Back

posted in

Announcements

Phase 2 Suspension

My two cents and personal opinions only:

The Phase 2 suspension feels more like a postponement than a halt of any kind.

"Additionally, the Department will begin a comprehensive review of CMMC aimed at aligning with Secretary of War Pete Hegseth's Acquisition Transformation System (ATS) directives prioritizing speed to capability, lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures."

I think this quote is the heart of the matter. I've seen estimates of ~80,000 contractors with level 2 requirements. According to this analysis it lists for CMMC Level 2:
Adoption rate: 8% (certified), 42% (in progress)
Average implementation time: 12-18 months
Compliance cost range: $75,000 – $300,000
(sources in link)

... which leads me to believe there's an estimated half (~40,000) of contractors where level 2 isn't on their radar.

Of course these aren’t official DoW numbers, but they paint a reasonable picture of the landscape.

I believe C3PAOs and assessors are still needed, and how/where they fit in will be realized during this 60-day window (or at least, eventually).

Speaking as someone who's not yet CMMC certified, I'm confident saying that the pursuit of becoming certified is worthwhile and I plan on doing so as soon as I can (because those T3 background checks won't be getting any shorter!)