CMMC Phase 2 pause codified; Pentagon CIO says compliance is not security

The CMMC Phase 2 pause is now in the contracts. A September 3 class deviation signed by John Tenaglia, principal director of Defense Pricing, Contracting, and Acquisition Policy, requires contracting officers to remove CMMC third-party assessment requirements from active solicitations and existing contracts "while preserving baseline cybersecurity obligations," per MeriTalk. At the Billington CyberSecurity Summit on September 9, Department of War CIO Kirsten Davies said the reform request for information drew more than 1,100 responses and over 10,000 pages, DefenseScoop reported. Her verdict: "Compliance doesn't equal security."

Davies called compliance "a point-in-time check" and said CMMC was hitting small and medium-sized businesses "inappropriately hard," per DefenseScoop. When it announced the pause in July, the department pointed to Small Business Administration figures of $593,800 per certification for a small business that needs a third-party assessment, per MeriTalk. During the pause, the department is expected to enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments, per DefenseScoop.

Removing the assessment requirement removes the outside check Phase 2 was to add, not the liability. As our Honeywell dispatch reported, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to satisfy required NIST SP 800-171 controls, per Bass, Berry & Sims, which notes no cyberattack or data breach was identified. The conduct ran from April 2020 through December 2023, and Honeywell said the settlement includes no admission of wrongdoing, per Manufacturing Dive. A self-assessment scores against the same controls, so the affirmation carries that weight. It is only as good as its evidence.

• Reconcile the SPRS score against the system as it runs.
• Keep the 800-171 boundary map current as assets change.
• Log each known deficiency with an owner and the dates found and fixed.
• Ask primes what they now require of subcontractors, in writing.

For defense industrial base security teams, APEX — Platform Foundation is designed to keep security work governed and auditable across the EternaEdge pillars: signals resolved to one entity, cases opened at set thresholds, and an audit trail of what automation did and who approved it. It is not an 800-171 assessment tool. Compliance leads still own the SPRS score and the affirmation behind it.

This extends our July read that the pause is not a pass: DFARS 252.204-7012 and SPRS affirmations still apply, per Covington's Inside Government Contracts. Davies has named the principle, per DefenseScoop: security that is continuous, at the pace of the threat. The defensible position is evidence that is current the day someone asks for it.