CMMC workloads displacing security duties, ISC2 survey finds
The Phase II pause has layered uncertainty onto a deeper structural problem: compliance preparation that cannibalizes the security work CMMC exists to ensure.
TL;DR
ISC2 surveyed 219 U.S. cybersecurity professionals involved in CMMC. Seventy-six percent support the program, but views on the Phase II pause are nearly split (38% support, 42% oppose). Sixty-six percent report heavier workloads from CMMC preparation, and 32% say they've spent less time on actual cybersecurity duties over the past year. Meanwhile, Redspin reports half its consulting clients have canceled contracts, and a quarter of assessment clients canceled believing "CMMC is going away." Primes are still pushing subs to certify regardless of the DoD review.
The ISC2 survey captures a paradox. Cybersecurity professionals overwhelmingly endorse CMMC: 76% agree it's necessary. But the preparation burden is grinding. Sixty-six percent report heavier workloads, 62% cite expanded documentation demands. Most damning, 32% say they've spent less time on actual cybersecurity responsibilities in the past year. A compliance program cannibalizing the activity it exists to protect has a design problem, and that problem predates the pause. The Phase II suspension has layered on its own disruption. Redspin, the first C3PAO authorized under the program, told Inside Cybersecurity that half its consulting clients have canceled contracts, and roughly a quarter of assessment-side clients have walked away because "they think CMMC is going away," per VP Robert Teague.1 Yet another 50% are forging ahead, and primes are pushing subs to certify regardless: a CMMC certification functions as a trust signal in the supply chain. The contractor base is cleaved in two.
The training burden falls hardest on smaller firms. Fifty-five percent of respondents said CMMC preparation increased their need for additional credentials or training, and respondents at small and medium-sized organizations were significantly more likely to report this than those at larger firms. That cost isn't addressed by the pause, and it isn't mentioned in the RFI.
The operational disruption extends beyond the survey numbers. Thirty-four percent of respondents have reallocated time away from CMMC work and 26% report delayed or canceled assessment preparation. The pause was supposed to create breathing room. What it's delivered is a holding pattern with no estimated time of arrival.
Footnotes #
Published ·Deep Fathom