DoD’s reasons for CMMC pause falling apart in face of RFI responses

Key Points:

• The Department of Defense (DoD) has paused the Cybersecurity Maturity Model Certification (CMMC) program for a comprehensive review, but internal data from a recent request for information (RFI) contradicts the reasons given by CIO Kirsten Davies for the pause, particularly regarding cost, burden, and assessor shortages.
• The RFI revealed that the primary cost drivers are related to compliance with the underlying NIST SP 800-171 cybersecurity controls, not the CMMC assessments themselves, with average assessment costs around $47,000, much lower than previously claimed figures.
• Contrary to claims of assessor shortages, DoD data shows there is sufficient third-party assessor capacity, with thousands of companies already certified and assessment demand not exceeding available capacity.
• Sources criticize Davies for limited engagement with the CMMC program office and industry stakeholders, and for a rushed, superficial review process that failed to deeply analyze feedback or involve key program personnel.
• Former CMMC advocate Katie Arrington and industry experts warn that delaying or dismantling CMMC risks weakening defense industrial base cybersecurity, emphasizing that the program enforces critical protections mandated by Congress and that the underlying NIST standards remain unchanged.