DoD Task Force Outlines Short-Term Fixes for CMMC Amidst Ongoing Pause
The Defense Department’s Cybersecurity Maturity Model Certification (CMMC) remains paused, but a task force has identified multiple pathways to address industry concerns without scrapping the program. Key recommendations include clarifying Controlled Unclassified Information (CUI) marking, adopting NIST SP 800-171 Revision 3, and expanding compliance timelines. While DoD declined to comment, experts argue that immediate actions like issuing waivers or improving assessor consistency could mitigate costs and restore trust in the defense industrial base.
Key points
- A task force summary obtained by Federal News Network outlines three categories of reforms: those the DoD CIO can implement without rulemaking, those requiring significant cost or time, and those outside the CIO’s authority.
- Short-term actions include addressing inconsistent implementation among assessors, adopting NIST SP 800-171 Revision 3, and clarifying CUI marking to reduce the population of contractors subject to strict controls.
- Medium-term recommendations include extending Plan of Action and Milestones (POA&M) compliance to 270 days, creating templates for easier acceptance testing, and recognizing reciprocity with ISO 27001.
- DoD CIO Kirsten Davies paused CMMC Phase 2 in December, but the underlying NIST 800-171 security controls remain mandatory for contractors.
- Industry experts criticize the pause for causing economic harm to third-party assessors and small businesses, noting that many firms are cutting back on security investments due to uncertainty.
Background
This development follows the Defense Department’s self-imposed pause on CMMC Phase 2, which halted third-party assessments but left underlying cybersecurity obligations in place. Previous coverage noted that while the certification process is suspended, NIST 800-171 requirements remain active, and a proposed federal rule may extend similar standards across all government contracts. The current task force recommendations aim to resolve the ambiguity and burden that led to the pause, potentially allowing a phased restart of the program.
Why it matters
The future of CMMC directly impacts the security posture of the defense industrial base and the financial viability of small businesses. Without clear guidance, contractors face conflicting standards and increased liability risks, while the government risks losing critical cybersecurity improvements. Resolving these issues is essential for maintaining a secure supply chain and ensuring that federal contracts are awarded to compliant, secure vendors.
What to watch
DoD is expected to evaluate the task force’s recommendations, potentially issuing waivers or variances for specific requirements. The department may also proceed with the adoption of NIST SP 800-171 Revision 3, which has been delayed. Industry stakeholders will monitor whether DoD implements short-term fixes, such as clarifying CUI marking, or if it moves toward more significant rulemaking changes.
Want the full story? Read the original reporting
Read on Federal News Network