The Defense Department’s (DOD) newly established Cybersecurity Maturity Model Certification (CMMC) Reform Task Force is seeking feedback from the defense industrial base companies as it reviews the department’s cybersecurity compliance program following the recent suspension of CMMC Phase 2 requirements.
The July 13 request for information (RFI) seeks industry recommendations on practical strategies to protect federal data, improve operational resilience against cyberattacks, reduce compliance costs, and lessen administrative burdens.
The solicitation follows the DOD chief information officer’s (CIO) decision to immediately suspend CMMC Phase 2 requirements, which had been scheduled to take effect Nov. 10, 2026.
All Phase 1 self-assessment requirements will remain in effect while the DOD conducts a comprehensive 60-day review of the program. The suspension also applies to pending and future CMMC implementation milestones in DOD solicitations and contracts. The department originally planned to implement the program in four phases over three years.
Under this suspension, the CMMC Reform Task Force will conduct the 60-day review of the program.
The department argued that CMMC, while intended to improve cybersecurity, had instead created prohibitive compliance costs and administrative burdens.
“The combination of prohibitive compliance costs, severe shortages in third-party assessment capacity, and complex regulatory timelines is actively forcing innovative new entrants and small businesses to opt out of [DOD] contracts and freezing critical suppliers out of the market,” DOD CIO Kirsten Davies said.
Feedback from the RFI is intended to support the task force as it reviews CMMC. According to the solicitation, industry responses will help inform policy reforms aligned with the Acquisition Transformation System that are designed to make partnering with the DOD more accessible, cost-effective, and secure while accelerating the delivery of cybersecure capabilities to the warfighter.
The task force is seeking feedback on the use of existing commercial cybersecurity capabilities, self-attestation, and other approaches to streamline cybersecurity compliance.
The department said it will use those responses to benchmark industry practices as it looks to reduce compliance costs and administrative burdens for small, medium-sized, and nontraditional companies while improving cybersecurity and operational resilience across the defense industrial base.
Responses to the RFI are due by noon on August 14.