DoD CMMC Pause Sparks Debate Over Cost, Scope, and Federal Cyber Obligations

Key points

• DoD CIO Kirsten Davies paused CMMC Phase 2 in July 2026, but NIST 800-171 controls remain mandatory for defense contractors.
• A proposed FAR rule would extend CUI safeguarding requirements to all federal contractors, potentially reaching nearly 20,000 entities.
• Industry experts suggest that defining CUI scope and adopting NIST 800-171 Revision 3 could significantly reduce compliance burdens.
• The pause has disrupted the certification ecosystem, with third-party assessors facing financial strain and contractors delaying security investments.
• DoD’s 'Brilliant at the Basics' campaign introduces new foundational practices, but critics note these may impose additional costs without clear regulatory alignment.

Background

CMMC was introduced to standardize cybersecurity requirements for the defense industrial base. Previous iterations faced criticism for complexity and cost, leading to a pause in Phase 2 third-party assessments. The current debate centers on whether to refine the program or replace it with broader federal rules.

How outlets are covering it

Federal News Network emphasizes that DoD has multiple options to address CMMC concerns without full rulemaking, including clarifying CUI marking and adopting NIST 800-171 Revision 3. Aviation Week focuses on practical steps for small suppliers to define scope and manage costs, stressing that the pause does not eliminate underlying obligations. DevPro Journal highlights the broader federal trend, noting that a proposed FAR rule may extend similar requirements across all government contracts, making compliance a cross-sector issue. Critics, including former officials and industry experts, argue that the pause reflects political expediency rather than a genuine effort to reduce burden, and that DoD has failed to conduct proper cost analyses or utilize existing waiver mechanisms.

Why it matters

The CMMC pause affects thousands of defense contractors and their subcontractors, creating uncertainty in compliance and security investments. As federal cybersecurity requirements expand beyond defense, all government contractors face increased scrutiny and potential liability for non-compliance. The outcome will shape the future of federal cybersecurity policy and the resilience of the defense industrial base.

What to watch

DoD is expected to publish its CMMC review results and a new Phase 2 timeline, though no date has been announced. The FAR Council may finalize its proposed rule, which could extend CUI requirements across all federal contracts. Industry stakeholders are urging DoD to adopt NIST 800-171 Revision 3 and clarify CUI scope to reduce compliance burdens. Third-party assessors are adapting to the pause, with some facing financial strain, while contractors are reassessing their security investments and compliance strategies.