This is part 1 of a two-part investigation into the Cybersecurity Maturity Model Certification (CMMC) program. Part 2 will come out on Oct. 27.
The Defense Department has backed itself into a corner with the Cybersecurity Maturity Model Certification program.
Every reason Kirsten Davies, the DoD chief information officer, gave for pausing CMMC and for conducting a “top-to-bottom” review has been called into question based on data in its own request for information.
Davies, who at least three sources say has privately stated that her goal is to “get rid of the program,” now can’t make the forthcoming recommendations fit her narrative and has a limited path to move forward with CMMC.
“The final CMMC report is delayed because Davies can’t make it say what she wants it to say. The RFI responses and data didn’t support her goals,” said a former government official, who is familiar with CMMC and requested anonymity for fear of retribution. “I believe Davies wanted the task force to come back with recommendation to end the third-party assessments because it was most difficult for small businesses and what she considered the biggest problem with the program. But the RFI responses don’t support that claim and she can’t move forward.”
When DoD paused CMMC in July, Davies called assessments a “burdensome, red-tape ridden, check-the-box, point-in-time view of a company’s handling” of sensitive data. She said the planned compliance requirements progression was creating prohibitive costs and unacceptable burdens to the defense industrial base, and the cost and compliance concerns are creating barriers for smaller companies to compete for defense contracts.
Davies said when DoD initiated the pause that the review team had 60 days to gather feedback and review the program, then 15 days to provide a report with recommendations to herself and Undersecretary for Acquisition and Sustainment Michael Duffey. That 75-day timeline is now pushing over 100 days.
And the reasons for the delay are clear from the data in the RFI, for which DoD reviewed 997 responses with 509 (51%) coming from the defense industrial base and the rest coming from vendors, consultants, the “ecosystem” and others.
Documents obtained by Federal News Network show the top reason the respondents said for the cost of CMMC was the implementation and maintenance not of the program, but of meeting the security control requirements of National Institute of Standards and Technology Special Publication 800-171. That publication is the underlying foundation and requirements for securing controlled unclassified information (CUI) that CMMC is meant to enforce.
“With regard to implementation and maintenance, respondents cited the following key areas of concern: licensing and recurring annual costs (e.g. Microsoft 365 GCC high); enclaves with separate and dedicated hardware and associated operability with enterprise systems; inconsistent interpretation between subcontractors and their prime contractors, assessors, CMMC ecosystem, consultants and government documentation; and external service providers, including managed service providers and cloud services providers,” said an internal DoD email summarizing the RFI responses. “With regard to documentation and evidence, respondents cited the following key areas of concern: creation and maintenance of documentation required to meet the NIST controls; assembling evidence packages in preparation for assessment and inconsistent and lack of guidance for evidence assessment and reuse across cybersecurity frameworks.”
Cost drivers related to NIST 800-171
The RFI also shows a top cost driver that respondents highlighted was around concerns related to inconsistent CUI marking policies across DoD, which creates uncertainty for when the company needs to apply NIST 800-171 protections. The way DoD handles CUI has long been a concern, not just for vendors, but across the entire community because of the tendency to mark information as CUI when it doesn’t meet any of the requirements.
In the RFI, respondents said another top cost driver also is related to the complexity of implementing NIST 800-171 security controls. The respondents said they need to have “specialized, dedicated personnel to assist with understanding requirements, implementing solutions and documenting evidence.” DoD says that these requirements are specifically difficult for small businesses who have more limited budgets to afford high-priced expertise.
Davies, Duffey and Kelly Loeffler, the administrator of the Small Business Administration, have all said the cost of CMMC is prohibitive to small firms and that is a major reason for the pause. SBA’s own Office of Advocacy wrote a letter to DoD in February expressing concerns about the costs of CMMC compliance.
But again, this is where DoD’s rationale falls short. The RFI found the cost of the CMMC assessments to be well over-stated, with the average cost to comply with CMMC – and not NIST 800-171 – at $47,000.
Loeffler said in July that complying with CMMC could cost as much as $600,000. About 47% of the respondents said the cost of the third-party assessors was one of the top cost drivers, rating fifth overall.
“This perception, as was noted by many commentors, is in contrast to the average assessment cost ($47,000) directly cited by a subset of respondents. Notably, prices have reduced over the first year of CMMC implementation as the natural forces of supply and demand have taken effect,” DoD wrote.
Sources say third-party assessment organizations (3PAOs) provided DoD with copies of contracts to demonstrate that the costs were not what they were advertising.
Federal News Network repeatedly asked DoD to comment on the RFI results, the review process and Davies’ overall feelings about CMMC, sending 15 specific questions. DoD declined to comment.
No shortage of assessors
Even the rationale that the burden of CMMC was too much for firms to bear turned out to be false. Respondents to the RFI did say the burden of 800-171 was high, specifically around certain security controls that the companies felt didn’t actually lower risk. But the respondents didn’t say the burden of CMMC was too high.
“With regard to requirements that create overhead and financial burden, system security plans (SSPs) were ranked highest because they claimed it required significant effort to document and does not directly provide cybersecurity,” DoD wrote. “The requirement for FIPS-validated encryption was cited next as overhead and financial burden, respondents cited concerns with the timeline to get through the FIPS process and disruptions with respect to updates.”
A third common reason DoD gave for suspending CMMC is a shortage of assessors.
Davies wrote in July, “The combination of prohibitive compliance costs, severe shortages in third-party assessment capacity and complex regulatory timelines is actively forcing innovative new entrants and small businesses to opt out of [DoD] contracts and freezing critical suppliers out of the market.”
But the industry source said that too continues to be proven false based on DoD’s own data provided by the Cyber AB.
“On a monthly basis the number of third-party assessors from the Cyber AB townhall shows there are plenty of 3PAOs. This is data from how many available 3PAOs and the demand for Level 2 certifications from contractors is directly reported out of DoD’s database. There has never once during all of Phase 1 where ecosystem utilized more than half of the available assessment capacity,” the source said. “Compared to DoD’s own estimates in the CMMC final rule, they have way more than enough capacity to support the assessment demand they expected well in to Phase 3 of roll out. They said not enough capacity or assessors, but have not provided any answers about how many are enough.”
When contacted about the programmatic pause, the Cyber AB declined to comment.
As of September, Federal News Network learned 2,433 companies have received Level 2 third-party certifications. The source said that is five time the number of companies that DoD estimated would be able to achieve Level 2 in first 12 months of the program.
“When you compare that with assessment teams, it’s not approached half of the available capacity. Companies haven’t come close to maxing out the available assessment capacity,” the source said. “And keep in mind, there is no DoD policy that makes the November 2026 deadline a requirement for all vendors to achieve a Level 2 certification. That is when DoD begins the requirement to include Level 2 in contracts.”
Another industry source said quite simply after reviewing the RFI responses and following the CMMC program closely that DoD’s “math isn’t mathing.”
“When they get every fact about the program incorrect, when they talk about the program and are conflating cost with DFARs 7012 and existing cyber requirements, it’s clear that they misunderstand their own policy,” said the industry expert, who requested anonymity. “Based on their reasons, anyone on the outside would be hard pressed to think they understand the program because everything they say about it is provable incorrect through their own policies. This is really stunning to watch.”
The source said the RFI was problematic from the start.
“The issue with the RFI is DoD was asking for all requirements and not focusing on third-party assessments of the NIST 800-171 requirements. The CMMC program is relatively narrow in terms of what is in program. It’s all about how to run an assessment, how it is scoped, how the boundaries are scoped, the plan of action and milestones timeline and what is allowable,” the source said. “There are details on the verification process. It talks about training, vetting and giving authority to assessors and assessment teams. None of that has anything to do with requirements that get assessed by program. But RFI and subsequent suspension of third-party verifications is focused on the requirements and not the verification process.”
Only a 20-minute meeting with the PMO
Sources say Davies hasn’t done enough to understand the CMMC program. Since the Senate confirmed her as the DoD CIO in December, she has met with the CMMC program office for only 20 minutes. Sources say she had a 90-minute meeting scheduled in late February or early March, showed up late to the meeting and gave the PMO team only 20 minutes.
“CIO leadership had no substantive communication with the cybersecurity directorate for more than eight months,” said a government source with knowledge of CMMC. “Davies and her team aren’t talking to anyone who knows anything about CMMC. They like to do everything in a silo. When she arrived in January, she stopped all CMMC work, told the program office not to engage with anyone and the program office didn’t hear anything from them about what they could or couldn’t do until Davies put on official hold on the program in July. There was zero communication on their plans or intentions to the CMMC PMO.”
Multiple sources say that the PMO tried to engage with Davies and her team, but had no luck and didn’t find out about the pause beforehand.
“The CMMC program office wasn’t notified or consulted before the suspension was announced. They found out the way industry did, from the public announcement. The Cyber AB was not told in advance either,” the third source said. “I don’t think Davies understands the cyber threat or the history of why CMMC exists. It’s not to punish the DIB ecosystem. It was stood up in response to constant exfiltration to controlled information.”
Katie Arrington, who was performing the duties of the DoD CIO before the Senate confirmed Davies, has been a vocal supporter of CMMC and rolled it out during the first Trump administration. She said she tried to talk to Davies on multiple occasions about CMMC, and other CIO-related priorities like revamping the risk management framework and the software security program known as SWFT, but was stopped by legislative affairs and others higher ups in DoD.
Arrington, who now is a quantum technology evangelist at IonQ, said CMMC was born out of major cyber incidents such as one involving China stealing the plans for the F-35 fighter.
“I think if I had the opportunity to sit down with Davies and explain all things that we have done to make cybersecurity better, it would’ve made a huge difference,” Arrington said in an interview. “I was texting her on LinkedIn prior to her going for her confirmation hearing and I was reading her questions, telling her what to watch out for. I didn’t want her to fail. I know that coming into the building is intimidating and about understanding it can be ugly. If you don’t know how the building works, it will eat you alive. She was polite in the beginning and then she stopped communicating. Now due to ethics, I can’t reach out to her.”
Arrington said she also left on Davies’ desk a binder full of information and data about all CIO priorities and initiatives, including CMMC, as well as a card and floral arrangement.
The industry source added that Davies also has rarely met with CMMC industry despite several attempts by 3PAOs and others to talk to her.
And the former government official added it’s unclear whether Davies has even received a classified briefing of the cyber threat the DIB faces.
“Everyone who has seen it easily concludes that we should do something about the cyber threat. Her decisions seem to show she never has taken it,” said the former official. “I don’t think Davies understands or gets the urgency or the risk of not keeping data confidential. She thinks as long as we go to battle with five weapons and the enemy has four, then we win. That isn’t about protecting our data from which the enemy can develop counter measures and do other things to impact our soldiers. I don’t think she recognizes that data is everything. She should understand that no matter what her background is. She is so absorbed by Secretary Pete Hegseth’s Arsenal of Freedom.”
Hegseth kicked off the Arsenal of Freedom effort in January, trying to revitalize and re-energize the defense industrial base, particularly in the manufacturing sector. Hegseth said in January that DoD’s “industrial renaissance” will be one that no longer rewards delays, tolerates cost overruns or awards contracts to programs that are years behind schedule.
Task force review in three days
The sources believe because Davies didn’t attempt to understand CMMC, the RFI review and task force are missing an opportunity to improve the program.
The government source said the effort was questionable at best, starting with how DoD developed the RFI and left it open for only 30 days and continuing through the entire review process.
The source said with only 509 DIB companies responding, that accounted for less than 1% of the entire sector. The source said if DoD had left the RFI open for 60 or 90 days, they would’ve captured more responses from the sector.
Additionally, the task force reviewed more than 1,100 comments – some of which they disqualified and which is why the review ended up with 997 total comments – in three days.
“A group of about 20 people took the information from the RFI and looked at the data, but did not analyze it deeply. It was just a top-level response set of trends,” the government official said. “The task force did include the current director and deputy director of the CMMC PMO, but the other 18 people came from the Defense Contract Management Agency, the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), folks from acquisition and sustainment, folks from research and development, consultants from the Institute for Defense Analysis, Carnegie Mellon and Johns Hopkins Applied Physics Lab. They were given the directive not to use AI because they didn’t have time to establish a non-biased model. Most of the analysis was done by hand, bucketizing and categorizing the results to break out issues in text. They did use a key word search tool to match specific issues that was developed by a contractor, but mostly it was a manual review process.”
The former government official added the task force used a spreadsheet to do the analysis and found a lot of the responses were companies just promoting tools to meet CMMC requirements.
“The CMMC program office was not involved or embraced in writing the final recommendations. They were all written and directed by CMMC task force lead by Cynthia Carpenter. She worked in the DIB operations side of the DoD CIO’s office, which is opposite from CMMC as they manage the DIB cybersecurity partnership program,” said the former government official.
The quick turnaround for the task force’s analysis has also raised doubts about the depth of the RFI review.
The government source said when DoD updated the CMMC rule in October 2024 that created 32 CFR170, DoD reviewed 1,400 comments and needed about eight months to go through them all.
‘CMMC is not my baby’
Eric Crusius, a partner with the law firm Hunton, said it was clear the RFI was trying to address too many issues. He said there seems to be a disconnect between complaints about CMMC and concerns about NIST 800-171.
“The cost of program is blamed on certification instead of underlying certification controls, which are not part of the CMMC program. DoD got a lot of press associated with suspension of CMMC, but I don’t think it accurately captured where significant costs are. The underlying certification controls haven’t changed and the department has not retreated from it,” he said. “The RFI included a lot of questions about those underlying controls, how much they cost and how hard they were to implement.”
Arrington said that’s the rub with the entire review process: There was nothing that DoD is doing that would change the requirement under the DFAR rule 7012 or NIST 800-171.
“When it comes to the challenges of CMMC, DoD is still back to ground zero because there was nothing in the RFI that talked about moving away from those requirements,” she said. “Ultimately, is NIST 800-171 the right way to go? That’s her job to determine the standard. Davies could say that DoD no longer will use the NIST standard anymore but then what do you use — ISO 27001 or something else? In the absence of something different than NIST, why not ask if there are other cyber standards that DoD should be looking at? The standard is what it is, and you can’t deviate from it.”
In the end, Arrington and others believe Davies will kick the CMMC can down the road for two more years. In responding to the RFI, Arrington said she made the suggestions to let CMMC stand up and figure out how to improve it.
“I think they will say vendors will need to achieve Level 2 certification by 2029 and the ecosystem will die because you turned off the demand and the supply will not be there anymore. It will become a self-fulfilling prophecy,” Arrington said. “The big question is, does the pause help the nation to be more secure or cause more peril? There are cyber weapons in our critical infrastructure. So what are you doing to defend us? Sometimes accountability is hard, but an ounce of prevention is worth a pound of cure. They need to lock the data down before Q day. CMMC is there to ensure that you have that culture of cybersecurity. If you don’t like the name, then rename it or rebrand it.”
Arrington said it’s a shame that CMMC has become so politicized over the years. She said it’s an auditing and compliance program that came from Congress because they saw a significant problem with how industry was securing critical data.
“CMMC is not my baby. She can make CMMC auditing better, but you need to launch the program. The problem I have with Davies is I was never allowed to speak to her and the powers that be thought it was too combustible,” she said. “CMMC wasn’t my idea. It was [former undersecretary of defense for acquisition and sustainment] Ellen Lord’s and [former assistant secretary of defense for acquisition] Kevin Fahey. I just had to evangelize it. Congress told my bosses make the DIB accountable. CMMC is not mine. It’s been a much-needed effort that I gladly accepted, because I care. Last year I told the community I needed to move away from being part of it. And I definitely don’t own it.”
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.