Pentagon pauses cyber audit rule blamed for supplier exits
FILE PHOTO: The Pentagon in Arlington, Virginia, is seen from the air on March 3, 2022, REUTERS/Joshua Roberts/File Photo
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
WASHINGTON, July 13 : The Pentagon is suspending the next phase of a cybersecurity certification program for defense contractors, backing off a compliance requirement that industry executives had warned was pushing small suppliers out of military work and narrowing competition in the defense supply chain.
The Defense Department’s long-delayed U.S. Cybersecurity Maturity Model Certification began in November 2025 and aims to protect sensitive information, known as controlled unclassified information.
The Phase 2 rollout of the Cybersecurity Maturity Model Certification, which was to take effect on November 10 of this year, will be paused immediately, the department said. Program offices will for now require only Level 1 or Level 2 self-assessments rather than the third-party audits Phase 2 would have mandated.
The move follows months of complaints from small and mid-sized aerospace and defense suppliers, some of whom told Reuters earlier this year that compliance costs were running into the hundreds of thousands of dollars. They said this, combined with long waits for third-party audits, was prompting them to reconsider defense work altogether.
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Industry lawyers had also warned the rules risked squeezing out lower-tier suppliers and complicating business for international companies juggling competing data-privacy standards.
Pentagon Chief Information Officer Kirsten Davies said the suspension responds to those pressures.
The Pentagon said in a statement that “CMMC compliance is forcing innovative companies out of the Defense Industrial Base,” and that the department would launch a 60-day review.
Pentagon Under Secretary of War for Acquisition and Sustainment Michael Duffey tied the decision to the department’s push to speed weapons production, saying the change would remove “paralyzing costs” while keeping “innovators and competition growing in the defense supply chain.”
A newly formed CMMC Reform Task Force will draw on industry feedback collected through a public request for information and deliver recommendations within 60 days.
Source: Reuters
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
About The Author
