Clarion Street

The CMMC Pause Rested on 'About 100 Assessors.' Nobody Said What That Counted.

·15 min read

The sentence that put a number behind the CMMC pause came from the Small Business Administration on July 13. Phase II, the release said, “would have required more than 120,000 DIB small businesses to seek compliance through a cost-prohibitive system supported by only about 100 approved assessors.”

The department gave three reasons: cost and burden, regulatory complexity, and a shortage of assessment capacity. The first two are arguments about what a program costs and how hard it is to read. The third is a claim about supply, and it is the only one of the three that counting could settle, if anyone had said what to count.

I wrote about the selling side of this in October, using the September census and a set of named assessors describing cancelled bookings. The RFI summary behind Federal News Network’s October 26 and 27 investigation has been picked over twice on this site since, for the cost finding and for the task force’s 90-day restart option. The capacity material is the part neither post used: two figures the investigation put on the record, a census published two days behind it, and one count that was public in July and has not been in this site’s coverage.

What the 100 was counting

The pairing of 120,000 companies against about 100 assessors has been quoted on this site before, and by Kirsten Davies in the plainest terms anyone has used: “the math just simply doesn’t math”.

Nothing in the SBA release defines the word. It says Phase II would have been “supported by only about 100 approved assessors.” Davies at the podium the same day put it at “somewhere in the neighborhood of 100, maybe a little over 100 assessors that are available for that.” Neither document, nor the memo behind them, says whether that means accredited firms, credentialed individuals, or the number of assessors free to take new work in a given month.

The first figure that could have answered it came four days later. Federal News Network reported on July 17 that the Cyber AB put the program at “over 1,000” CMMC certified assessors, the people who carry out the third-party audits. The firm counts came later: 117 authorized or accredited C3PAOs in the September town hall, 120 in October, four of them fully accredited to ISO/IEC 17020.

By fall the word had three candidate referents on the record: about 100 in July, over 1,000 certified assessors in July, and 117 accredited firms in September. The 100 sits close to the firm count and an order of magnitude below the count of people. I have found no source that says which one the SBA or the CIO meant, and I am not going to pick for them.

What follows holds either way. Read as firms, the sentence compares a population of companies to a population of companies and carries no throughput at all, because a firm count cannot tell you how many assessments the sector finishes in a year. Read as credentialed people, the figure is contradicted by the accreditation body’s own accounting four days later, and nobody at the department has explained the difference. Either way, an assessor number describes supply only if you already know how much assessment one assessor delivers, and nothing in the record says.

A different comparison is on the record. Matt Travis said in 2025 that full implementation would need between 2,000 and 3,000 certified assessors, and the department projected full implementation for late 2028. That target is roughly two to three times the Cyber AB’s count of over 1,000 certified assessors. Because the current count is reported as a floor, the size of the remaining shortfall cannot be calculated, and I am not going to guess at it. The number Travis gave is checkable, and it is not the one in the press release.

What the 120,000 was counting

The numerator moved too, and the documents disagree about it. The SBA release says Phase II “requires many small contractors to complete either a self-assessment or a third-party assessment, depending on contract requirements,” so part of its 120,000 was never going to buy an assessment at all. Davies, at the podium the same day, put it differently: “over 100,000 DIB businesses still that needed a third-party assessment”. The department’s own estimate, reported by Federal News Network that same day, was roughly 80,000 companies that would eventually be subject to the third-party requirements.

Three numbers for the same population, all published on July 13. An earlier post on this beat used the smallest of them when it observed that the queue could not clear on any timeline the rule assumed.

The sentence that anchored the capacity argument took the largest population anyone had named and set it against an assessor count that was never given a unit. Neither number was wrong on its own. One was a sector size, the other was a supply label, and dividing them produced a ratio that has been quoted ever since as though it measured a queue.

The department’s own consultation ranked the assessment fifth

Federal News Network reports that about 47% of respondents named the cost of third-party assessors as one of the top cost drivers, “rating fifth overall.” The top driver was implementing and maintaining NIST SP 800-171. Inconsistent CUI marking was another top driver, and so was the complexity of the controls themselves. A second account of the summary, published on CMMC.com, ranks the items the same way. CMMC.com is Secureframe’s content property, so I am citing it for the numbers rather than for its reading of them.

That ranking measures cost, not capacity, and I am not going to treat it as a refutation of the shortage claim. The department never asked respondents whether there were enough assessors, so the summary cannot say. What the ranking does say is narrower. When the department sorted through 997 responses to ask what actually cost people money, the assessment came fifth and the controls underneath came first. Whatever the pause was meant to fix, its own consultation pointed at the standard and at how much CUI gets marked, not at the supply of people who check the standard.

The cost analysis on this site already made that point, and the newer data does not disturb it. Clearer CUI marking is the reform item the department described as having the greatest potential to shrink the regulated population, and the evidence work underneath the controls is where the cost sits. Both changes would reduce how much of the population has to comply, which is a different remedy from hiring more assessors.

What October added

The census is a monthly count of the accredited base. October’s town hall reported 120 C3PAOs, 4 fully accredited and 116 authorized, with 12 newly authorized during the previous quarter and none leaving the program. Final Level 2 certificates were up 8% on September. There were 78 conditional certificates. Level 2 assessments in progress rose to 184, from 151.

That last pair is the one I said I would keep pulling. The October 21 post called assessments in progress the single figure moving the wrong way, down 5% to 151, and said that if it kept falling while the firm count held, the pairing would need an explanation. In October both moved up.

I also said several months of that would be worth a post. This is one month, and I am not going to bank a trend on it. What gives October more weight than a one-month wobble is that the newsroom figures landed in the same week, and the two together put a rate on the sector for the first time.

The rate is about 229 certifications a month

Phase I began on November 10, 2025. By the end of September that was 324 days, or about 10.6 months. Federal News Network reported 2,433 companies holding Level 2 third-party certifications as of September.

The September town hall reported 2,362 final Level 2 certificates and 71 conditional ones. Those two add to exactly 2,433, which suggests the newsroom figure counts conditional certificates in the total. The October recap gives a percentage and no absolute count, so I am not going to multiply 2,362 by 1.08 and call the result a fact.

2,433 over 10.6 months works out to about 229 certifications a month across the whole sector. Against October’s count of 120 firms, that is about 20 each over the period.

That is Phase I output, not a ceiling. It measures what the sector finished while self-assessment was the requirement and third-party assessment was voluntary, and it is not a forecast of Phase II demand. As a counterfactual it does one job for this post: point the rate the sector actually achieved at 120,000 companies and the work runs about 44 years, or 22 if every firm doubled its throughput. The remedies in the task force’s own summary do not propose doubling anything. They propose serving fewer contractors.

Federal News Network’s source also said 2,433 was five times the number of companies the department estimated would be able to reach Level 2 in the program’s first twelve months. Both sides of that comparison are company counts. It says adoption ran well ahead of the department’s forecast, and it says nothing about how much assessment work the sector could absorb. The capacity reading the source attached to the same number is one anonymous claim, and it is treated as one below.

The utilization claim, and whose it is

Federal News Network’s source said that in no month of Phase I did the ecosystem use “more than half of the available assessment capacity”, and that the department has never said how much capacity would be enough. That is one anonymous industry source. The Cyber AB declined to comment on the pause when asked. Weight it accordingly.

Nothing else in the record measures it. Certificates per assessor is not a utilization rate: take the bench at over a thousand certified assessors and 2,433 certifications over ten and a half months and you get about two each for the whole period, but assessment work runs in teams and takes weeks, and plenty of those credential holders may not be staffed to assessment work at all. I can’t turn that into spare capacity.

The census cannot settle it either. The 184 assessments in progress came up from 151, but the recap reports the label and the number without defining the category, which is the same caveat I attached to the September figure. A count of open engagements is activity. It cannot separate finished work from bookings, and it says nothing about how much more the firms could have taken on. Read across 120 firms it is about one and a half each, and that is arithmetic about a label, not a finding about capacity.

The utilization claim rests where it started. One anonymous source says the ecosystem never used more than half its capacity, and nothing published confirms or refutes the percentage.

What makes it credible is the requirement’s own structure. Phase II was never a requirement that 120,000 companies hold a certificate on one date. It was a condition of award attached to contracts that involve CUI, phased in by solicitation, and the same source said as much: “there is no DoD policy that makes the November 2026 deadline a requirement for all vendors to achieve a Level 2 certification.” A requirement that arrives contract by contract does not need to clear 120,000 in a year. The 120,000 figure described the size of the affected sector, and it was used as if it described a queue.

What a stable firm count cannot see

A firm can keep its accreditation while the assessors inside it leave, and the census cannot see that. Matt Travis said as much in October, acknowledging that “many C3PAOs have lost pipeline” while the count held at 120. Named assessors were describing layoffs and cancellations in August and September, in the reporting the October 21 post carries.

The contraction shows up in the pipeline that produces assessors. The count of firms that employ them has not moved. Growth in CCAs and CCPs slowed in October, and Travis said he expects that to continue given lower class enrollment. Approved Training Providers went from 53 to 49 between August and September and stand at 47 in October.

The training content is the clearest signal, because it is a decision someone made and wrote down. CAICO had planned new CCP and CCA content and exams for January. It has pushed that to the first quarter of 2027, with a beta running from January through late February, curriculum finalized in March, and new exams expected in early April after the ISO/IEC 17024 standard setting. The current Rev 2 content stays authorized through March 31, 2027, and the exams stay available through September 30, 2027. The stated reason for the delay is the Phase 2 pause.

That is a supplier holding off on new product until it knows whether a market exists for it. Unlike the layoff claims from August, it comes with a date, a stated reason and a published schedule. The bench Travis said needs to reach two to three thousand is the same bench that just had its next training cycle pushed back a quarter.

What a narrower restart does to that

The task force’s near-term option is to restart Phase 2 for a narrower population within 90 days, which I looked at on October 30. That option at least fits the arithmetic. A population sized to the rate the sector actually achieved is a different proposition from 120,000, though nobody has published the number they have in mind.

It is also a decision to cut demand further. Fewer contractors in scope means fewer assessments ordered, whatever turns out to be true about utilization. On the one account in the record, the sector was already using less than half its capacity, so a fix aimed at the schedule would land on a supplier base that was already short of work. I have not seen anyone in this debate say that out loud, and the firms that lost pipeline when Phase II was suspended are being told the restart will serve fewer customers.

Whether that matters depends on how long the narrowing holds and how the credential pipeline responds, and neither is knowable from the documents. What the documents do say is that the reform under discussion is a scope decision. Nobody in it is describing a larger assessor base; the numbers on offer are smaller populations.

What I would tell a contractor

Nothing published tells you how long a company that is ready for a Level 2 assessment waits for a slot. The census counts firms, certificates and engagements in progress, and the label on the last one is undefined. There is no queue length, no median wait, no booking backlog in any of it. That is true of the department’s press release too, which printed a ratio and never explained what went into it. I would not plan around a capacity constraint I cannot measure, in either direction.

What is measurable is the cost side, and it is where the department’s own consultation put the weight. The first-ranked cost driver among 997 responses was implementing and maintaining NIST SP 800-171. Third-party assessor cost rated fifth. That ordering measures money, and the recommendations that follow from it point at the controls and at how much CUI gets marked, not at the number of firms able to audit them. None of those recommendations has a date yet.

What to watch is the credential pipeline, not the firm count. If a restart lands in 2027 on a population the CUI marking rule has not yet drawn, the assessors doing that work will be whoever is still in the pipeline when it lands. A count that held at 120 through 2026 does not forecast that.

I don’t think the capacity rationale was invented. It was the one reason among the three with numbers next to it, and the numbers turned out to be a population that was never a queue divided by an assessor count that was never given a unit. The census has had another month to show the accredited base shrinking and has not: the firms stayed, the certificates kept coming, and none of the 120 left. What that leaves is a supplier base asked to wait while the answer is worked out, and the wait is already in the training schedule. The marking rule is where the remaining population gets decided and it has no date. The training schedule is where the supply side showed its hand first, and it has already slipped a quarter.

Sources

  1. SBA Commends U.S. Department of War’s Suspension of CMMC Phase II for Small Defense Contractors — SBA news release 26-73, July 13, 2026
  2. DoD’s reasons for CMMC pause falling apart in face of RFI responses — Federal News Network, Jason Miller, October 26, 2026
  3. Pentagon suspends CMMC phase two requirements, launches review of program — Federal News Network, Justin Doubleday, July 13, 2026
  4. DoD plans CMMC listening sessions as questions swirl around review — Federal News Network, Justin Doubleday, July 17, 2026
  5. Pentagon announces ‘immediate suspension’ of CMMC Phase II mandates — Breaking Defense, July 13, 2026
  6. October 2026 Cyber AB Town Hall Recap — CMMC.com, October 28, 2026
  7. September 2026 Cyber AB Town Hall Recap — CMMC.com, September 30, 2026
  8. CMMC Reform Task Force Outlines Possible Phase 2 Restart Among Other Options, FNN Reports — CMMC.com, October 28, 2026
  9. About CMMC — U.S. Department of War, Chief Information Officer (retrieved from the Wayback capture of October 21, 2026)
  10. The CMMC Pause Took Away the Calendar That Assessment Firms Staffed Against — Clarion Street, October 21, 2026
  11. The Pause Has a Drafted Exit Ramp. It’s a Smaller Phase 2. — Clarion Street, October 30, 2026
  12. The CMMC Inheritance Shortcut: MSPs, CSPs, and the 90% You Don’t Own — Clarion Street, October 15, 2026