DoD CMMC Pause Sparks Debate Over Cost, Scope, and Federal Cyber Obligations
The Defense Department’s pause on CMMC Phase 2 has not eliminated cybersecurity obligations for contractors. While third-party assessments are halted, underlying NIST 800-171 requirements remain in effect, and a proposed federal rule may extend similar standards across all government contracts. Industry experts argue that clarifying Controlled Unclassified Information (CUI) scope and adopting NIST 800-171 Revision 3 could reduce costs and improve compliance efficiency.