A contractor's nine CMMC fixes that skip lowering the bar
The proposals are one executive's, not the Pentagon's, but they name the exact points where CMMC compliance has priced out small and non-traditional vendors.
TL;DR
Federal News Network ran commentary laying out nine recommendations for streamlining CMMC without lowering its security baseline: fold the program into DFARS clauses, swap prescriptive technology mandates for outcome-based equivalency, and move toward continuous risk-based reassessment instead of fixed assessment cycles. The author, a federal vendor executive, argues the cost and complexity now make it harder for smaller and non-traditional contractors to enter the defense market. None of this is DoD policy; whether the Pentagon's CMMC Reform Task Force adopts any of it remains open.
The nine fixes are not the Pentagon's. Federal News Network published them as commentary from Scott Montgomery, a vice president at federal software vendor Island, and the piece is labeled opinion throughout. That matters for how you read it: these are one executive's recommendations for the Defense Department's ongoing CMMC review, not a task force decision or a rulemaking notice.
What's useful is where the recommendations land. Montgomery isn't proposing to lower the security baseline for contractors handling controlled unclassified information. He's proposing to lower the cost of proving compliance. Fold CMMC directly into the Defense Federal Acquisition Regulation Supplement instead of running it as a parallel regime. Let contractors define how they meet a security outcome rather than dictating the technology, citing virtual desktop infrastructure as the expensive thing a browser-based architecture might replace. Move from a fixed assessment cycle to continuous, risk-measured reassessment so the government isn't looking at a stale snapshot.
Several recommendations target concrete friction points contractors already know: accepting FIPS-compliant cryptography rather than a particular implementation, publishing anonymized assessment data back to the industrial base, and clarifying managed service provider responsibilities inside the assessment boundary. Two stretch beyond CMMC itself, including fixing the System for Award Management path between GSA and the Defense Logistics Agency, which Montgomery describes as an administrative tax on any company trying to do business with DoD.
The underlying argument is cost-driven. Montgomery's premise is that the pace of the battlefield, illustrated by AI-guided drones and tenfold growth in AI-assisted strikes reported by Ukraine's Ministry of Defence, is moving faster than a three-year compliance cycle. For smaller and non-traditional contractors, the current setup can mean expensive infrastructure, duplicative requirements, and prescriptive readings that don't reflect modern security architecture, with companies spending more time proving compliance than improving security.
Whether DoD formally adopts any of this is unresolved. The piece is addressed to the CMMC Reform Task Force's open review, and nothing in the source indicates the Pentagon has committed to any single recommendation or a timeline. The recommendations read as a bid to reshape the program's cost structure, not its security bar. The question left unanswered is whether the department is listening.
Published ·Deep Fathom