The CMMC review could lead to "everything from an overhaul, to small tweaks here and there,” DoD CIO Kirsten Davies said after the review team's first meeting. The Pentagon wants to move quickly with its review of the Cybersecurity Maturity Model Certification program, but plenty of questions swirl around what defense officials can do differently this time to balance compliance concerns for small businesses with the need to enforce cybersecurity requirements. The CMMC review team met for the first time on Thursday, July 16, Defense Department Chief Information Officer Kirsten Davies told reporters that same day following a tour of the factory floor at Kform, a small defense manufacturer based in Sterling, Va. Davies was joined on the tour by Small Business Administrator Kelly Loeffler and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey. Davies said small business considerations were central in the decision to suspend CMMC third-party assessment requirements and launch a “top-to-bottom” review of the program. The goal is to address cost and compliance concerns that Davies, Loeffler and Duffey said are creating barriers for smaller companies to compete for defense contracts. Join us July 21 – 23 for Federal News Network's Space & Satellite Exchange where government and industry leaders will discuss advancing connectivity, resilience and mission reach. Register today! “We took this action because data, including the reports from the Small Business Administration, makes one thing very clear: our planned compliance requirements progression was creating prohibitive costs and unacceptable burdens to the defense industrial base,” Davies said. DoD has published a request for information on the CMMC review. And officials will also hold listening sessions across the country to get feedback from defense contractors, “especially the small businesses, and from the cybersecurity operators and executives who serve your companies,” Davies said. “We want to