What Happened
Defense Department's Reasons For Suspension Falling Apart
The US Department of Defense’s pause of the Cybersecurity Maturity Model Certification (CMMC) program is facing criticism amid responses to a request for information (RFI). The RFI responses show that the top cost drivers for CMMC compliance are related to the implementation of NIST 800-171, not the CMMC program itself. Industry sources say that DoD’s rationale for the pause is flawed and based on incorrect data, and that the program’s suspension may have significant implications for the defense industrial base. The CMMC program was designed to improve the cybersecurity of the defense industrial base, and its pause has raised concerns about the potential impact on national security, as reported by Federal News Network.