DoD pauses CMMC Phase II, seeks burden-cutting input

Treat this as vendor-framed, because it is. The Federal News Network piece is sponsored commentary from Avatara CEO Rob McCormick, and its argument is that the important part of DoD’s CMMC Phase II suspension is the accompanying SAM.gov request for information. According to the piece, the department is asking industry how to protect federal data while reducing compliance costs, administrative burden and operational complexity, with existing contractual obligations still in place.

That distinction matters for contractors. A pause in the Cybersecurity Maturity Model Certification rollout does not make covered defense information optional, and the source does not claim it does. The operational question is narrower and more useful: which parts of the assessment and evidence process improve security, and which parts mostly move labor from system hardening into documentation?

McCormick’s answer is also the sales pitch: use mature commercial cloud, managed services, automation, continuous monitoring and governance instead of forcing every contractor to recreate the same security functions alone. Fine, as far as it goes. But DoD’s RFI should not become a referendum on whether vendors can rename outsourced operations as reduced burden. The harder question is whether DoD can distinguish reduced administrative work from reduced accountability. Contractors will still need to know what evidence is sufficient, who accepts it, and how that maps back to covered defense information obligations when the pause ends.