DoD's Own RFI Data Undercuts the CMMC Pause: What Contractors Should Do

The reasons the Department of Defense gave for pausing CMMC do not hold up against the Department’s own request for information, according to a two-part investigation by Federal News Network. The first article, published October 26, reports that respondents named NIST SP 800-171 implementation, not third-party assessment, as their top cost driver. It also reports that assessor capacity was never close to exhausted during Phase 1. Neither finding changes what your contract requires today. Both change how you should plan for the next year.

This article covers the first part of the investigation. Our follow-up covers the task force’s options for a path forward.

What did DoD say when it paused CMMC?

The Department suspended the CMMC Phase 2 transition on July 13, 2026. Our earlier article covers the announcement. In it, DoD Chief Information Officer Kirsten Davies described third-party assessments as a “burdensome, red-tape ridden, check-the-box, point-in-time view of a company’s handling” of sensitive data. She also cited compliance costs that create barriers for small businesses and “severe shortages in third-party assessment capacity.”

The Department opened a request for information (RFI) in July. The CMMC Reform Task Force was given 60 days to gather feedback and 15 days to report to Davies and Undersecretary for Acquisition and Sustainment Michael Duffey. Federal News Network notes that the review is now past 100 days with no public result.

What did the RFI responses say about cost?

According to the reporting, the task force reviewed 997 responses. About half, 509, came from defense industrial base (DIB) companies. The rest came from vendors, consultants, and others in the ecosystem.

The top cost driver respondents named was implementing and maintaining NIST SP 800-171 controls. An internal DoD email cited by the article listed the specific pain points: recurring licensing costs for products such as Microsoft 365 GCC High, enclave architectures, and inconsistent interpretation of requirements among primes, subcontractors, and assessors. On documentation, the same email cited the work of creating and maintaining the records the NIST controls require, assembling evidence packages before an assessment, and the lack of guidance on reusing evidence across frameworks. Inconsistent CUI marking across DoD and the need for “specialized, dedicated personnel” rounded out the top drivers.

Among individual requirements, respondents ranked the System Security Plan (SSP) as the heaviest burden, followed by FIPS-validated encryption. Our guides to writing an SSP and FIPS validation cover both.

Third-party assessment cost ranked fifth. About 47% of respondents named it as a top driver. The article quotes DoD’s own summary, which notes that this perception “is in contrast to the average assessment cost ($47,000) directly cited by a subset of respondents” and that prices fell over the first year of the program. For comparison, the article cites a July statement from the Small Business Administration that compliance “could cost as much as $600,000.” The RFI data does not support that figure for the assessment itself.

What did the data say about assessor capacity?

Federal News Network reports that 2,433 companies had received CMMC Level 2 third-party certifications as of September. That is roughly five times the Department’s own estimate for the first 12 months. An industry source citing CMMC Accreditation Body data told the outlet that the ecosystem “never once during all of Phase 1” used more than half of available assessment capacity.

The article also points out that no DoD policy ever made the November 2026 date a hard deadline for every contractor. Phase 2 was the point at which contracting officers could begin requiring Level 2 certification in new awards, not a cutoff for the whole DIB.

How was the review conducted?

The reporting describes a compressed process:

• The RFI was open for 30 days. A government source said that a 60 or 90 day window would have drawn more responses from a sector where 509 companies is under 1% of participants.
• The task force reviewed more than 1,100 submissions and narrowed them to 997 in three days.
• About 20 people took part, including the CMMC program office director and deputy. Staff were instructed not to use AI tools, so most analysis was manual.
• The final recommendations came from a task force led by Cynthia Carpenter on the DIB operations side of the CIO’s office, which a former official described as organizationally “opposite from CMMC.”

By contrast, the October 2024 rule that updated 32 CFR Part 170 drew 1,400 comments and took about eight months to process.

An industry source also told the outlet that the RFI asked the wrong questions. CMMC itself is narrow: how an assessment is run, how boundaries are scoped, what a POA&M may contain and for how long, and how assessors are trained and vetted. The RFI asked about the cost of the underlying requirements instead, which are owed under DFARS 252.204-7012 whether or not anyone verifies them.

Federal News Network also reports, citing anonymous government sources, that the CMMC program office was not consulted before the suspension and learned of it from the public announcement. Three unnamed sources told the outlet that Davies privately said her goal is to end the program. DoD declined to comment after the outlet sent 15 questions. Treat those claims as reported, not confirmed.

What do the lawyers and former officials expect next?

Eric Crusius, a partner at Hunton, told the outlet that “the cost of program is blamed on certification instead of underlying certification controls, which are not part of the CMMC program.” He added that “the underlying certification controls haven’t changed and the department has not retreated from it.”

Katie Arrington, who led CMMC during the first Trump administration and performed the duties of DoD CIO before Davies was confirmed, made the same point: “DoD is still back to ground zero because there was nothing in the RFI that talked about moving away from those requirements.” She expects the Department to push the Level 2 requirement to 2029 and warned that turning off demand for two years will shrink the assessor ecosystem before it is needed again.

What does this mean for your contract today?

Nothing in the investigation changes your current obligations. Class Deviation 2026-O0025, Revision 3 still requires baseline NIST SP 800-171 Rev. 2 compliance under DFARS 252.204-7012. Contracting officers may still include Level 1 or Level 2 self-assessments in solicitations. Your SPRS score is still a representation the government can rely on.

The investigation does change the planning picture in three ways:

1. The cost is in the controls, not the audit. If your budget assumed the assessment was the expensive part, the RFI data says otherwise. The spend that matters is in the 110 requirements, the SSP, the encryption, and the people who maintain them. That spend is owed under 7012 whether or not CMMC returns.
2. The capacity argument is weak. If you deferred an assessment because you expected no assessor to be available, the data does not support that. Assessors have open calendars, and some are now struggling to stay in business.
3. The timeline is unknown. The review has passed its own deadline with no published outcome. Plan for 800-171 as a standing requirement and treat any CMMC schedule as unconfirmed until a rule or deviation says otherwise.

What should a small contractor do this quarter?

• Price the controls, not the certificate. Separate your 800-171 implementation and maintenance costs from your assessment costs. Most of what the RFI respondents complained about falls into the first bucket, and that bucket does not go away.
• Check the recurring line items. Respondents named licensing, enclaves, and dedicated staff as the ongoing burden. Review whether your email, file, and document tools require a separate enclave or a second identity system to keep CUI in scope. Our Office 365 migration article walks through where that cost comes from.
• Keep the SSP current. Respondents ranked the SSP as the heaviest single burden. An out-of-date SSP is also the first thing that fails under a False Claims Act review.
• Decide on the assessment on your own terms. With 2,433 companies certified and assessors available, a Level 2 certificate is still obtainable. Whether it is worth the cost before the review concludes is a business decision, not a capacity one.

Where collaboration tools fit

The RFI’s top cost drivers, recurring licensing, enclave architecture, and inconsistent interpretation, show up most often in email and file sharing, where CUI moves between people and outside the organization. IRONKEEP keeps mail, files, docs, and chat under tenant-scoped encryption keys with built-in identity, retention, and audit evidence, so a small contractor does not need a separate enclave for each workload. It does not replace your SSP or your assessment; your organization still owns both.

If your cost review finds that the recurring burden sits in how CUI is shared, request a defense pilot scoped to one CUI workflow with IRONKEEP. Define what the reviewer needs to see, test with synthetic files, and confirm deployment suitability and contractual requirements before introducing controlled information.

Set the next review date

Give one owner the job of tracking the CMMC review and reporting back monthly. Bring your 800-171 cost breakdown, your SSP revision date, and your current contract clauses to that meeting. Decide what you will keep spending on regardless of the outcome, and record the reason. The second part of this series covers what the task force recommended and which changes could arrive without rulemaking.