The pause in CMMC Phase 2 doesn’t change the underlying problem: contractors holding controlled unclassified information have been required to meet NIST SP 800-171 for years, but self-attestation without verification is an honor system with a federal contract attached. The adversary isn’t pausing, and the small suppliers who make up much of the defense industrial base still can’t afford the compliance theater that’s grown up around what should be straightforward security hygiene.
Lonny Anderson’s proposal—independent assessment paired with continuous external monitoring and shared remediation support—makes sense if DoD uses the time to actually modernize accountability instead of just deferring it. An enterprise model would let program offices prioritize suppliers by mission risk, not administrative sequence, and a department-led fund could cover baseline monitoring for critical small businesses who sit three or four tiers down but support multiple platforms. The Senate’s proposed $50 million in assessment grants is a start, but a one-time subsidy won’t sustain the kind of continuous posture visibility that matters when AI-enabled adversaries are already mapping exposed certificates and misconfigured services faster than any audit cycle can catch.
If you’re hiring or advising at the C-suite in this space, the calculus hasn’t changed: cleared leaders who understand both compliance frameworks and actual threat mitigation—and can translate between primes, subs, and program offices—are going to be in shorter supply than the roles that need them. The pause creates planning space, not a pass.