Heads They Win, Tails They Win: The CMMC Trap and the Way Out

Here is a prediction from inside the compliance trenches: the CMMC Reform Task Force closed its sixty-day review on September 11 and is now finalizing recommendations for the Department of War's Chief Information Officer, with a public report expected within weeks. When that report lands, read it knowing what its authors cannot quite say aloud — there is no good answer. Every option in front of them loses. The program they were convened to fix is not a regulation that went wrong. It is one move in a game an adversary designed.The task force was stood up on July 13, when the Department abruptly suspended Phase 2 of the Cybersecurity Maturity Model Certification program — the requirement, set to begin appearing in contracts this November, that companies handling controlled unclassified information (CUI) pass a third-party certification before winning defense work. The Department's stated reasons: prohibitive compliance costs, a severe shortage of assessment capacity, and a Small Business Administration finding that the program is structurally incompatible with rapidly expanding the defense industrial base. The task force spent the summer digesting more than 1,100 responses to its req...