Defense Industrial Base

The SBA put assessor supply at about 100 without saying what the count measured, and the department used the same figure the same day. Four days later the accreditation body counted over 1,000 certified assessors. The ratio in the press release described a population and a label, not a queue.

The CMMC Reform Task Force's summary, obtained by Federal News Network, recommends restarting Phase 2 on a narrower population within a 90-day horizon and widening POA&Ms from 180 to 270 days. The narrowing runs through a CUI marking rule that has not published, and the summary was assembled in three days without the program office's involvement.

The Phase 2 pause cut the schedule assessment firms were hiring and pricing against. Named assessors describe layoffs and cancellations, the accreditation body's own numbers show capacity still growing, and the one figure that moved the wrong way is the number of assessments in progress.

The first surveys since the CMMC Phase 2 pause show the compliance drift mostly did not happen. About 78% of contractors kept going; a roughly 22% minority slowed, and the pullback was in certification spend, not controls.

A contractor can inherit 80 to 90 percent of its CMMC controls from an MSP or cloud platform. The shortcut solves the cost and assessor bottleneck, and it concentrates the residual risk in a customer responsibility matrix most small firms can't read.

CMMC automation has split into two poles: a document generator that scored itself 44 out of 100, and continuous-monitoring tooling built for an assessment target that keeps moving. Which parts to buy, which to build, and which to defer.

The CMMC pause was not a CMMC decision. It was Pillar 3 of a five-pillar acquisition doctrine building since Executive Order 14265, and it moved the compliance question from who signs the certificate to how the government will confirm security at all.

Deep Fathom spent the spring selling a compliance product and the summer writing the reform that would make software-assisted review policy. The conflict is disclosed. The report that would settle it has not been published.

Open-CMMC v2.0 extends the CUI enclave from the server room to the CNC floor over SMB. The release is notable less for the feature than for how honestly it scopes the parts that cannot be encrypted.

Open source removes CMMC's license fees and vendor lock-in, but it moves the entire burden of proof onto the small business that adopts it. The push toward continuous monitoring cuts both ways.

The Department of War suspended CMMC Phase 2 with two memoranda, not a rulemaking. The program's future is now a predictability problem more than a compliance problem.