RFI offers path forward for DoD with CMMC

Key Points:

• The Department of Defense (DoD) has paused the Cybersecurity Maturity Model Certification (CMMC) program, primarily due to concerns with the underlying NIST SP 800-171 security control requirements rather than the program itself, with several short- and medium-term reform options available.
• The DoD CMMC task force identified three categories of potential reforms: improvements achievable without rulemaking, more complex and costly changes possibly requiring rulemaking, and suggestions beyond the DoD CIO’s authority, including clarifying CMMC implementation, adopting NIST 800-171 Revision 3, and improving controlled unclassified information (CUI) marking.
• Over the next 90 days, the task force recommends restarting Phase 2 of CMMC with a narrower scope, enhancing assessor guidance, publishing assessor availability data, and expanding plan of action and milestones (POA&M) compliance eligibility, while longer-term proposals include developing templates, addressing reciprocity with other standards, and advocating for grants or tax credits.
• Industry experts and former officials emphasize the need to proceed with CMMC rollout to refine the program, highlight the importance of better defining CUI, suggest leveraging AI for data labeling and compliance assessments, and call for a proper cost realism study to understand the financial impact on contractors.
• There are concerns that further delays or cancellation of CMMC could undermine trust in the DoD among defense industrial base (DIB) companies, disrupt the ecosystem of third-party assessors, and increase cybersecurity risks, though compliance with NIST 800-171 remains mandatory and third-party certifications help mitigate legal and contractual risks.