Pentagon Hits Pause on Cybersecurity Certification for Defense Contractors
Washington, July 13 (Reuters) – The Pentagon has decided to halt the next step of its cybersecurity certification program aimed at defense contractors. This change comes after industry leaders raised concerns that the compliance requirements were making it difficult for smaller suppliers to continue participating in military projects, ultimately reducing competition within the defense supply chain.
The U.S. Cybersecurity Maturity Model Certification (CMMC), which was introduced in November 2020, is designed to safeguard sensitive information, particularly what is known as controlled unclassified information. However, the Phase 2 rollout of this certification, originally set to start on November 10 of this year, will now be paused. For the time being, only Level 1 or Level 2 self-assessments will be necessary, rather than the more rigorous third-party evaluations planned for Phase 2.
This decision comes after numerous complaints from small and mid-sized aerospace and defense suppliers, many of whom reported that the costs of compliance were soaring into the hundreds of thousands of dollars. Additionally, lengthy delays for third-party audits were leading some to reconsider their involvement in defense work.
Industry legal experts had also expressed concerns that the new rules might push lower-tier suppliers out of the market and create complications for international companies facing varying data-privacy standards.
Pentagon Chief Information Officer Kirsten Davies stated that this suspension is a direct response to those concerns. In a statement, the Pentagon noted that “CMMC compliance is forcing innovative companies out of the Defense Industrial Base.” The department plans to conduct a 60-day review to reassess the situation.
Michael Duffey, the Pentagon’s Under Secretary for Acquisition and Sustainment, linked this decision to the need for quicker weapons production. He emphasized that suspending these requirements would help eliminate “paralyzing costs” while allowing for continued innovation and competition in the defense supply chain.
A newly created CMMC Reform Task Force will gather input from the industry through a public request for information and aims to provide recommendations within the next 60 days.
