CMMC Phase II Was Supposed to Start Today. Here’s What We Know Now.

CMMC Phase II Was Supposed to Start Today. Here’s What We Know Now.

Today was supposed to be a milestone. November 10 was set to be the day CMMC Phase II began, making Level 2 certification a condition for DoW contracts involving CUI.

For many defense contractors, November 10 was a date that had been circled on their calendar for months. Up until July of this year, it shaped budgets, drove timelines, and set the pace for assessment bookings across the DIB.

Now it seems like yesterday that the bombshell Phase II pause was announced, but it’s been four months. In that time, the Reform Task Force has run its course. The RFI public comment period closed nearly three months ago, and the 60-day review period has come and gone.

Today, the date that Level 2 certification was supposed to start appearing in new contracts, we still haven’t heard anything official from the DoW about the future of CMMC. There’s still no restart date, published findings, or revised guidance for the thousands of contractors waiting to hear what comes next with third-party assessments.

Of course, there have been some indications along the way. In September, the Phase II suspension was written into a class deviation, turning July’s announcement into formal acquisition policy. A recent DFARS update offered another signal, showing a clear preoccupation with China’s role in the U.S. defense supply chain. And last week, the DoW posted on LinkedIn about growing the DIB, helping small contractors compete for awards, and expanding industrial capacity. (Still no official mention of CMMC, though.)

The most substantive news has come from Federal News Network, which recently obtained the task force’s internal summary of the RFI responses and reported what the data revealed. Those findings complicate the story behind the pause and point the way to a handful of initial solutions. Today, in honor of the November 10 deadline-that-never-was, we’ll dive into those findings and solutions for the future of CMMC.

What the RFI data revealed

As reported by the Federal News Network, the CMMC task force reviewed 997 RFI responses, 509 of them from the DIB. While the initial announcement about the Phase II pause framed C3PAO assessments as the main barrier to compliance for small businesses, the FNN’s two-part report told a different story.

First, the RFI responses found the cost of CMMC assessments to be well overstated, with the average cost to comply with CMMC itself, separate from NIST 800-171, at $47,000. Instead, the real expense was the work behind the assessment. The top expense named was implementing and maintaining NIST SP 800-171, with respondents repeatedly pointing to software licensing, specialized systems, documentation, and unclear CUI scope as cost drivers.

The FNN reporting also summarized suggestions from the RFI responses, including clarifying CUI markings, moving to NIST SP 800-171 Rev 3, making assessments more consistent, extending POA&M windows, and possibly restarting Phase 2 with a narrower group of contractors within 90 days.

Taken together, the task force’s own data points away from the third-party assessment as the core problem: something that Sentinel Blue and other C3PAOs have been suggesting all along. Instead, the complexity of the requirements themselves is a key barrier to CMMC compliance.

Fortunately, we have some suggestions.

What we told the task force

As both an MSP and a C3PAO that has helped more than 50 defense contractors achieve CMMC Level 2 certification, Sentinel Blue has invested as much in the success of CMMC as any organization can. When we submitted our RFI response in August, we pointed out that we have a vested interest in maintaining the status quo.

But maintaining the status quo serves neither the interests of the DIB nor the interests of our national security. We believed (and still do!) that the DoW has an opportunity to meaningfully move the security needle for the defense industry, and our suggestions reflect that belief. They also reflect a need to simplify, to refocus CMMC assessments around the controls that stop real attacks, and to cut the requirements that add cost without improving security.

For the full text of our response, you can check out our CEO’s LinkedIn post. For a summary, here are our suggestions:

• Refocus the assessment. NIST SP 800-171A’s 320 assessment objectives have become a shadow standard, and organizations now build their policies and systems around passing them. Assessments should focus on heavily weighted technical controls and require fewer assessors. They should also let CCPs meaningfully contribute and allow failed controls to be remediated collaboratively, without instant failure.
• Stop penalizing improvement. Under current guidance, a significant change to a certified environment can trigger a full reassessment, which discourages organizations from upgrading their systems. Certified organizations have already shown they have a change management process, so a focused delta assessment should be enough when a review is truly warranted.
• Move to Rev 3. NIST SP 800-171 Revision 3 adds an important emphasis on operational resilience and drops lower-impact requirements. Its organizationally defined parameters (ODPs) would also let the Department retire the FIPS-validated cryptography requirement, which is the single most prohibitive requirement facing the DIB. (Seriously, we have to get rid of FIPS.)
• Rethink the FedRAMP Moderate requirement. We regularly see organizations pay triple or more for FedRAMP versions of cloud services that often lag behind their commercial counterparts. The added cost and reduced capability push users toward shadow IT, which in turn undermines security and compliance.
• Use DIBCAC more efficiently. Instead of reviewing 110 requirements at one organization per week, a DIBCAC team could review five high-risk requirements, like MFA, across ten organizations. That way, the DoW would gain broader assurance, and industry would prioritize the controls with the biggest impact.
• Recognize managed services providers. MSPs like Sentinel Blue often hold at least partial responsibility for a majority of their clients’ NIST 800-171 requirements. Many small contractors couldn’t achieve certification without that support. An MSP certification model would put more scrutiny on the provider and reduce the burden on the organizations it supports, which would in turn lower the barrier to entry for small businesses in the DIB.

While we wait (still)

Whatever the task force ultimately recommends, the adversaries targeting the DIB haven’t slowed down during the Phase II pause. For contractors who were preparing for November 10, the most valuable thing they can do with this time is to focus on the security measures that actually stop cyberattacks.

In our RFI response, we pointed to the controls that have delivered the most tangible security improvement across our client base:

• Multifactor authentication. MFA, especially phishing-resistant and replay-resistant MFA, is the single most effective control for disrupting real attacks. Our SOC monitors and protects thousands of users and endpoints, and we regularly see compromised credentials stopped by MFA policies. Industry breach research consistently reaches the same conclusion. If your organization still relies on SMS codes or allows exceptions to MFA, closing those gaps is the highest-value step you can take.
• Single sign-on. Identity is now the primary attack surface. When identities are spread across dozens of disconnected systems, it’s hard to know which credentials need protecting, let alone detect when one is compromised. Consolidating identity into a single platform shrinks the attack surface. It also makes stronger protections easier to enforce, like limiting access to specific networks, requiring phishing-resistant MFA, and allowing only compliant devices.
• Zero Trust Network Access. For most small contractors, the traditional corporate network perimeter is long gone. Employees work remotely, use commercial cloud tools, and connect to private cloud environments from almost anywhere. Zero Trust gives organizations tighter control over that sprawling footprint. It enforces granular policies on which users and devices can reach which services, and it inspects traffic to catch threats along the way.
• Risk assessments. In terms of administrative controls, a well-run risk assessment consistently delivers the most value. It brings together stakeholders from across the organization, surfaces risks no one had considered, and gives non-security leaders a clearer picture of what’s at stake.

All of these suggestions are rooted in the same NIST 800-171 controls that the DIB is already obligated to implement, but doubling down on them will strengthen your security posture and put you in a better position for whatever form CMMC takes in the future.

November 10 may not mean what it was originally supposed to, but it’s still a great day to invest in the security that matters across the entire defense industrial base.