RFI offers path forward for DoD with CMMC
Recent responses to a Defense Department request for information regarding the Cybersecurity Maturity Model Certification are undermining the justifications behind the program's current pause. An internal task force outlined short- and medium-term recommendations to address long-standing program challenges. However, the data gathered from the request undercuts the department's previous rationale, showing that compliance expenses are driven primarily by underlying standards and information marking rather than the formal certification process itself. While Phase II remains on hold, existing regulatory obligations for defense suppliers remain fully active.
Listen to Live Briefing
Real-time synthesized voice briefing · Live Feeds Desk
- ✓ The Defense Department's Cybersecurity Maturity Model Certification task force outlined several short- and medium-term steps to address long-time program challenges.
- ✓ The Department of Defense paused CMMC Phase II, but NIST SP 800-171 and DFARS 252.204-7012 requirements still apply.
- ✓ Data from request for information responses shows that NIST 800-171 controls and Controlled Unclassified Information marking drive contractor costs rather than certification.
What changed
Data from the department's own request for information responses exposed flaws in the original rationale used to justify freezing the program.
Live updates
-
DoD RFI Responses Challenge CMMC Pause Justifications
Recent responses to a Defense Department request for information regarding the Cybersecurity Maturity Model Certification are undermining the justifications behind the program's current pause. An internal task force outlined short- and medium-term recommendations to address long-standing program challenges. However, the data gathered from the request undercuts the department's previous rationale, showing that compliance expenses are driven primarily by underlying standards and information marking rather than the formal certification process itself. While Phase II remains on hold, existing regulatory obligations for defense suppliers remain fully active.
Why it matters
The Defense Department previously paused its Phase II rollout while citing concerns over contractor burden and program structure. Analysis of the recent request for information data highlights that underlying cybersecurity frameworks continue to drive compliance expenses regardless of the certification timeline. This disconnect places renewed pressure on defense officials to adapt their approach for the supply chain.
What is confirmed
- The Defense Department's Cybersecurity Maturity Model Certification task force outlined several short- and medium-term steps to address long-time program challenges.
- The Department of Defense paused CMMC Phase II, but NIST SP 800-171 and DFARS 252.204-7012 requirements still apply.
- Data from request for information responses shows that NIST 800-171 controls and Controlled Unclassified Information marking drive contractor costs rather than certification.
Still unconfirmed
- Average CMMC assessments cost $47,000 as the 75-day review passes 100 days.
What to watch next
- Official department decisions regarding the future trajectory of CMMC Phase II
- Further policy updates from the CMMC task force addressing the request for information findings
confidence 100%Sources used for this update (17)
- Federal News Network — RFI offers path forward for DoD with CMMC
- Federal News Network — DoD’s reasons for CMMC pause falling apart in face of RFI responses
- Federal News Network — The battlefield has no boundaries: How the Iran war is redrawing the cyber threat map
- Aviation Week — Scope And Cost: A Cybersecurity Guide For Small Defense Suppliers
- DevPro Journal — The CMMC deadline paused, but the obligations didn’t
- Santa Clarita Valley Signal — What Does Your SPRS Score Say About Your Business? A Guide for SCV Manufacturers
- Contractor Magazine — ABC Offers Contractors a Roadmap to DoD Cybersecurity Certification
- Technology Org — CMMC Level 2 Requirements and C3PAO Guide (2027)
- cashwalklabs.io — GM will switch to Nasdaq from the NYSE on Nov. 17
- federalnewsnetwork.com — RFI offers path forward for DoD with CMMC - Federal News Network
- cuicktrac.com — Cuick Trac - DFARS Compliance Made Simple for Contractors
- www.hivesystems.com — CMMC Pause: What the DoD RFI Responses Mean for Defense ...
Community Sentiment: How do you assess this situation?
Voice your perspective · Real-time aggregated sentiment from the Live Feeds community