CYBERSECURITY BREAKING: Pentagon’s CMMC Pause Draws Praise, Criticism from Industry By Josh Luckenbaugh iStock illustration The Defense Department on July 13 suspended the Phase 2 requirements for its Cybersecurity Maturity Model Certification program and initiated a review of the effort, drawing both praise and criticism from experts. Phase 2 of the program, which was scheduled to start Nov. 10, would have introduced in applicable Pentagon solicitations requirements for contractors handling controlled unclassified information to be certified by a CMMC third-party assessment organization, or C3PAO. Citing Small Business Administration data, the department in a release said CMMC compliance is forcing innovative companies out of the defense industrial base, which will delay the delivery of critical capabilities to U.S. warfighters. As a result, it is suspending the transition to Phase 2, as well as pending and future CMMC implementation milestones. Pete Sfoglia, co-founder and CEO of Pistos Information Protection, said the suspension of Phase 2 is an overdue admission from the department that after decades of indifference to how small and medium-sized companies safeguarded controlled unclassified information, the Pentagon through CMMC “demanded they become experts in a discipline that was never their core competency.” Full implementation of the security requirements outlined in National Institute of Standards and Technology Special Publication 800-171 “plus the cost of C3PAO assessments was cost-prohibitive on its face, and the predictable outcome was not a more secure industrial base but a smaller one,” Sfoglia said. “The right move now is not to delay the burden but to rethink who bears it." In a statement provided to National Defense, authorized C3PAO Redspin said while the department is exercising existing flexibility allowing it to suspend pending CMMC implementation milestones, it is not rescinding the program. “For organizations in the defense industrial base, this suspension means more time to prepare, not