Pentagon task force to review CMMC hits the ground running

Executive Summary

The Department of Defense has launched a task force to perform a comprehensive 60-day review of the entire CMMC (Cybersecurity Maturity Model Certification) program and has paused Phase 2 requirements that were set to take effect November 10, 2026. The review will reassess NIST framework requirements, DFARS (Defense Federal Acquisition Regulation Supplement) obligations, and the cyber threat landscape; outcomes could range from minor adjustments to a full program overhaul. DOD also issued an RFI soliciting contractor feedback on compliance burden and commercial cyber solutions, with final recommendations expected approximately 75 days from the task force's July 17 kickoff.

Market-wide, this is a critical inflection point for defense-focused segments and for firms whose offerings or compliance posture are tied to CMMC, NIST SP 800-171 (NIST Special Publication 800-171)/172, and DFARS clauses. The near-term pause reduces immediate Phase 2 enforcement risk but increases uncertainty about future requirements — contractors must both avoid premature sunk costs and actively influence the review through the RFI and other engagement channels. Firms that act now to shape outcomes, document compliance burden, and position commercial cyber solutions can convert uncertainty into competitive advantage; those that stand still risk being misaligned with whatever changes the task force recommends.

Impact Matrix

Defense

• Risk Level: Critical
• Opportunity: Influence policy via the DOD RFI; position as a responsive partner if CMMC changes create transition work or new procurement requirements. Specific opportunities TBD pending solicitation language.
• Relevant NAICS codes: 334111, 334118, 334290, 334511, 336411, 336412, 336413, 336414, 336415, 336419, 541330, 541511, 541512, 541513, 541519, 541715, 561210 (from Tags)
• Relevant contract vehicles: OASIS+, STARS III, SEWP, GSA (General Services Administration) MAS, 8(a) STARS III (from Tags)
• Timeline: 60-day task force review; final recommendations expected approximately 75 days from the July 17 kickoff. Phase 2 requirements paused that were set to take effect November 10, 2026.
• Action Required: Review and document current CMMC/NIST/DFARS compliance costs and gaps; prepare a concise RFI response describing burdens and commercial solutions; pause irreversible Phase 2 investments until review outcomes are clearer; maintain existing required controls in the interim.
• Competitive Edge: Lead with evidence-based RFI responses and offer practical transition plans (e.g., staged compliance approaches or commercial solutions that minimize disruption) to become a preferred supplier under revised requirements.

Cybersecurity

• Risk Level: High
• Opportunity: Increased demand for advisory, assessment, and commercial cyber tooling if the task force recommends modifications; ability to win work supporting transition, assessment, and remediation efforts. Specific opportunities TBD pending solicitation language.
• Relevant compliance surfaces: CMMC, CMMC 2.0, NIST SP 800-171, NIST 800-172, DFARS 252.204-7012 (from Tags)
• Timeline: 60-day review; recommendations ~75 days after July 17 kickoff; Phase 2 pause until further decision (Phase 2 previously set to take effect November 10, 2026).
• Action Required: Prepare technical, cost, and burden data for the RFI; inventory current service offerings against NIST SP 800-171/172 and DFARS; ready assessment and remediation teams for potential uptick in demand.
• Competitive Edge: Publish succinct use cases and ROI data for commercial cyber solutions in your RFI and capability statements to differentiate from competitors as the DoD (Department of Defense) evaluates practical options.

IT Services

• Risk Level: High
• Opportunity: Support for system implementations, managed services, and compliance automation if the program shifts toward different technical controls or commercial solutions. Specific opportunities TBD pending solicitation language.
• Relevant NAICS codes: see Tags list above
• Relevant contract vehicles: OASIS+, STARS III, SEWP, GSA MAS, 8(a) STARS III (from Tags)
• Timeline: 60-day review; recommendations expected ~75 days from July 17 kickoff.
• Action Required: Map current service catalog to NIST and CMMC control sets; assess which services can be scaled or repositioned; prepare RFI input on operational burden and potential automation opportunities.
• Competitive Edge: Bundle managed compliance services with measurable SLAs and demoable automation to appeal to evaluators focused on reducing contractor burden.

Defense Industrial Base

• Risk Level: Critical
• Opportunity: Potential relief from near-term Phase 2 compliance enforcement, and an opportunity to influence practical compliance requirements; contractors that demonstrate reduced burden and continued protection of controlled unclassified information (CUI (Controlled Unclassified Information)) can gain preference. Specific opportunities TBD pending solicitation language.
• Relevant NAICS codes: see Tags list above
• Timeline: 60-day review; final recommendations ~75 days from July 17 kickoff; Phase 2 pause affecting November 10, 2026 effective date.
• Action Required: Consolidate evidence of compliance costs and operational impacts for RFI submission; continue baseline protections for CUI while avoiding large irreversible expenditures tied solely to the paused Phase 2 requirements.
• Competitive Edge: Provide practical transition frameworks that minimize production disruption and demonstrate cost-to-compliance reductions.

Aerospace and Defense

• Risk Level: Critical
• Opportunity: Shape how revised CMMC/NIST/DFARS requirements will apply to complex programs; opportunity to offer tailored compliance and cybersecurity services to prime and sub-tier partners. Specific opportunities TBD pending solicitation language.
• Relevant NAICS codes: see Tags list above
• Timeline: 60-day review; recommendations expected ~75 days after July 17 kickoff; Phase 2 pause impacting November 10, 2026.
• Action Required: Coordinate with primes and subs to align compliance posture; prepare joint RFI submissions or coalition feedback where appropriate; inventory subcontractor risk and remediation plans.
• Competitive Edge: Position as a systems integrator that can deliver end-to-end compliance solutions that reduce program risk and schedule impact.

Manufacturing

• Risk Level: High
• Opportunity: If requirements are adjusted toward commercial solutions or scaled controls, manufacturers may see clearer, more cost-effective compliance paths; opportunity to adopt compliant commercial tooling offered by cyber vendors. Specific opportunities TBD pending solicitation language.
• Relevant NAICS codes: see Tags list above
• Timeline: 60-day review; recommendations ~75 days from July 17 kickoff; Phase 2 pause through review.
• Action Required: Document operational impact and compliance burden for the RFI; avoid large capital expenditures tied only to Phase 2; continue protecting CUI in current operations.
• Competitive Edge: Demonstrate production-friendly compliance approaches and supplier-chain solutions that lower overall cost and complexity.

Professional Services

• Risk Level: Medium
• Opportunity: Advisory, legal, compliance, and consulting engagements to help contractors respond to the RFI and prepare for a range of outcomes. Specific opportunities TBD pending solicitation language.
• Timeline: 60-day review; recommendations expected approximately 75 days from July 17 kickoff.
• Action Required: Publish thought leadership, prepare RFI responses on compliance burden, ready service offerings for rapid deployment if the task force recommends changes.
• Competitive Edge: Offer packaged, rapid-assessment engagements to help contractors cost and plan for multiple scenarios.

Managed Security Services

• Risk Level: High
• Opportunity: Potential increased demand for MSS offerings if the DoD endorses commercial solutions or requires managed approaches to meet revised control baselines. Specific opportunities TBD pending solicitation language.
• Relevant compliance surfaces: CMMC, NIST SP 800-171, DFARS (from Tags)
• Timeline: 60-day review; recommendations ~75 days from July 17 kickoff.
• Action Required: Align MSS offerings with NIST/CMMC control mappings; prepare case studies and RFI input showing operational and cost benefits of managed approaches.
• Competitive Edge: Create compliance-focused MSS bundles with clear mappings to NIST/CMMC controls and cost-to-compliance metrics to be cited in RFI and proposals.

Cross-Segment Implications

• Policy changes to CMMC and related NIST/DFARS requirements will cascade across Defense, Defense Industrial Base, Aerospace and Defense, Manufacturing, IT Services, Cybersecurity, Managed Security Services, and Professional Services. For example, any shift toward commercial cyber solutions benefits Cybersecurity vendors and Managed Security Services while requiring IT Services and Professional Services to support integrations and compliance assurance.
• Primes and subs in Aerospace and Defense and the Defense Industrial Base will need coordinated responses; changes to enforcement or control sets could alter supply-chain obligations, moving compliance workload between manufacturers and service providers.
• The RFI is a single point for influence: coordinated, evidence-based submissions across segments can amplify contractor voice and affect final recommendations; conversely, fragmented or late responses risk missing the opportunity to shape outcomes.
• The pause of Phase 2 reduces immediate enforcement risk but increases near-term strategic uncertainty; segments must balance delaying non-reversible investments with readiness to scale if the task force tightens requirements.