The Pentagon’s recent decision to suspend the Cybersecurity Maturity Model Certification (CMMC) phase two requirements and launch a sweeping review of the program is more than just bureaucratic reshuffling—it’s a revealing moment in the ongoing struggle to balance cybersecurity with innovation. Personally, I think this move underscores a deeper tension in defense policy: how do we secure our supply chains without stifling the very innovation that makes them resilient? What makes this particularly fascinating is the timing. Just as the program was set to ramp up, with third-party assessments becoming mandatory for all contracts involving sensitive but unclassified information by November 2026, the brakes were slammed. In my opinion, this isn’t just about administrative delays; it’s a recognition that the CMMC, as currently structured, may be doing more harm than good.
One thing that immediately stands out is the critique from DoD Chief Information Officer Kirsten Davies, who framed the CMMC as a ‘compliance checklist’ that imposes ‘significant and often prohibitive burdens’ on the Defense Industrial Base (DIB). What many people don’t realize is that the DIB isn’t just a monolithic entity—it’s a complex ecosystem where small and non-traditional businesses play a critical role. These firms are often the engines of innovation, yet they’re the ones most likely to be priced out by the compliance costs of CMMC. If you take a step back and think about it, this raises a deeper question: Are we sacrificing long-term innovation for short-term security?
The Small Business Administration (SBA) has been vocal about these concerns, and their applause for the suspension is telling. SBA Administrator Kelly Loeffler’s statement highlights how CMMC compliance was becoming an ‘untenable barrier’ for small businesses, pushing them out of the defense market. This isn’t just an economic issue—it’s a national security one. Small businesses are often the backbone of critical supply chains, and their exclusion could leave gaps in our defense infrastructure. What this really suggests is that the CMMC, in its current form, may be undermining the very resilience it aims to achieve.
From my perspective, the decision to launch a 60-day ‘top-to-bottom’ review of the program is both necessary and overdue. The CMMC Reform Task Force has been tasked with finding a framework that prioritizes speed, lowers barriers for small businesses, and replaces costly third-party compliance models with scalable security measures. This isn’t just about tweaking the program—it’s about reimagining how we approach cybersecurity in the defense sector. A detail that I find especially interesting is the emphasis on ‘tangible cyber hygiene’ over bureaucratic red tape. This shift in focus could be a game-changer, but it also raises questions about how we define and measure cybersecurity effectiveness.
The history of the CMMC program is a cautionary tale about the challenges of implementing large-scale regulatory reforms. Launched during the Trump administration under former acquisition official Katie Arrington, the program was initially seen as a solution to the problem of contractors self-attesting to cybersecurity standards without actually meeting them. But the Biden administration’s 2021 pause and subsequent ‘CMMC 2.0’ revisions were a clear sign that the program was struggling to balance its goals with practical realities. Now, with key architects like Arrington and Stacey Bostjanick no longer in government, the program is at a crossroads.
What’s next for the CMMC? Personally, I think the review will lead to significant changes, but the devil will be in the details. Will the new framework truly lower barriers for small businesses, or will it simply shift the burden elsewhere? Will it strike the right balance between security and innovation, or will it tilt too far in one direction? These are the questions that will define the program’s future.
In the broader context, this saga highlights a recurring theme in defense policy: the tension between regulation and innovation. As we grapple with increasingly complex cybersecurity threats, we need frameworks that are both robust and flexible. The CMMC suspension is a reminder that even the best-intentioned policies can have unintended consequences. If there’s one takeaway from this, it’s that cybersecurity isn’t just a technical challenge—it’s a cultural and economic one. And until we address it as such, we’ll continue to face these kinds of dilemmas.
