DoD paused CMMC Phase 2 in July 2026 and pointed to cost. Federal News Network has now reported what DoD's own request for information (RFI) shows, from DoD's internal summary of the responses. The data points somewhere specific: the cost is in the NIST SP 800-171 controls your contract already requires, not in the certification.
What the RFI data shows
Federal News Network reported, in a two-part investigation published Oct 26 and Oct 27, 2026:
- DoD reviewed 997 responses, 509 (51%) of them from the defense industrial base.- The average CMMC assessment cost cited by respondents was $47,000. DoD's summary called the perception of high assessment cost "in contrast" to that figure and said prices have come down over the first year.- In July, SBA Administrator Kelly Loeffler said complying with CMMC could cost as much as $600,000.- The top cost driver respondents named was implementing and maintaining NIST SP 800-171: Microsoft 365 GCC High licensing and recurring costs, enclaves with dedicated hardware, and external service providers.- On overhead, system security plans (SSPs) ranked highest, followed by FIPS-validated encryption.- As of September, 2,433 companies had received Level 2 third-party certifications.## Where things stand The CMMC Phase 2 suspension remains in place. During the pause, contracts can require only CMMC Level 1 (Self) or Level 2 (Self) assessments. DoD's task force recommendations have not been released or adopted. Federal News Network reported the task force listed restarting Phase 2 for a narrower population within 90 days as one option. ## What the pause did not change
- DFARS 252.204-7012 still requires NIST SP 800-171 on systems that handle CUI. CUI comes through the contract.- Your SPRS score is still a statement to the government, and it still has to be accurate.- The controls cost what they cost whether an assessor checks them this year or later.## What to do now
- Score all 110 NIST SP 800-171 controls honestly.- Write every gap into your SSP and POA&M.- Plan the expensive items first: where CUI lives (GCC High or an enclave), FIPS-validated encryption, and the documentation that proves it.## Start here Our free SPRS score worksheet walks you through the 110 controls so you can see where you stand: https://cyberneza.com/sprs-score-worksheet Sources: Federal News Network, Oct 26, 2026, Federal News Network, Oct 27, 2026, DoD CIO CMMC resources Cyberneza is a veteran-owned, 100% US-based cybersecurity firm in Orlando, Florida.
Top comments (0)