The CMMC Task Force's Path Forward: What Could Change Without Rulemaking

The CMMC Reform Task Force has sorted the request for information (RFI) recommendations into changes the DoD CIO can make now, changes that need rulemaking, and changes outside the CIO’s authority, according to Federal News Network. The second article in its investigation, published October 27, quotes the task force’s September summary: “several are feasible in the short term, while others would require more time and effort to implement, if approved.” Nothing has been approved. The value for a contractor is in seeing which changes are likely to arrive first and which you should not wait for.

This article covers the second part of the investigation. Our first article covers what the RFI data said about the reasons for the pause.

What are the three tiers?

The reporting describes the task force’s sort as follows.

Tier 1: changes the DoD CIO could make without rulemaking. Resolve the ambiguity caused by inconsistent interpretation among assessors, primes, and the CMMC program office. Implement NIST SP 800-171 Revision 3, which has been on hold since Davies took office in December. Address inconsistent CUI marking by the military services, defense agencies, and the defense industrial base (DIB).

Tier 2: changes that are harder, costlier, longer term, and may or may not need rulemaking. Extend Plan of Action and Milestones (POA&M) closeout windows. Publish templates and configuration settings for acceptance testing. Address reciprocity with other frameworks such as ISO 27001.

Tier 3: reasonable suggestions outside the CIO’s authority. The documents reviewed by the outlet do not itemize these.

Separately, the task force offered five sets of recommendations. Some repeat the tiers above, such as finalizing the move to Rev. 3. One calls for a further revision of 800-171 to address “the new direction from the CMMC Reform Task Force.” The documents do not say what that direction is.

What timelines did the task force attach?

The article reports the following targets from the task force summary. All are proposals, not commitments.

Under the current 32 CFR Part 170 rule, a Level 2 POA&M must be closed within 180 days of the assessment. Our guide to POA&Ms at Level 2 covers what belongs on one and the limits on its use.

Why does CUI marking rank so high?

Respondents said inconsistent marking creates both ambiguity and cost. If a program office stamps everything CUI, the contractor has to protect everything. The article quotes DoD’s summary: clearer marking “has the greatest potential to narrow the DIB population subject to NIST 800-171 implementation and cybersecurity related costs.” A planned FAR rule “would include establishment of a new standard form for clearly articulating the CUI data to be shared (and safeguarded).”

For a contractor, this is the change with the largest potential upside and the least control from your side. You cannot fix how the government marks documents. You can document what you receive, question markings that look wrong, and keep CUI in one place so the scope of your 800-171 system stays as small as the markings allow. Our article on encrypted CUI covers why “small scope” has to mean the data is actually confined, not just encrypted.

Why does the Rev. 3 delay matter?

An industry source told the outlet that the rule to move DoD contracts to Rev. 3 was reportedly on Davies’s desk when she chose to suspend the program instead. The consequence for contractors is a split baseline. The forthcoming FAR CUI rule calls for Rev. 3, while DFARS 252.204-7012 still pins defense contracts to Rev. 2, which is more than 10 years old. The source said that leaves two outcomes: “either defense contractors have two baselines or DoD will have to rapidly catch up and shorten or eliminate the transition to Rev. 3.” Both add cost.

The same source pointed to an authority that already exists. The 7012 clause lets the DoD CIO issue waivers or variances for specific CUI protection requirements, and CMMC allows waivers at the contract level. Neither has been publicly acknowledged as an option during the pause. For a contractor, the practical point is that a targeted waiver is the mechanism that would relieve a specific control, not a programmatic suspension, so no control should be treated as relieved until a waiver or deviation says so in writing.

What did the article say about funding and tools?

The task force summary says “many respondents requested availability of free tools, grants, subsidies or tax credits.” DoD could “develop free tools, subject to funding availability.” For grants or tax credits, it “could advocate on behalf of the DIB but could not unilaterally address these recommendations.”

Former CMMC lead Katie Arrington, quoted in the article, proposed a Small Business Administration loan program where “the government would forgive the debt after so many years.” Eric Crusius, a partner at Hunton, said a loan or grant program for third-party assessments “would be an easy win for DoD” and suggested cutting assessment teams from three people to two.

Arrington also noted that DoD never ran a cost realism study for 800-171 compliance, which she said the acquisition community has been asked to do for nine years. A former official added that the regulatory impact analysis required when the 2017 rulemaking process was updated “never got done.” Until one exists, the cost figures in circulation come from vendors and respondents, not from a government estimate.

None of the funding ideas exist today. Do not build a budget around them.

What stays the same regardless of outcome?

Several sources in the article make the same point from different angles.

• The 7012 clause and NIST SP 800-171 remain in force. Class Deviation 2026-O0025, Revision 3 requires Rev. 2 compliance now.
• Crusius warns that some companies are treating the assessment pause as if the controls no longer apply. The CIO’s office has said they do. He lists the exposure: False Claims Act liability, contract cancellation, and poor performance ratings. A third-party certificate makes recklessness harder to argue but does not fully protect a company.
• A federal official told the outlet that “self-assessments do not provide assurance with risk mitigation.” Among RFI respondents who answered the question, 58% said self-assessments improved their security and 43% called them “check-the-box.” Fewer than 20% answered.
• Arrington’s summary: “Everyone needs to be Level 2 for their own insurance policy.” She said primes are already using CMMC to limit their own liability for subcontractor failures.
• Crusius said C3PAOs are laying off staff and some may close. If DoD wants third-party assessment later, it “will have a hard time to gin up capacity.” A contractor that wants a certificate may find it easier to schedule now than after a restart.

The article also notes that Davies released the Brilliant at the Basics campaign shortly after the pause. Our Brilliant at the Basics guide maps its 10 practices to Rev. 2. An industry source told Federal News Network that implementing those practices may cost as much as CMMC itself.

What should a small contractor do with this?

1. Act on Tier 1 before DoD does. Interpretation guidance, Rev. 3 alignment, and CUI marking are all things you can start on your own. Read the Rev. 3 requirement text now, note where it differs from your Rev. 2 implementation, and record the gaps. If Rev. 3 arrives without rulemaking, you will already know what changes.
2. Watch for the POA&M amendment. A 270-day closeout window would change how you sequence remediation. Until it is published, plan to the current rule.
3. Collect your ISO 27001 evidence if you have it. If reciprocity credit arrives within six months, you will want a crosswalk from your ISO controls to 800-171 requirements ready before an assessor asks.
4. Do not wait for templates, OSCAL, or grants. These are one-year targets at best and depend on funding and rulemaking. Your SSP and your assessment preparation cannot wait on them.
5. Reduce the CUI you hold. The single highest-leverage change in the whole summary is narrower marking. Ask your prime what is actually CUI, keep it in one system, and limit who can reach it. That shrinks your 800-171 boundary no matter what DoD decides.

Where collaboration tools fit

Most of the Tier 1 and Tier 2 items land on the same operational question: can you show where CUI lives, who touched it, and what controls were in effect at the time? IRONKEEP keeps mail, files, docs, and chat under tenant-scoped encryption keys with built-in identity, retention, legal hold, and audit evidence export, so the boundary around CUI stays narrow and the evidence is ready when an assessor or a prime asks. It does not replace your SSP or your assessment; your organization still owns both.

If narrowing your CUI boundary is the next step in your plan, request a defense pilot scoped to one CUI workflow with IRONKEEP. Define what the reviewer needs to see, test with synthetic files, and confirm deployment suitability and contractual requirements before introducing controlled information.

Set the next review date

Assign one owner to track each tier. Tier 1 items could appear without notice. Tier 2 items will show up in the Federal Register. Tier 3 items depend on other agencies and may never arrive. Bring the table above to your next compliance meeting, decide which items change your plan if they land, and record what you will do in each case. When DoD publishes its review, you will be reacting to a list you already know.