ADI Urges DoD-Funded Enclaves to Ease CMMC Cost Burden

The Alliance for Digital Innovation's August 14 filing lays out a structural alternative to the per-firm compliance model at the heart of CMMC. Rather than requiring each small or nontraditional contractor to independently fund its own compliant environment, ADI argues the Defense Department should "sponsor a centrally funded, accredited enclave that firms can onboard into and inherit controls from." The trade group's logic is straightforward: shift the cost and accreditation burden from thousands of individual firms to a single government-sponsored platform, and you lower barriers to entry while raising the security floor across the defense industrial base.

The Army is already pursuing a different approach through its Next-Gen Commercial Operations in Defended Enclaves (NCODE) initiative, which selected eight vendors in May to compete for task orders building a marketplace that links small businesses with verified external service providers. ADI's proposal goes further (a single funded enclave rather than a marketplace) but both reflect a recognition that small contractors can't reasonably be expected to fund isolated CUI-handling environments on their own.

ADI's filing also recommends a contract-value threshold for Level 2 third-party assessments. Below $500,000, the department would need to determine whether a C3PAO assessment is warranted, and if so, allow the contractor to treat it as a recoverable cost. The proposal targets a specific friction point: small firms pursuing smaller contracts face assessment costs disproportionate to the contract value.

The filing addresses scoping as well, arguing that prime contractors routinely impose blanket Level 2 flow-downs on subcontractors "that never touch CUI" because primes lack confidence in their scoping determinations and default to over-inclusion to avoid audit liability. ADI's recommendation (enforce the existing rule that certification level follows data type) wouldn't create new regulatory burden but would shift accountability for scoping diligence back to primes.

Additional recommendations in the filing cover CMMC reciprocity with FedRAMP and an expedited authorization pathway for AI-driven defensive security capabilities, with ADI pushing for a 90-day review window for providers already holding federal security authorizations.

The CMMC Reform Task Force, stood up by DOD CIO Kirsten Davies on July 13 alongside the phase two pause, is expected to deliver its recommendations in mid-September. ADI's filing, along with the other RFI responses, will inform that work. Phase two was originally set to begin November 10, when defense acquisition officials would have been permitted to include CMMC Level 2 third-party assessment requirements in contract solicitations.