CMMC Updates Ahead! What Contractors Should Do Next

Christopher Souza | CEO

Before the holiday season is upon us, we wanted to share some encouraging feedback from October’s Cybersecurity Maturity Model Certification (CMMC) Town Hall alongside an interesting Federal News Network story about the program’s future.

The Phase 2 rollout remains delayed, but recent reporting points to continued certification activity and proposals that will push the program forward. Businesses should use this time to address security gaps and prepare for assessment as waiting for a new deadline could leave your company facing a rushed implementation, higher costs, and difficulty qualifying for work that requires certification.

What the Latest CMMC Updates Tell Us

At October’s Cyber AB Town Hall, 2,551 final Level 2 certificates were reported, an increase of approximately 8% since September, with another 184 assessments in progress. Cyber AB CEO Matthew Travis also expressed optimism about a possible November announcement, although the announcement’s timing and content remain unconfirmed.

Federal News Network’s October 27 report describes recommendations developed through the government’s review and request for information (RFI). One proposal would restart Phase 2 for a narrower group of contractors over a 90-day period while longer-term changes proceed through rulemaking. Any restart would depend on a formal government decision, and a new start date has not been confirmed.

The recommendations also included clearer guidance for assessors, more consistent identification of controlled unclassified information (CUI), and published assessor availability data. A task force summary quoted in the article said “several are feasible in the short term” reinforcing the fact that businesses should follow these developments while continuing to meet the requirements that currently apply to their contracts.

Common Misconceptions That Can Derail CMMC Planning

• “Certification costs are universally prohibitive.” Federal News Network’s companion investigation reports an average assessment cost of approximately $47,000 among a subset of RFI respondents. That is separate from implementing and maintaining the underlying security controls, and individual costs vary. Headlines suggesting certification alone routinely costs hundreds of thousands of dollars blur that distinction.
• “There aren’t enough assessors.” The same investigation reports that Phase 1 assessment demand remained below half of available capacity, according to an industry source citing Cyber AB and DoD data. That challenges claims of a systemwide shortage, although individual availability varies.
• “The pause means we can stop preparing.” The pause in Phase 2 contractual requirements does not remove applicable obligations to safeguard controlled unclassified information. Building effective controls, maintaining documentation, and preparing assessment evidence still require sustained work.

Why Waiting Can Hurt Your Business

Postponing preparation can be devastating for a company that depends on defense contracts and if a future opportunity requires certification before your business is ready, you could lose that work while trying to resolve gaps that needed attention months earlier. A rushed project can also strain your budget and pull employees away from daily operations.

Readiness requires working security controls, accurate documentation, and employees who understand their responsibilities. Teams need time to identify where CUI is stored and shared, correct access permissions, test procedures, and collect evidence showing that safeguards work. Unresolved weaknesses also leave sensitive information exposed while the policy review continues.

Discussing the continuing security requirements, attorney Eric Crusius told Federal News Network, “The DoD CIO said these controls are in place and that certainly hasn’t changed.” That being said use the additional time to assign responsibility for outstanding work, establish a realistic budget, and review progress regularly. Prepare now so that you aren’t repairing later.

How TSI Supports CMMC and NIST Readiness

Technical Support International (TSI) has continued working with CMMC clients throughout the pause and has helped a number of clients achieve certification. As a Managed Service Provider (MSP), Managed Security Service Provider (MSSP), and CMMC Registered Provider Organization (RPO), we support the IT operations, cybersecurity controls, and documentation involved in preparing for assessment.

Our NIST SP 800-171 services help identify gaps, establish remediation priorities, and develop a System Security Plan (SSP) that explain how your organization protects CUI. Through our complimenting CMMC support services, we help define your assessment scope, implement appropriate safeguards, and organize supporting evidence. Ongoing patching, access management, monitoring, and employee training help keep those protections effective as your business and its compliance needs change.

Contact TSI Today!

Don’t wait for after the holiday season! Make sure your organization has a clear path forward and contact TSI today to schedule a CMMC readiness conversation. We’ll help you identify your most pressing gaps and outline the work needed to prepare for assessment and maintain ongoing compliance.

About Technical Support International

TSI is 37-year old cybersecurity (MSSP) and IT support (MSP) company specializing in helping DIB organizations address their NIST 800-171 and CMMC compliance obligations. As a CMMC-AB Registered Provider Organization (RPO), TSI offers a complete NIST 800-171 and CMMC support solution to help guide our clients toward a successful certification audit and provide the assurance that they’re adhering to these expansive compliance requirements.