DoD's reasons for CMMC pause falling apart in face of RFI responses

Defense Department documents show the biggest challenges are not with CMMC, but with the underlying NIST standards.

This is part 1 of a two-part investigation into the Cybersecurity Maturity Model Certification (CMMC) program. Part 2 will come out on Oct. 27.

The Defense Department has backed itself into a corner with the Cybersecurity Maturity Model Certification program.

Every reason Kirsten Davies, the DoD chief information officer, gave for pausing CMMC and for conducting a “top-to-bottom” review has been called into question based on data in its own request for information.

Davies, who at least three sources say has privately stated that her goal is to “get rid of the program,” now can’t make the forthcoming recommendations fit her narrative and has a limited path to move forward with CMMC.

“The final CMMC report is delayed because Davies can’t make it say what she wants it to say. The RFI responses and data didn’t support her goals,” said a former government official, who is familiar with CMMC and requested anonymity for fear of retribution. “I believe Davies wanted the task force to come back with recommendation to end the third-party assessments because it was most difficult for small businesses and what she considered the biggest problem with the program. But the RFI responses don’t support that claim and she can’t move forward.”

Explore how DoD, GSA, NASA and OFPP are modernizing workforce strategies, streamlining procurement and leveraging tech to deliver mission outcomes at speed and effectively in our new ebook, sponsored by Icertis.

When DoD paused CMMC in July, Davies called assessments a “burdensome, red-tape ridden, check-the-box, point-in-time view of a company’s handling” of sensitive data. She said the planned compliance requirements progression was creating prohibitive costs and unacceptable burdens to the defense industrial base, and the cost and compliance concerns are creating barriers for smaller companies to compete for defense contracts.

Davies said when DoD initiated the pause that the review team had 60 days to gather feedback and review the program, then 15 days to provide a report with recommendations to herself and Undersecretary for Acquisition and Sustainment Michael Duffey. That 75-day timeline is now pushing over 100 days.

And the reasons for the delay are clear from the data in the RFI, for which DoD reviewed 997 responses with 509 (51%) coming from the defense industrial base and the rest coming from vendors, consultants, the “ecosystem” and others.

Documents obtained by Federal News Network show the top reason the respondents said for the cost of CMMC was the implementation and maintenance not of the program, but of meeting the security control requirements of National Institute of Standards and Technology Special Publication 800-171. That publication is the underlying foundation and requirements for securing controlled unclassified information (CUI) that CMMC is meant to enforce.

“With regard to implementation and maintenance, respondents cited the following key areas of concern: licensing and recurring annual costs (e.g. Microsoft 365 GCC high); enclaves with separate and dedicated hardware and associated operability with enterprise systems; inconsistent interpretation between subcontractors and their prime contractors, assessors, CMMC ecosystem, consultants and government documentation; and external service providers, including managed service providers and cloud services providers,” said an internal DoD email summarizing the RFI responses. “With regard to documentation and evidence, respondents cited the following key areas of concern: creation and maintenance of documentation required to meet the NIST controls; assembling evidence packages in preparation for assessment and inconsistent and lack of guidance for evidence assessment and reuse across cybersecurity frameworks.”

The RFI also shows a top cost driver that respondents highlighted was around concerns related to inconsistent CUI marking policies across DoD, which creates uncertainty for when the company needs to apply NIST 800-171 protections. The way DoD handles CUI has long been a concern, not just for vendors, but across the entire community because of the tendency to mark information as CUI when it doesn’t meet any of the requirements.

In the RFI, respondents said another top cost driver also is related to the complexity of implementing NIST 800-171 security controls. The respondents said they need to have “specialized, dedicated personnel to assist with understanding requirements, implementing solutions and documenting evidence.” DoD says that these requirements are specifically difficult for small businesses who have more limited budgets to afford high-priced expertise.

Davies, Duffey and Kelly Loeffler, the administrator of the Small Business Administration, have all said the cost of CMMC is prohibitive to small firms and that is a major reason for the pause. SBA’s own Office of Advocacy wrote a letter to DoD in February expressing concerns about the costs of CMMC compliance.

But again, this is where DoD’s rationale falls short. The RFI found the cost of the CMMC assessments to be well over-stated, with the average cost to comply with CMMC – and not NIST 800-171 – at $47,000.

Loeffler said in July that complying with CMMC could cost as much as $600,000. About 47% of the respondents said the cost of the third-party assessors was one of the top cost drivers, rating fifth overall.

“This perception, as was noted by many commentors, is in contrast to the average assessment cost ($47,000) directly cited by a subset of respondents. Notably, prices have reduced over the first year of CMMC implementation as the natural forces of supply and demand have taken effect,” DoD wrote.

Sources say third-party assessment organizations (3PAOs) provided DoD with copies of contracts to demonstrate that the costs were not what they were advertising.

Federal News Network repeatedly asked DoD to comment on the RFI results, the review process and Davies’ overall feelings about CMMC, sending 15 specific questions. DoD declined to comment.

Even the rationale that the burden of CMMC was too much for firms to bear turned out to be false. Respondents to the RFI did say the burden of 800-171 was high, specifically around certain security controls that the companies felt didn’t actually lower risk. But the respondents didn’t say the burden of CMMC was too high.

“With regard to requirements that create overhead and financial burden, system security plans (SSPs) were ranked highest because they claimed it required significant effort to document and does not directly provide cybersecurity,” DoD wrote. “The requirement for FIPS-validated encryption was cited next as overhead and financial burden, respondents cited concerns with the timeline to get through the FIPS process and disruptions with respect to updates.”

A third common reason DoD gave for suspending CMMC is a shortage of assessors.

Davies wrote in July, “The combination of prohibitive compliance costs, severe shortages in third-party assessment capacity and complex regulatory timelines is actively forcing innovative new entrants and small businesses to opt out of [DoD] contracts and freezing critical suppliers out of the market.”

But the industry source said that too continues to be proven false based on DoD’s own data provided by the Cyber AB.

“On a monthly basis the number of third-party assessors from the Cyber AB townhall shows there are plenty of 3PAOs. This is data from how many available 3PAOs and the demand for Level 2 certifications from contractors is directly reported out of DoD’s database. There has never once during all of Phase 1 where ecosystem utilized more than half of the available assessment capacity,” the source said. “Compared to DoD’s own estimates in the CMMC final rule, they have way more than enough capacity to support the assessment demand they expected well in to Phase 3 of roll out. They said not enough capacity or assessors, but have not provided any answers about how many are enough.”

When contacted about the programmatic pause, the Cyber AB declined to comment.

As of September, Federal News Network learned 2,433 companies have received Level 2 third-party certifications. The source said that is five time the number of companies that DoD estimated would be able to achieve Level 2 in first 12 months of the program.

“When you compare that with assessment teams, it’s not approached half of the available capacity. Companies haven’t come close to maxing out the available assessment capacity,” the source said. “And keep in mind, there is no DoD policy that makes the November 2026 deadline a requirement for all vendors to achieve a Level 2 certification. That is when DoD begins the requirement to include Level 2 in contracts.”

Another industry source said quite simply after reviewing the RFI responses and following the CMMC program closely that DoD’s “math isn’t mathing.”

“When they get every fact about the program incorrect, when they talk about the program and are conflating cost with DFARs 7012 and existing cyber requirements, it’s clear that they misunderstand their own policy,” said the industry expert, who requested anonymity. “Based on their reasons, anyone on the outside would be hard pressed to think they understand the program because everything they say about it is provable incorrect through their own policies. This is really stunning to watch.”

The source said the RFI was problematic from the start.

“The issue with the RFI is DoD was asking for all requirements and not focusing on third-party assessments of the NIST 800-171 requirements. The CMMC program is relatively narrow in terms of what is in program. It’s all about how to run an assessment, how it is scoped, how the boundaries are scoped, the plan of action and milestones timeline and what is allowable,” the source said. “There are details on the verification process. It talks about training, vetting and giving authority to assessors and assessment teams. None of that has anything to do with requirements that get assessed by program. But RFI and subsequent suspension of third-party verifications is focused on the requirements and not the verification process.”

Sources say Davies hasn’t done enough to understand the CMMC program. Since the Senate confirmed her as the DoD CIO in December, she has met with the CMMC program office for only 20 minutes. Sources say she had a 90-minute meeting scheduled in late February or early March, showed up late to the meeting and gave the PMO team only 20 minutes.

“CIO leadership had no substantive communication with the cybersecurity directorate for more than eight months,” said a government source with knowledge of CMMC. “Davies and her team aren’t talking to anyone who knows anything about CMMC. They like to do everything in a silo. When she arrived in January, she stopped all CMMC work, told the program office not to engage with anyone and the program office didn’t hear anything from them about what they could or couldn’t do until Davies put on official hold on the program in July. There was zero communication on their plans or intentions to the CMMC PMO.”

Multiple sources say that the PMO tried to engage with Davies and her team, but had no luck and didn’t find out about the pause beforehand.

“The CMMC program office wasn’t notified or consulted before the suspension was announced. They found out the way industry did, from the public announcement. The Cyber AB was not told in advance either,” the third source said. “I don’t think Davies understands the cyber threat or the history of why CMMC exists. It’s not to punish the DIB ecosystem. It was stood up in response to constant exfiltration to controlled information.”

Katie Arrington, who was performing the duties of the DoD CIO before the Senate confirmed Davies, has been a vocal supporter of CMMC and rolled it out during the fi