The CMMC Reform Task Force concluded its sixty-day review on September 11, setting up a public report for the Chief Information Officer expected within weeks regarding the future of the Cybersecurity Maturity Model Certification program. Task force members are finalizing recommendations following a review period that began after the department suspended Phase 2 of the program on July 13.
The suspension halted a mandate that would have required companies handling controlled unclassified information (CUI) to pass a third-party certification before securing defense contracts starting this November. The department suspended the requirement due to prohibitive compliance costs, a severe shortage of assessment capacity, and a Small Business Administration finding that the program is structurally incompatible with rapidly expanding the defense industrial base. The department is moving to codify the pause in binding regulation.
The Assessment Dilemma and Compliance Costs
The task force evaluated more than 1,100 responses to a request for information over the summer, grappling with fundamental economic and structural tensions within the cybersecurity framework. Pentagon rulemaking priced a single Level 2 assessment at roughly $102,000 for a small business every three years, a baseline figure that excluded underlying security work. First-year figures run two or three times higher.
With approximately 80,000 companies in scope—nearly three-quarters of them small businesses—total compliance costs every year approach the financial scale of a major weapons system. Conversely, relying on self-attestation under NIST SP 800-171, which has been contractually mandatory since the end of 2017, produced widespread discrepancies when government assessors subsequently checked implementation scores. Furthermore, a Level 2 assessment fans 110 security controls into 320 individually judged objectives. Only nine of those controls can be satisfied by configuring a system, leaving the vast majority dependent on manual document review and interviews by human assessors.
Strategic Cost Imposition and Industrial Base Pressures
Defense officials face a structural dynamic where cybersecurity enforcement mechanisms interact directly with adversary incentives. A sustained intelligence effort against the defense supply chain targets both information exfiltration and defense industrial capacity. Successful intrusions harvest research and development outputs from accounts running to roughly $150 billion a year, while defensive compliance overhead imposes heavy administrative and financial burdens on smaller suppliers.
The National Industrial Security Program previously managed sensitive information through a binary structure where classified information was maintained through government-cleared facilities, counterintelligence support, and direct government funding. The introduction of CUI as a third tier in 2010 shifted protection responsibilities onto 80,000 private networks without comparable industrial security machinery. CMMC emerged as an attempt to patch that gap using commercial assessors and contractor funding.
Policy Alternatives and Upcoming Recommendations
Agency guidance issued by the National Archives on September 2 underscored ongoing difficulties with consistent designation and marking across federal programs sixteen years after the executive order established the category.
