How companies can benefit from the Pentagon’s move to rethink CMMC
Posted by [email protected] on Aug. 4, 2026 / Subscribe 0
The Defense Industrial Base can move faster without giving up control of its most sensitive data
By Benjamin Karrasch, Corello
When the Department of War announced on July 13 that it would immediately suspend the “Phase II” requirements of the Cybersecurity Maturity Model Certification (CMMC), the reaction across the defense supply chain was equal parts relief and uncertainty.
The requirements, originally slated to take effect on November 10, 2026, were designed to harden cybersecurity across the Defense Industrial Base (DIB). But in practice, they had come to represent something else for thousands of small and mid-sized shops: prohibitive compliance costs and bureaucratic burden that threatened to push exactly the kind of nimble, non-traditional innovators the country needs out of defense work altogether.
In their place, the Department has created a “CMMC Reform Task Force” to conduct a 60-day, top-to-bottom review. Framed under Secretary Hegseth’s Acquisition Transformation System and the “Arsenal of Freedom” banner, the move emphasizes speed, lower barriers to entry, and keeping a meaningful security baseline without the heavy administrative overhead. In the interim, contractors continue to operate under NIST SP 800-171 Rev 2 and remain obligated to protect covered defense information under DFARS 252.204-7012. The message is clear: less red tape, but no compromise on real cyber hygiene.
A Wartime Playbook, Revisited
For those of us who work alongside American manufacturers every day, this moment feels familiar. We have been here before. Eighty years ago, the War Production Board and agencies like the Office of Production Management pulled companies with no prior defense experience into the national effort. Most famously, automakers converted their assembly lines to build aircraft, tanks, and munitions. Ford’s Willow Run plant produced a B-24 bomber roughly every hour at its peak. The genius of that mobilization was not that it relied on a handful of entrenched contractors. It was that it unlocked the breadth of the commercial industrial base.
Today’s emphasis on lowering barriers for small, medium, and non-traditional businesses mirrors that same instinct. The fastest path to capability runs through the broad industrial base, not just the primes. Cutting red tape to gain speed is the second half of that playbook. Wartime mobilization repeatedly relaxed peacetime procurement rules precisely because normal bureaucratic process was seen as too slow for the strategic moment. The current language about removing paralyzing costs and prioritizing speed to capability over bureaucratic compliance is the same trade-off: accepting looser process to keep production flowing.
But there is a subtler parallel that matters most here. World War II did not abolish quality control; it standardized it. The drive toward interchangeable parts and uniform specifications is what allowed dispersed manufacturers to all contribute to a single war effort. The Department’s approach today follows the same logic. It keeps a floor, NIST 800-171 self-assessment and the existing DFARS safeguarding clause, while stripping away the layered certification on top. The goal is a common minimum standard that many suppliers can actually meet, rather than a gold-plated one that only a few can.
The net of all this is that the move to suspend CMMC II holds significant promise, if companies are freed up to operate. That said, lower compliance friction should never mean lower data protection or other pitfalls. Companies can put together a playbook, a tool-kit, on how to ensure positive outcomes.
Next time we’ll look at the possibilities and potential pitfalls of utilizing AI as one tool.
Reach me at [email protected].
0 Comments