Image courtesy of AGC of America

By KERRY SMITH BUCK

WASHINGTON, D.C. – The U.S. Dept. of War (DoW) announces the immediate suspension of the Cybersecurity Maturity Model Certification phase two requirements, which were set to take full effect Nov. 10.

The suspension, filed on July 13, came in response to recent data collected by the Small Business Administration that found that CMMC compliance burdens are forcing companies out of the Defense Industrial Base.

The DIB is the worldwide complex of organizations, facilities and resources that research, design, produce and maintain military weapons systems and equipment. It includes more than 100,000 prime contractors, subcontractors and research labs that supply the Dept. of Defense.

This suspension does not eliminate the requirement for companies to protect federal data, the Associated General Contractors of America says; contractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012.

The suspension will last 60 days to give the DoW time to review the CMMC program through a newly formed CMMC reform task force. During the two-month suspension, the task force will review the future of the program and the feasibility of Phase II CMMC requirements and make recommendations through industry feedback via a public request for information and delivery recommendations through the RFI within 60 days. The RFI, available through SAM.gov, can be found here.

All contractors must still meet existing cybersecurity obligations, including those that were required under Phase I of CMMC, meaning that they must still comply with Levels 1 and 2 self-assessment requirements.

As originally written, CMMC framework is designed to protect Controlled Unclassified Information and Federal Contract Information, imposing rigorous cybersecurity requirements that impact not only prime contractors but also the entire supply chain, including subcontractors.

Despite the Phase II suspension, all Phase I requirements, which establish self-assessments for CMMC Levels 1 and 2, remain in place.