The CMMC Pause Is Not a Pause on Protecting Your Data

If you run a small machine shop, a family manufacturer or a nonprofit that supports defense work, the CMMC news has probably left you with one question: should we stop?

The short answer is no. Not because anything dramatic is coming, but because the part of this work that protects your data, and your customers' data, was never paused.

What exactly is paused?

The Department of Defense suspended CMMC Phase II requirements and began a comprehensive review of the program. In its release on the decision, the Small Business Administration said more than 100,000 small businesses are affected and cited compliance costs approaching as much as $600,000.

Phase II is the stage that would have made third party CMMC Level 2 assessments a routine condition of many defense contracts. That step is on hold while the review runs. The review was planned to take about 75 days, 60 days of feedback plus 15 days to write a report. Federal News Network reports it is now past 100 days, with no report published.

What did the new reporting find?

Federal News Network reviewed what DoD learned from the public comments it collected during the review. These are FNN's findings, drawn from records and sources it obtained. DoD declined to comment on the questions FNN sent, and so did The Cyber AB.

According to FNN's reporting:

• DoD reviewed 997 responses. 509 of them, about 51 percent, came from companies in the defense industrial base. The rest came from vendors, consultants and others.
• An internal DoD email quoted by FNN said the top cost concerns were implementing and maintaining the NIST SP 800-171 controls themselves: licensing and recurring costs such as Microsoft 365 GCC High, enclaves, outside service providers, and inconsistent interpretation between primes, subcontractors, assessors and guidance. Documentation and evidence packages were also a major concern.
• Inconsistent marking of Controlled Unclassified Information (CUI) across DoD was another top driver of cost.
• Respondents ranked the system security plan as the most burdensome requirement, followed by FIPS validated encryption.
• DoD wrote that the average assessment cost cited by the respondents who named one was $47,000, and that prices have come down over the first year. About 47 percent named the third party assessor's cost as a top driver, fifth on the list overall.
• More than 2,400 companies already held Level 2 third party certifications, FNN reported.

Why does that matter for a small organization?

Because it moves the conversation from the assessment to the work. Big numbers in the headlines can make the assessment sound like the main expense. The reporting suggests the biggest cost concerns sit in NIST SP 800-171 itself: writing a plan that matches how you really operate, encrypting data the right way, choosing the right systems, and keeping evidence that the controls work.

That work is not new and it is not tied to the CMMC schedule. If your organization handles CUI under a defense contract, DFARS clause 252.204-7012 already expects you to meet the 110 requirements of NIST SP 800-171. The pause concerns CMMC Phase II requirements. It does not remove that clause from your contracts.

There is a quieter lesson too. The things people found hardest, the plan and the encryption, are also the things that protect you on an ordinary Tuesday when a phishing email lands or a laptop goes missing. That work keeps its value whatever the review decides.

What should you keep doing while the review runs?

Keep going at a steady pace. A few practical steps:

1. Know where your CUI lives. List the drawings, specifications and contract files you receive, who touches them and which systems hold them. The smaller that footprint, the less there is to protect.
2. Keep your system security plan honest. Update it to describe how you work today, not how a template says you should. It is the requirement respondents found hardest, so a little progress each month counts.
3. Check your encryption. Find out whether the tools that store and send CUI use FIPS validated encryption, and write down what you learn.
4. Ask your prime how it reads the requirements. Inconsistent interpretation was one of the top cost drivers. A short conversation now can save rework later.
5. Keep your evidence in one place. Screenshots, training records and policies, filed by requirement, so a question gets a clear answer.

None of this calls for panic or a big purchase. It calls for steady, documented progress.

How can Cyber Grants Alliance help?

Cyber Grants Alliance exists so that being small does not decide whether you can protect your data. Our in-kind cybersecurity grants put experienced practitioners to work alongside your team, at no cost to you. For defense contractors, the CMMC Gap Assessment Grant is an in-kind assessment against the NIST SP 800-171 requirements, so you can see where you stand before you decide what to do next.

If that would help, you can apply for an in-kind grant.

Frequently asked questions

Sources

• Federal News Network, DoD's reasons for CMMC pause falling apart in face of RFI responses
• U.S. Small Business Administration, SBA Commends U.S. Department of War's Suspension of CMMC Phase II for Small Defense Contractors
• NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information