DoD PAUSES CMMC Phase II for 60 Days
Every DoD CIO in the last many years has done this; some people are surprised it took her this long to do this. The pause ONLY applies to Phase 2 and later and only lasts for 60 days.
The goal is two fold although they are not talking about one issue. The FAR Council released a government wide draft regulation that requires compliance with 800-171 Rev 3 not Rev 2, so that has to be reconciled and the stated goal of trying to make CMMC less bureaucratic, which would be great.
The problem is that if you do that, defense contractors will continue to lie and say that they are compliant as we have seen from the False Claims Act prosecutions and DIBCAC audit findings.
One option would be to eliminate the third party verifications and have the DoD hire a few thousand people in order for the DIBCAC to do the third party assessments internally. Be careful what you wish for. DIBCAC audits are much more comprehensive and cover more than 800-171 compliance. The most recent PUBLICLY visible DIBCAC assessment turned a score of POSITIVE 110 to a score of NEGATIVE 171 and a False Claims Act Settlement of about 80 percent of the total value of the contract, meaning that if the contract top line revenue was a million dollars, that would translate to an 800,000 dollar fine. Needless to say that would make the contract “unprofitable”.
Kirsten did make a point of saying that contractors are still responsible for complying with the Phase 1 requirements, but that part of CMMC has no easy verification mechanism other than really ramping up DIBCAC audits, which the Pentagon does not have the staff to do.
Listen to the podcast for more details.