The Defense Department (DOD) has moved beyond a temporary pause of third-party assessment requirements under the Cybersecurity Maturity Model Certification (CMMC) program and into a binding acquisition instruction that codifies the suspension.
Under the Trump administration, the DOD was rebranded as the War Department.
A Sept. 3 class deviation memo from John Tenaglia, principal director of Defense Pricing, Contracting, and Acquisition Policy at DOD, directs contracting officers to make changes to active solicitations and existing contracts. The class deviation requires contracting officers to remove CMMC requirements for third-party assessments while preserving baseline cybersecurity obligations.
The move follows the department’s July 13 announcement that Phase 2 of CMMC will be paused while it conducts a 60-day review of the program. Phase 1 requirements remained in place. Phase 2 had been scheduled to take effect Nov. 10. The review period ends Sept. 11.
At a Sept. 9 fireside chat at the 17th annual Billington CyberSecurity Summit in Washington, D.C., DOD CIO Kirsten Davies said the department reviewed more than 1,100 request for information responses totaling over 10,000 pages as part of its CMMC review. DOD also held listening sessions nationwide with more than 3,000 attendees and met with cyber advisory groups, third-party assessors, and small businesses.
According to Davies, more than 50% of respondents favored putting CMMC on hold and seeking some level of reform.
She said some respondents questioned why the program had started and why contractors were required to comply with it. She also said third-party assessors were concerned about how they would demonstrate that the defense industrial base is following federal policies.
Davies outlined two findings from that feedback.
“Compliance equals compliance. Compliance doesn’t equal security. Compliance equals a point in time check of where are you right now,” Davies said, requirements are more burdensome for small- and medium-sized businesses compared to large firm.
In announcing the Phase 2 pause, the department said CMMC, while intended to improve cybersecurity, had instead created prohibitive compliance costs and administrative burdens. The department cited Small Business Administration estimates of $593,800 per certification for small businesses requiring third-party assessments and about $388,600 for those eligible for self-assessment.
The second finding, Davies said, is that the department’s cyber compliance process needs to account for the defense industrial base’s manufacturing and operational technology. Davies said CMMC did not address “how to build cyber resilience for a manufacturing line.”
The defense industrial base includes service providers as well as manufacturers, she said, adding that operational technology is critical.
“This is still something that we need to resolve” Davies said. “We rely on the defense industrial base for the manufacturing, for the innovation that is there,” she said. “So, we have some work to do. It’s coming.”\