparation that cannibalizes the security work CMMC exists to ensure.
ISC2 surveyed 219 U.S. cybersecurity professionals involved in CMMC. Seventy-six percent support the program, but views on the Phase II pause are nearly split (38% support, 42% oppose). Sixty-six percent report heavier workloads from CMMC preparation, and 32% say they've spent less time on actual cybersecurity duties over the past year. Meanwhile, Redspin reports half its consulting clients have canceled contracts, and a quarter of assessment clients canceled believing "CMMC is going away." Primes are still pushing subs to certify regardless of the DoD review.
SEP 21
independent
DoD Suspends CMMC Phase 2, Launches Reform Review
The second major pause in four years signals structural rethinking (not a tweak) with the scope of review spanning OT, cloud, MSPs, and supply chain obligations.
The Department of Defense suspended CMMC Phase 2 on July 13, 2026, four months before its scheduled November 10 start. Phase 2 would have mandated third-party C3PAO assessments and Level 2 certifications as conditions of award for contracts involving CUI. A Reform Task Force convened in early September to review more than 1,100 RFI comments on assessment scope, cloud and MSP treatment, supply-chain reach, and operational technology applicability. Its report was due to the DoD CIO on September 11 but hasn't been made public. Phase 1 self-assessment requirements and underlying NIST SP 800-171 obligations remain in effect.
SEP 21
trade-press
NIST Publishes SP 800-171A Small-Business Primer
The assessment guide addresses Rev. 3 methodology directly, determination statements and security assessment plans have tripped up small contractors since the revision landed.
NIST released a small-business primer for SP 800-171A Revision 3, the companion assessment guide to the CUI security standard. The resource walks small contractors through assessment procedures, determination statements, and how to build a security assessment plan, areas where under-resourced firms have struggled since Rev. 3 was published. The primer also clarifies what roles different parties play in the CUI ecosystem and explicitly notes that CMMC remains pegged to SP 800-171 Revision 2, urging contractors to check their contracts for which version applies. NIST will host an Oct. 29 webinar on the primer.
SEP 17
independent
DoW Revises CMMC Suspension and Adds Three Supply-Chain Bans
Third revision in 18 months bundles a prolonged Phase 2 freeze with new restrictions on semiconductors, employee data, and drones, contracting officers now carry all four in one directive.
DoW issued Revision 3 of its Class Deviation on September 3, directing contracting officers to remove or revise CMMC Phase 2 third-party assessment requirements from new and existing contracts. The suspension of the November 2026 transition, first ordered by the CIO in July, remains in place, 800-171 compliance is unaffected. New to Revision 3: three procurement prohibitions covering semiconductor dealings with Huawei-affiliated entities, transfers of covered DoW employee data, and use or procurement of certain unmanned aircraft systems from China, Russia, Iran, or North Korea. Scott Kupor's DoW now runs supply-chain enforcement and CMMC timeline management through the same Part 240 vehicle.
SEP 14
trade-press
CMMC's architects make the case for pressing on
Two of the program's builders argue the threat hasn't paused, and neither have the contractors who've already decided the July suspension means they can stop spending.
Stacy Bostjanick and Tara Lemieux, both central to CMMC's development and now at Cybersec Investment, published an opinion piece in Federal News Network arguing the Pentagon's July 2026 phase-two suspension shouldn't be read as permission to abandon compliance. They point to real DIB breach cases as the cost of inaction, cite $20,000, $50,000 in annual sunk compliance investment by small firms, and warn that contractors publicly posting on Reddit that they've halted spending are betting wrong on the direction of the review. The piece is advocacy from the compliance community, not a DoD signal, but with the 60-day review window launched July 13 now closing, the argument lands while the program's fate is genuinely unsettled.
SEP 9
trade-press
Normal workflows push CUI past CMMC enclave boundaries
When CUI flows through collaboration platforms and subcontractor correspondence, the compliance surface expands beyond the enclave boundary that most preparation efforts are built around.
A Federal News Network commentary argues CMMC compliance programs share a blind spot: the assumption that CUI stays where you put it. In practice, controlled technical information propagates through Teams, email, cloud storage, and subcontractor correspondence as a byproduct of ordinary business. An organization can achieve certification and fall out of scope within days, not through policy failure, but through the normal velocity of project work.
SEP 1
trade-press
DOD to shift CMMC to NIST 800-171 Rev. 3 with expanded assessment scope
The control count drops from 110 to 97, but assessment objectives jump past 420 and new supply-chain risk management requirements push compliance beyond IT's walls.
DOD is planning an interim final rule to transition CMMC Level 2 compliance from NIST SP 800-171 Revision 2 to Revision 3, reducing controls from 110 to 97 while expanding assessment objectives from 320 to roughly 420 and adding supply-chain risk management requirements. Presenters at an Aug. 25 NDIA webinar warned that supply-chain risk management isn't an IT function and that contractors treating 800-171 compliance as a security-team problem will find Rev. 3 especially punishing. No effective date has been set; the CMMC Reform Task Force delivers recommendations in mid-September, and DOD must still issue guidance on organization-defined parameters before contractors can fully align.
AUG 27
trade-press
Sonu Shankar named Pentagon principal deputy CIO amid CMMC review
Shankar fills a role vacant since Leslie Beavers departed last September, arriving with weeks left in the CMMC Reform Task Force's 60-day review.
Sonu Shankar was sworn in Aug. 24 as the Pentagon's principal deputy CIO, filling a post that's been vacant since Leslie Beavers departed last September. An industry veteran whose résumé includes Phosphorus Cybersecurity and Arctic Wolf, Shankar reached the role through the Pentagon's BOND program, which embeds private-sector executives in advisory positions. He arrives with the CMMC Reform Task Force roughly two weeks from its 60-day deadline, the group's recommendations will determine whether Phase 2 requirements, suspended in July, are revived, reworked, or scrapped.
AUG 27
trade-press
ADI Urges DoD-Funded Enclaves to Ease CMMC Cost Burden
The trade group's filing proposes shifting assessment and infrastructure costs from thousands of individual small contractors to a single government-sponsored platform rather than leaving each firm to fund its own compliant environment.
The Alliance for Digital Innovation filed recommendations August 14 urging the Defense Department to sponsor a centrally funded, government-accredited enclave that small and nontraditional defense contractors could onboard into and inherit CMMC controls from. The filing, responding to DoD's July 13 RFI, also proposes a $500,000 contract-value threshold below which Level 2 third-party assessment costs would be recoverable. The recommendations arrive as the CMMC Reform Task Force prepares mid-September guidance that will shape the paused phase two rollout.
AUG 26
trade-press
ITI pushes DOD to accept FedRAMP controls under CMMC
Reciprocity would end the wasteful re-auditing of controls FedRAMP already validated; the AI fast-track is a separate ask entirely.
ITI urged DOD to establish formal FedRAMP-CMMC reciprocity in comments filed during the Phase Two pause, arguing that re-auditing controls already validated under FedRAMP produces "duplicative cost without a proportionate increase in security." The filing proposes a "commercial solutions equivalency" pathway where contractors inherit platform-level FedRAMP assurances rather than re-certifying per project. DOD already recognized FedRAMP Moderate equivalency for cloud providers handling CUI in a January 2024 memo, ITI wants that extended to commercial software platforms broadly and codified in a common control matrix.
AUG 25
trade-press
Contractor SPRS Confidence Falls from 89% to 65% in One Year
More defense contractors are reporting SPRS scores than ever, but confidence in their accuracy has collapsed, undercutting the self-attestation model while CMMC phase two remains paused.
Per Inside Cybersecurity, CyberSheath's annual survey of 302 defense contractors found 88% now report a positive SPRS score, but only 65% are confident in their accuracy, down from 89% last year and 94% in 2024. Average annual cybersecurity spend hit $155,204, yet median self-assessed CMMC readiness sits at 70%. Just 1% of respondents say they're completely ready. CyberSheath, a managed security provider that sells CMMC compliance services, commissioned the survey conducted by Merrill Research.
AUG 25
trade-press
PSC renews call for single cyber standard in CMMC reform comments
Seven years and multiple program pauses later, the trade group is still asking why a contractor serving both DoD and DHS faces two different sets of cybersecurity rules.
The Professional Services Council filed comments on the latest CMMC reform proposal, reiterating three longstanding concerns: inconsistent cybersecurity standards across federal agencies, the cost of demonstrating compliance versus actually improving security, and what happens to companies that already earned certifications under prior versions of the program. The consistency argument is the sharpest, a contractor serving both DoD and DHS faces different rules for fundamentally the same work, and PSC has been raising it since CMMC's inception.
AUG 25
trade-press
PSC urges CMMC alignment with NIST 800-171 Rev. 3
The contracting group wants risk-tiered assessments but acknowledges that easing small-business requirements widens the supply-chain attack surface.
The Professional Services Council filed comments Aug. 14 on DoD's CMMC review, asking for alignment with NIST 800-171 Rev. 3, reciprocity with FedRAMP Moderate, and grandfathering of existing Level 2 certifications. The filing also recommends risk-tiered C3PAO assessments, then undercuts its own case, conceding that "sophisticated threat actors routinely target the least-protected organization in a supply chain" and "the sensitivity of CUI does not change based on company size."
AUG 25
trade-press
CMMC program operational despite phase-two pause, Cyber AB says
The pause is tactical, not strategic, but the task force's mandate to "drastically reduce costs" could reshape level two for small and non-traditional shops before anything becomes contractually mandatory.
CMMC's phase-two implementation timeline is on hold after DoD's July 13 pause and 60-day task-force review, but Cyber AB CEO Matthew Travis told a July 28 town hall that the program itself remains operational: C3PAOs are conducting level two certifications, DFARS 252.204-7012 compliance is still in force, and both CMMC portals remain open. Travis framed certification as "the best insurance policy against False Claims Act risk" and urged contractors to respond to DoD's RFI by the Aug. 14 deadline. The task force's authority to alter the rule's cost, scope, or timing remains undefined, and the Cyber AB hasn't been contacted for tier-four participation yet.
AUG 25
trade-press
BlueVoyant exec: use CMMC pause to build enterprise monitoring
Lonny Anderson, a former CMMC skeptic, argues the Phase 2 suspension is the right moment to replace self-attestation with continuous external monitoring, and that reverting to the honor system while DOD deliberates is the real risk.
Former NSA chief technology officer Lonny Anderson, now president of BlueVoyant Government Solutions, published an open argument Wednesday urging the Defense Department to use the CMMC Phase 2 suspension to adopt an enterprise accountability model (independent assessment plus continuous external monitoring and shared remediation funding) rather than letting the pause lapse into pure self-attestation. The piece marks a public shift from CMMC skeptic to conditional supporter. Anderson's central claim: many NIST SP 800-171 failures, like expired TLS certificates and exposed misconfigured services, are visible from the outside right now, regardless of whether formal C3PAO assessments are running.
AUG 20
trade-press
NDIA: DoD's own CUI marking failures drive CMMC costs
The comment-period pause gives industry a rare opening to name the Pentagon's own CUI marking failures as the hidden cost driver in CMMC, not contractor immaturity.
NDIA told DoD during the CMMC reform comment window that inconsistent Pentagon CUI marking is the root cause of compliance costs running $100K to $5M+ for individual contractors. Nearly half of NDIA's survey respondents spent over $100,000 implementing NIST 800-171, costs that can't be amortized across contracts for small firms. The filing names what contractors have said quietly for years: you can't protect information the government itself can't consistently label.
AUG 19
trade-press
CMMC architect wants AI to sharpen CUI targeting
Katie Arrington says the standard shouldn't budge, but inconsistent CUI determinations across the defense industrial base are wasting money and leaving real exposure, and AI-assisted triage could fix the mismatch without touching the security bar.
Katie Arrington, who built the CMMC program, argues in a NextGov op-ed that the framework's requirements shouldn't loosen, but its targeting needs sharpening. CUI determinations remain inconsistent across the defense industrial base: some small businesses get assessed for data that isn't really CUI, while others handling sensitive material slide through with lighter requirements. Her fix: use AI to do first-pass sorting of contract language and CUI flow-down, with a human contracting officer making the final call. She also calls for a dedicated SBA loan program to fund cybersecurity investment at small businesses outside the defense supply chain.
AUG 17
trade-press
Early CMMC adopters paid up. Now Phase 2 is frozen.
The Pentagon suspension doesn't void the certification, but it does void the first-mover advantage many small contractors bet on.
Contractors who earned CMMC Level 2 certification ahead of the Phase 2 mandate are now navigating a suspended program. IntelliGenesis, a small business, spent four months and a seven-day-a-week sprint to certify, driven partly by primes threatening to drop non-certified subs from teams. The July 13 DoD suspension froze Phase 2's third-party assessment ramp while keeping Phase 1 self-assessments in force. Early adopters say they'd do it again, but the competitive edge they bought is on hold alongside the requirement that created it.
AUG 7
trade-press
Cyber AB town hall convenes amid CMMC phase two pause
The Cyber AB called the pause surprising; Tuesday's town hall is its first chance to argue the assessment infrastructure it accredited is worth preserving.
The Cyber AB holds its July town hall Tuesday, the first public forum since the Pentagon paused CMMC phase two on July 13. CEO Matthew Travis called the decision "surprising and disappointing" and pledged cooperation with the newly formed CMMC Reform Task Force. The pause halts the planned November rollout of third-party assessment requirements in solicitations and caught C3PAOs off guard. They'd spent years building the assessment ecosystem.
JUL 27
trade-press
House NDAA mandates vulnerability disclosure, extends CISA 2015
The vulnerability disclosure requirement marks the first time Congress has imposed the practice on contractors as a condition of federal work, rather than encouraging it as a best practice.
The House passed its fiscal 2027 NDAA 216-212 on July 22, packing in a nine-year CISA 2015 extension through 2035 and a first-of-its-kind mandate requiring federal contractors to adopt vulnerability disclosure policies. The bill also directs the Pentagon to brief Congress on CMMC's impact on small businesses. CISA 2015's current authorization expires September 30, leaving the Senate and reconciliation between now and then. The vulnerability disclosure mandate, carried by Rep. Nancy Mace's Federal Contractor Vulnerability Disclosure Act, shifts the practice from encouraged best practice to a condition of doing business with the federal government.
JUL 23
trade-press
Contractors continue CMMC assessments through DoD pause
A paused mandate still leaves contractors choosing between preserving sunk C3PAO spend and betting against whatever regime follows.
Federal News Network reports that Professional Services Council President Stephanie Kostro says PSC members already midway through Cybersecurity Maturity Model Certification (CMMC) assessments are staying with Certified Third Party Assessment Organizations (C3PAOs) despite DoD’s suspension. PSC has 400 member companies, about 40% with Defense Department work. The lesson is operational: companies have sunk assessment costs, protected government information to secure and no evidence that contractor cybersecurity requirements are disappearing.
JUL 21
trade-press
DoD CMMC pause leaves NIST SP 800-171 burden intact
The audit calendar moved; the control stack and executive signature risk did not, which is the part contractors actually pay for.
Federal News Network reports DoD paused Phase 2 third-party Cybersecurity Maturity Model Certification reviews, but defense contractors still must implement NIST SP 800-171 under DFARS 252.204-7012 and provide senior-official affirmations. Primes, subs and certified third-party assessment organizations get timeline uncertainty, not a compliance holiday. The expensive work remains the 110-plus controls, with False Claims Act and whistleblower exposure waiting for contractors that read “pause” as “stop.”
JUL 21
trade-press
DoD freezes third-party CMMC assessments for 60-day review
A program built to prove contractor discipline just admitted its own cost model may be undisciplined.
DoD suspended all Cybersecurity Maturity Model Certification third-party assessment requirements while it runs a 60-day review, Federal News Network reports. The review includes a request for information and listening sessions aimed at small business cost concerns. Contractors, subcontractors, C3PAOs and assessors now have stalled certification timelines, plus the more useful problem: DoD has finally stopped treating implementation pain as a communications issue.
JUL 20
trade-press
DoD suspends CMMC third-party assessments indefinitely
Small-business cost pressure has stopped the verification model DoD built after deciding self-attestation was failing.
Federal News Network reports that DoD has suspended Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements indefinitely and opened a 60-day program review, with recommendations expected by late September. Primes and subcontractors face frozen certification pathways, while CMMC Third-Party Assessment Organizations (C3PAOs) lose near-term assessment revenue. DoD is reopening the verification model it built because contractor self-attestation did not work.
JUL 17
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
Contractors face CMMC, fixed-price squeeze across federal market
The risk shift is not theoretical when small businesses must certify cybersecurity and document hours before invoices move.
Federal News Network’s interview with Barbara Kinosky frames the last 18 months of acquisition changes as a combined squeeze on contractors: mandatory Cybersecurity Maturity Model Certification, changes to small-business set-asides and fixed-price contracting as the default. Kinosky said small businesses are absorbing new compliance cost, while some fixed-price work now requires time cards and invoice-level proof of hours before payment.
JUN 16
trade-press
CMMC forces defense contractors to produce assessment evidence
The hard part was never writing the policy; it was proving the controls existed when award pressure arrived.
Federal News Network’s interview with CyberSheath CEO Emil Sayegh says Cybersecurity Maturity Model Certification pressure is now showing up through contracting officers, primes and Supplier Performance Risk System scores. Defense contractors and subcontractors handling controlled unclassified information are being pushed to move from plans to evidence. The useful warning is narrow: an assessor, or even a self-assessment, will not credit an Excel roadmap as implementation.
JUN 5
trade-press
House NDAA amendment targets CMMC cost burden
Congress is no longer just watching CMMC rollout mechanics; it is asking whether the market structure is pricing out small suppliers.
Inside Cybersecurity reports that House Armed Services advanced the fiscal 2027 National Defense Authorization Act, 44-12, with a Rep. Jeff Crank amendment requesting a Defense Department briefing on Cybersecurity Maturity Model Certification reforms by March 1, 2027. The amendment cites excessive regulatory burdens, small-business disadvantage, and fee transparency concerns involving the Cyber AB and CMMC Third-Party Assessment Organizations. Primes, subs, assessors, and the Cyber AB get the message: CMMC cost is now a Hill oversight target.
JUN 5