CMMC Reform Task Force Outlines Possible Phase 2 Restart Among Other Options, FNN Reports

The Department of Defense's own review of the Cybersecurity Maturity Model Certification (CMMC) program points to a different problem than the one it set out to fix. Federal News Network (FNN) obtained the CMMC Reform Task Force's internal summary of responses to the July 2026 CMMC reform request for information (RFI) and reported on October 26 and 27 that respondents named the underlying NIST SP 800-171 controls and inconsistent CUI marking, not CMMC assessments, as their biggest cost drivers.

The same summary lays out possible reform options, including short-term options without rulemaking as well as longer-term options that would be more difficult, costly, and likely involve rulemaking. Short-term options include restarting Phase 2 for a narrower group of contractors over a 90-day period, expanding Plan of Action and Milestones (POA&M) eligibility to 270 days, and a move to NIST SP 800-171 Rev 3.

None of these options is a decision yet. DoD declined to answer FNN's questions, no new memo or rule has been published, and the requirements contractors operate under today have not changed.

A note on naming: The Department now also uses the name Department of War (DoW). Existing CMMC rules, clauses, and source documents, including the RFI materials covered here, still read "Department of Defense (DoD)," so this article uses DoD and "the Department" as well as DoW.

Understanding the CMMC reform timeline

The CMMC reform RFI was the Department's request for industry feedback on how to reduce CMMC cost and burden. It covered the whole program, including the NIST SP 800-171 requirements that CMMC Level 2 verifies, not just third-party assessments.

It was issued on July 13, 2026, the same day DoD Chief Information Officer (CIO) Kirsten Davies paused the transition to CMMC Phase 2 and created a CMMC Reform Task Force to conduct a 60-day review of the program.

The plan was to give the task force 60 days to collect and review feedback, then 15 more days to deliver recommendations to Davies and Under Secretary for Acquisition and Sustainment Michael Duffey. That 75-day timeline is now pushing over 100 days, with no public report, FNN reports.

According to multiple sources that spoke to FNN, the Department received more than 1,100 comments, disqualified some, and reviewed 997. Of the 997 responses reviewed, 509 (51%) came from DIB companies, and the rest came from vendors, consultants, assessment organizations, and others.

About 20 people worked through them over three days, mostly by hand with a keyword tool and a spreadsheet. The team drew from the CMMC Program Management Office, the Defense Contract Management Agency (DCMA), the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), acquisition and research offices, and federally funded research centers, and was led by Cynthia Carpenter of the DoD CIO's Defense Industrial Base (DIB) operations office.

For a running log of each development in CMMC reform, see the CMMC news tracker.

What did RFI respondents say drives CMMC cost?

Most of the cost burden respondents described has to do with NIST 800-171, the underlying cybersecurity requirements for securing CUI that CMMC is meant to enforce, not CMMC itself.

According to the internal summary FNN obtained, the complexity of implementing NIST SP 800-171 was the top cost driver. Inconsistent CUI marking across the Department, which creates uncertainty for when a contractor needs to apply NIST 800-171, was second. Third-party assessors ranked fifth overall.

The NIST SP 800-171 controls carry most of the burden

Respondents said implementing NIST SP 800-171 requires specialized personnel, which is especially hard for small businesses. On documentation, they ranked the SSP as the single highest source of overhead, followed by FIPS-validated encryption requirements. They also cited the work of assembling evidence packages and inconsistent guidance on whether evidence can be reused across frameworks.

This lines up with what CMMC Level 2 has always been: a verification of requirements contractors already agreed to under DFARS 252.204-7012. Eric Crusius, a partner at Hunton, told FNN that cost complaints aimed at certification are really about the NIST controls, which are not part of CMMC itself.

Inconsistent CUI marking ranks second

Unclear or inconsistent CUI marking was the second-biggest cost driver in the summary. This echoes August reporting that groups including the SBA's Office of Advocacy and the National Defense Industrial Association raised the same issue in their RFI comments. When information is over-marked, under-marked, or marked inconsistently, contractors may protect more systems, people, and suppliers than the contract requires, or miss information that should be protected. Our guides to CUI, CUI marking, and CMMC scoping cover how marking decisions drive scope.

Implementation and maintenance costs recur

The summary also flagged ongoing costs that don't end once a contractor is compliant. These included licensing for platforms such as Microsoft 365 GCC High, CUI enclaves built on dedicated hardware, and fees for external service providers such as managed service providers and cloud service providers. Respondents also pointed to inconsistent interpretation of requirements among primes, subcontractors, and assessors.

As a Microsoft reseller, Secureframe offers competitive pricing on Microsoft 365 GCC High licenses, including Business Premium, G3, and G5. Browse licenses on the Marketplace.

What CMMC itself cost respondents

The RFI found the cost of CMMC itself was lower than the figures cited publicly. FNN reports that the average cost of a CMMC assessment (excluding NIST SP 800-171 implementation) was about $47,000, and that the Department's summary noted prices fell during the first year of implementation. Sources also told FNN that C3PAOs shared contracts showing costs below what had been advertised.

For comparison, the Small Business Administration (SBA) estimated in July that total compliance costs could reach about $593,800 per certification for small firms requiring a third-party assessment, and about $388,600 for firms eligible for self-assessment. Those figures measure total compliance, including implementation, while the $47,000 average isolates CMMC. That gap is largely the point: much of the disagreement over CMMC cost comes from blending the cost of certification with the cost of the underlying controls themselves.

The practical takeaway for contractors is that the enclave, controls, documentation, and scoping are where most of the spend sits, so they are also where cost-reduction efforts are likely to pay off first.

What CMMC reform options is the task force considering?

The task force summary sorts its options into three groups, according to FNN:

• Short-term changes the DoD CIO can make without rulemaking
• Costlier or longer-term changes that may require rulemaking
• Reasonable suggestions outside the CIO's authority

It pairs them with a 90-day, six-month, and one-year sequence. All of them are framed as recommendations that apply only if approved.

Restarting Phase 2 for a narrower population

The most consequential near-term option is restarting Phase 2, which adds third-party Level 2 assessments to contracts, for a smaller set of contractors within 90 days. The reporting doesn't say how that population would be defined. Longer-term changes would move through rulemaking in parallel. Until a restart is announced, contracting officers can still designate only Level 1 or Level 2 self-assessments.

A longer POA&M window

Today, a contractor can earn Conditional CMMC Status with a POA&M only for eligible requirements, and must close it out within 180 days under 32 CFR § 170.21. The summary recommends extending that to 270 days. That change would require rulemaking, though the summary notes it could be added to an amendment already in process.

A transition to NIST SP 800-171 Rev 3

FNN reports that the transition to NIST SP 800-171 Rev 3 has been on hold since Davies became CIO in December. The task force recommends finalizing that move and then beginning a second revision to reflect a new direction from the task force, which the documents don't describe. An industry source told FNN that the Rev 2 baseline is more than a decade old, and that a long delay could leave contractors working against two baselines. For what changes between versions, see NIST 800-171 Rev 2 vs Rev 3. Any switch would require new rulemaking.

Clearer, standardized CUI marking

DoD called clearer CUI marking the recommendation with the greatest potential to shrink the population that must comply with NIST SP 800-171. Within six months, the summary proposes training, marking tools, security classification guides, and limits on how much CUI flows to subcontractors, for example through virtual desktop or hardcopy approaches.

The Department also said a planned Federal Acquisition Regulation (FAR) rule could create a standard form for specifying the CUI shared under a contract, which it said could "drastically reduce the burden" on industry, especially small businesses. That connects to the proposed FAR CUI rule published in June.

More consistency, reciprocity, and shared tooling

Several options target the inconsistency respondents described: clearer guidance for assessors and consultants, credit for ISO 27001 where it overlaps, STIG-like approved configurations, and machine-readable evidence using NIST's Open Security Controls Assessment Language (OSCAL). Grants, subsidies, and tax credits made the list too, but DoD said it can't adopt those on its own.

Outside voices added their own ideas. Crusius suggested a loan or grant program for C3PAOs and smaller assessment teams of two people instead of three. Katie Arrington, who previously performed the duties of the DoD CIO and now works at IonQ, suggested clearer CUI definitions, AI tools to help contracting officers identify CUI, a cost study for NIST SP 800-171 compliance, and an SBA loan program with debt forgiveness for small firms in good cyber standing.

Why Phase 1 self-assessments as permanent reform is unlikely

The results on self-assessments were mixed. According to the summary, 58% of respondents said self-assessments improved their cybersecurity, and 43% called them a check-the-box exercise, though fewer than 20% of respondents answered that question.

A federal official told FNN that self-assessments can't prove to the government that information is actually being protected. Together, these points suggest a self-assessment-only end state is not a foregone conclusion.

When will DoD decide the future of CMMC?

There is no announced date. The task force report has not been made public, and DoD has not commented on its timing. Sources told FNN they expect the Department to either set a Level 2 deadline around 2029 or keep delaying, and Arrington predicted the timeline would be extended by about two more years.

Several of the proposed changes, including the 270-day POA&M window and the Rev 3 transition, require rulemaking, which typically takes months at minimum. By comparison, FNN noted that roughly 1,400 public comments on the rulemaking behind 32 CFR Part 170 took about eight months to review. For the full rollout history, see the CMMC 2.0 timeline.

What to watch next:

• Release of the task force report or a decision memo from Davies and Duffey
• Any Phase 2 restart announcement, and how the narrower population is defined
• Movement on the NIST SP 800-171 Rev 3 rulemaking
• A final FAR CUI rule or a new standard CUI form
• Cyber AB town hall updates on assessor capacity, given reports that some C3PAOs are cutting staff

What this means for defense contractors right now

Nothing in the task force summary removes the obligation to implement NIST SP 800-171. Most of the options aim to make that obligation clearer, narrower, or cheaper to prove, which means the work contractors do now is likely to count under almost any outcome.

The steps below line up with the problems the RFI surfaced so they can serve as a valuable roadmap for contractors whichever way reform lands:

1. Determine your CUI environment. Confirm with primes and contracting officers what information is actually CUI, and question markings that look overbroad. Then consider whether a cloud-only enclave using virtual desktops can keep that CUI in a smaller scope, or whether you’ll need some physical devices in scope.
2. Keep your SSP current. It was the top documentation burden in the RFI, and it is the first thing any future assessor, prime, or government reviewer will read. This CMMC SSP guide covers what it needs to show.
3. Refresh your gap analysis. Run or update a CMMC gap analysis against Rev 2, and note where Rev 3 would change the work.
4. Plan POA&Ms around today's rules. Keep remediation on a 180-day footing until a rule changes it.
5. Build evidence once. If ISO 27001 credit or machine-readable evidence arrives, organized, reusable evidence will transfer more easily. A continuous compliance tool can keep it current between reviews.
6. Ask your primes. Many haven't communicated a change in expectations around certification, so confirm what each customer will require and when. See how primes are driving CMMC enforcement.

Not sure where your CMMC program stands while reform plays out? Check your CMMC readiness in a few minutes with our free gap assessment tool, or talk to a CMMC expert.