The short answer
Practices cut from CMMC 1.0 have returned as voluntary guidance The unenforceable document is being read as the clearest signal of direction Risk reduction still matters, but its cost is what the pause aimed to relieve
When the "optional" document becomes the one everyone reads
Something strange is quietly happening in defense cybersecurity, and it's worth naming plainly.
In July, the Department of Defense (still its legal name, whatever the signage at war.gov says) paused CMMC's third-party assessment requirement and stood up a task force to review the program. Alongside that pause, the CIO's office published "Brilliant at the Basics": two top-ten lists of cybersecurity practices, one for IT and one for operational technology.
Here's the part that stops you. Several of these "basic" practices aren't new. Some lived in the original CMMC 1.0, got stripped out when the program was slimmed to 2.0, largely because they were judged too costly and burdensome for small businesses, and have now reappeared in a voluntary campaign with no rule, no clause, no scoring, and no certification behind them.
So follow the path. A requirement clears formal rulemaking. It's removed through formal rulemaking. Then it walks back in through a webpage.
And the second half is stranger. Because the campaign obligates no one, technically it's just guidance. Yet the entire compliance industry is now reading it line by line, precisely because it's the clearest signal of where the department's head is while the binding rules are treated as if they're up for grabs. The enforceable documents get read as provisional; the unenforceable one gets read as prophecy.
Here's the tension nobody should wave away. Phishing-resistant MFA, real asset inventory, tested backups, these reduce risk, and adversaries aren't waiting on a task force. But that security costs money, and the cost of implementing NIST 800-171 is the exact burden Phase 2 was paused to relieve. So the relief and the reappearing requirements point in opposite directions.
I'm suspicious of anyone who claims a tidy conclusion right now. In the meantime, the most-read document in defense cybersecurity is the one nobody's required to read.
If you're trying to figure out how to navigate this shifting environment, or just want to talk through what it means for your program, reach out to me or the team at The Vizius Group. Happy to help you make sense of it.
#CMMC #DFARS #DefenseIndustrialBase #GovCon #Cybersecurity
