Use the CMMC Phase II Suspension to Map the Gaps Before Rev. 3 Reaches Contracts

The recent suspension of Phase II of the Cybersecurity Maturity Model Certification (CMMC) program has led to a notable shift in the urgency surrounding cybersecurity compliance within the defense industrial base. While many might perceive this pause as a reduction in immediate pressure, the reality is quite the opposite. The rapidly evolving nature of cybersecurity threats, alongside changing government expectations, underscores the need for defense contractors to remain vigilant and proactive. Organizations must recognize that the standards implemented to protect Controlled Unclassified Information (CUI) are not static; they must evolve in tandem with emerging threats.

Central to this discussion is the National Institute of Standards and Technology’s (NIST) Special Publication 800-171 Revision 3, which serves as the latest framework for securing CUI in non-federal systems and organizations. Published in May 2024, Revision 3 replaces the previous Revision 2, leading to the withdrawal of the latter from the official NIST guidelines. Accompanying this new standard is NIST SP 800-171A Rev. 3, which provides the necessary assessment procedures to evaluate compliance with these fresh requirements.

Despite the introduction of Revision 3, it is crucial for defense contractors to remain grounded in their current implementation of Revision 2. CMMC Level 2 continues to require adherence to the 110 security controls outlined in Revision 2, meaning that abandoning established protocols could result in critical vulnerabilities. Furthermore, the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 still mandates the protection of covered defense information, emphasizing that while self-assessment requirements from CMMC Phase I remain enforced, organizations cannot afford to disregard the foundational standards developed in Revision 2.

Given the suspension of Phase II, now is the opportune moment for contractors to embark on a structured analysis of their cybersecurity posture. With the anticipation of Revision 3 being integrated into contracts in the future, organizations currently preparing for CMMC certification must begin identifying and addressing any gaps. This proactive approach is essential for ensuring that they are well-equipped to transition seamlessly into the next phase of compliance when it arrives.

Understanding the Necessity of Transitioning to Revision 3

While the Department of Defense has postponed the immediate implementation of Phase II, the fiscal and contractual obligations to safeguard CUI remain very much in effect. Contractors must differentiate between the process of certification and their ongoing obligation to protect sensitive information. With the evolving nature of requirements, the lack of a clear timeline for transitioning to Revision 3 reinforces the need for a proactive strategy. Organizations must continue their current Level 2 self-assessment practices while simultaneously preparing for what lies ahead in Revision 3.

NIST is indeed preparing for the future implementation of organization-defined parameters within Revision 3. This was underscored in an April 2025 memorandum, which, while not establishing a new effective date, signals that the groundwork for future requirements is being laid. For companies handling CUI, this direction suggests a move towards greater accountability, clearer governance structures, and a robust demonstration of operational effectiveness regarding their security controls.

To ensure that their security frameworks remain robust, organizations must engage in a thorough evaluation of both their existing contracts and the newly introduced expectations outlined in Revision 3. The transition from Revision 2 to Revision 3 is not merely a numerical renumbering exercise; it introduces both conceptual and operational shifts that could significantly impact various organizational roles, extending beyond just security teams to include procurement, compliance, and engineering functions.

NIST has made clear that Revision 3 delves deeper than its predecessor, with structural changes that align it more closely with NIST SP 800-53. This includes the expansion from 14 security requirements to 17, by incorporating new families of requirements such as planning, system and services acquisition, and supply chain risk management. This comprehensive approach reflects a paradigm shift in how organizations must approach the protection of CUI; it highlights the necessity for integrated governance and oversight across multiple operational domains.

Moving Forward: What Organizations Should Do Now

Designing an effective preparatory strategy involves a dual-track approach that enables organizations to meet their current obligations while also laying the foundation for the transition to Revision 3.

1. Maintain the Current Baseline: Organizations must continue implementing and assessing compliance with the current Revision 2 requirements unless explicitly stated otherwise in their contracts.

2. Map the Transition: Establish a crosswalk that systematically aligns existing Revision 2 requirements with their Revision 3 counterparts, noting any changes in scope, specificity, and ownership.

3. Identify New Stakeholders: As the focus broadens to include supply chain and acquisition requirements, it is essential to engage stakeholders from various operational areas who may not have been involved in the original Revision 2 compliance efforts.

4. Govern ODPs: Develop a repeatable and clear process for defining and managing organization-defined parameters. Assignments, approvals, and documentation processes must be well-established to maintain compliance integrity.

5. Audit CUI Environments: Conduct an assessment to ensure clarity around systems processing, storing, or transmitting CUI. Accurately identifying and controlling CUI is paramount for effective protection within current and future compliance frameworks.

6. Modernize Evidence Collection: Invest in technologies and practices that facilitate automated, verifiable evidence collection to support future assessments. This approach will significantly enhance the organization’s ability to meet compliance requirements efficiently.

The ultimate goal for organizations is not merely to prepare for a future revision but to build a resilient and compliant cybersecurity framework today. By starting now, organizations can assure themselves against the inevitability of contract changes and can make mindful investments in technology and processes that will streamline their compliance journey.

In conclusion, while the suspension of CMMC Phase II may appear as an opportunity for a breather, it actually presents a critical window for defense contractors. With a commitment to preparing for Revision 3 now, organizations can position themselves effectively for the inevitable changes on the horizon. By prioritizing cybersecurity and compliance today, they can avoid the scramble that often accompanies regulatory shifts and build a robust framework that stands the test of time.

Source link