CMMC Is Being Rewritten This Week: The Reform Report, the Rev 3 Fast-Track, and What Contractors Should Do Now

By Josh Hammer

The most important CMMC development this week is not a new assessment checklist. It is the possibility that the underlying program is about to be rewritten.

The CMMC Reform Task Force’s 60-day review is expected to reach its deadline around Sunday, September 13, following the Department of Defense’s July 13 suspension of CMMC Phase II. The review was launched after senior officials warned that the program’s cost and complexity could exclude small and nontraditional businesses from the Defense Industrial Base. Under Secretary of War for Acquisition and Sustainment Michael Duffey described the costs as “paralyzing,” while Small Business Administration Administrator Kelly Loeffler called CMMC an “untenable barrier.”

At the same time, the Pentagon is preparing an accelerated transition from NIST SP 800-171 Revision 2 to Revision 3. The proposed move would occur through an interim final rule under RIN 0790-AM01, amending 32 CFR Part 170 and establishing a transition period without the traditional notice-and-comment sequence normally associated with major regulatory changes. The Department estimates that approximately 20% fewer companies would be affected by the revised program.

There is a second complication. The FAR Council has proposed a governmentwide Controlled Unclassified Information rule that would require NIST SP 800-171 Rev. 3 for contractors handling CUI under a new FAR 52.240-7 clause. That means civilian agencies could begin demanding Rev. 3 even while DoD’s current CMMC Level 2 assessment baseline remains Rev. 2.

So, what should contractors do now?

My position is straightforward: do not pause your cybersecurity program, and do not blindly rebuild it around Rev. 3 identifiers. Audit first. Build a plan. Then select the tools that support that plan.

Tier 1: What the CMMC pause actually means

The pause changes assessment timing, not the underlying obligation

The July 13 suspension memo is clear. During the review, DoD program managers and requiring activities may include only:

• CMMC Level 1 self-assessments;
• CMMC Level 2 self-assessments; and
• Select government-led assessments where authorized.

They may not add new CMMC Level 2 C3PAO requirements or Level 3 DIBCAC requirements during the suspension. Existing solicitations and contracts containing those requirements must be reviewed and, where necessary, amended.

That is a meaningful change. It affects who assesses you and when a third-party certification may be required.

It does not eliminate the obligation to protect Federal Contract Information or Controlled Unclassified Information. DFARS 252.204-7012 remains in effect. Contractors still need to implement the applicable security requirements, maintain supportable records, submit required SPRS scores, and make accurate affirmations.

As Eric Crusius explained in Federal News Network’s analysis, CMMC is a certification and verification structure built on top of cybersecurity controls that contractors were already required to implement. The pause removes or delays one layer of verification. It does not make the controls optional.

The National Law Review’s “Pause, Not a Pass” analysis makes the same distinction: the suspension affects the implementation phase, not the fundamental obligations under the contract.

Why the Reform Task Force matters

The task force is examining whether CMMC can preserve national security outcomes without imposing disproportionate burdens on small businesses and nontraditional suppliers.

That debate is legitimate. A contractor may face significant costs for system segmentation, identity management, endpoint protection, encryption, monitoring, policy development, evidence preparation, and assessment support. The cost of a third-party assessment is only one part of the total compliance lifecycle.

But the debate also creates a dangerous misunderstanding. Some contractors may read “Phase II suspended” as “cybersecurity investments suspended.” That is the wrong conclusion.

A pause can create a temporary opportunity to improve your environment without the immediate pressure of a C3PAO assessment date. It should be used to:

1. Confirm what information your organization actually handles.
2. Define the systems, facilities, people, and suppliers within scope.
3. Audit current implementation against the requirements that apply today.
4. Document gaps and risk decisions.
5. Build a remediation plan that can survive a future CMMC or agency assessment.

The CSIS analysis of the CMMC pause makes an important point: reducing the burden of compliance cannot mean accepting weak protection for sensitive defense information. Small firms may need a simpler path, but they still need a defensible security program.

The civilian-agency complication

The DoD transition is not happening in isolation.

The FAR Council’s FAR Case 2026-001 proposal, published at 91 FR 37550, proposes a governmentwide CUI structure and a new FAR 52.240-7 clause. The proposal incorporates NIST SP 800-171 Rev. 3 for nonfederal systems handling CUI and references the organization-defined parameters prepared by DoD.

If finalized, the result could be a period of regulatory divergence:

• DoD CMMC Level 2 may continue assessing against Rev. 2 until its rulemaking is effective.
• Civilian agencies may require Rev. 3 through the FAR.
• Prime contractors may flow down different requirements depending on the contract, agency, and data environment.
• Contractors serving multiple agencies may need to maintain traceability across both revisions.

That is why a single-framework compliance mindset is becoming less practical.

Tier 2: NIST SP 800-171 Rev. 3 and the CMMC transition

Rev. 2 and Rev. 3 are structurally different

NIST SP 800-171 Rev. 2 contains 110 security requirements organized into 14 families. It distinguishes between basic and derived security requirements.

Rev. 3 contains 97 active requirements organized into 17 families. The distinction between basic and derived requirements has been eliminated.

The reduction from 110 to 97 does not mean the work is necessarily easier. Rev. 3 consolidates several requirements into more detailed, multi-part requirements. It also increases specificity in ways that may affect policies, technical configurations, evidence, and assessment interviews.

The three new families are:

• Planning (PL);
• System and Services Acquisition (SA);
• Supply Chain Risk Management (SR).

The former Security Assessment family is renamed Assessment, Authorization and Monitoring in NIST’s broader control structure and is represented in Rev. 3 as Security Assessment and Monitoring.

Rev. 3 is also more closely aligned with NIST SP 800-53 Rev. 5. That alignment matters for organizations pursuing NIST 800-53 compliance automation, FedRAMP, or Risk Management Framework authorization. A properly designed control architecture can connect CMMC requirements to broader NIST controls rather than treating every framework as a separate project.

You can review the authoritative publication on the NIST SP 800-171 Rev. 3 page, including its change analysis spreadsheet and supplemental materials.

The ODP issue is larger than most summaries suggest

Organization-defined parameters, or ODPs, are one of the most consequential changes in Rev. 3.

Forty-nine Rev. 3 requirements contain one or more ODPs. The assessment guide includes 88 ODP determination statements and 510 total determination statements, compared with 320 assessment objectives in the current Level 2 baseline.

An ODP may define a frequency, threshold, scope, role, condition, or technical expectation. Examples include:

• How quickly terminated accounts must be disabled;
• How often vulnerabilities must be scanned;
• How frequently access privileges must be reviewed;
• What events must be logged;
• How soon high-risk vulnerabilities must be remediated;
• Which personnel may hold privileged accounts;
• What external systems must satisfy before they can access CUI.

The NIST Rev. 3 FAQ explains the key rule: once ODP values are defined, they become part of the security requirement and can be assessed.

If a federal agency does not set a value, the nonfederal organization must assign one. That decision is not merely an internal note. It becomes part of the organization’s assessable control environment.

DoD signaled that it was preparing for this model when it published its April 2025 memorandum establishing ODP values for NIST SP 800-171 Rev. 3. The memo states that the values were developed in preparation for implementing Rev. 3 as a minimum contractor requirement.

For contractors, the lesson is practical: an ODP register is not optional transition paperwork. It should identify every ODP, its authoritative value, the policy or system configuration that implements it, the owner responsible for maintaining it, and the evidence proving that the requirement is being met over time.

The transition workbook shows why renumbering is dangerous

NIST’s transition analysis identifies 46 significant changes, 19 new requirements, and 33 withdrawn mappings. Many of the withdrawn mappings were consolidated into multi-part requirements rather than eliminated in substance.

That creates a traceability problem.

A contractor that immediately renumbers its entire System Security Plan from Rev. 2 identifiers to Rev. 3 identifiers may lose the ability to demonstrate what was in place under the current CMMC baseline. The problem is especially serious if the contractor has an active contract, current SPRS score, prior self-assessment, or an upcoming government review based on Rev. 2.

The safer approach is to maintain two connected layers:

1. Rev. 2 as the primary evidence index for current CMMC obligations.
2. A Rev. 3 crosswalk and ODP register maintained in parallel.

Do not replace the current evidence structure until the governing contract and regulation require Rev. 3. Instead, map each current Rev. 2 requirement to its Rev. 3 successor, identify whether the requirement was retained, consolidated, withdrawn, or materially changed, and flag new evidence that will be required.

What applies today?

As of September 7, 2026, CMMC Level 2 still assesses against Rev. 2 because 32 CFR 170.14 incorporates that version by reference.

The suspension changed the assessment pathway. It did not change the current Level 2 baseline.

Therefore:

• Keep your Rev. 2 SSP current.
• Maintain your Rev. 2 evidence index.
• Continue updating your SPRS score as required.
• Preserve records supporting annual affirmations.
• Continue incident reporting under applicable contract clauses.
• Do not assume the review creates a waiver.
• Do not assume a future Rev. 3 transition will erase current deficiencies.

The DoD suspension memorandum specifically states that DFARS 252.204-7012 remains in effect and that no waivers will be granted during the review.

Enforcement risk has not paused

Contractors should also consider the enforcement environment.

The Department of Justice’s Civil Cyber-Fraud Initiative uses the False Claims Act to pursue contractors that misrepresent cybersecurity practices, fail to meet contractual requirements, or do not report incidents as required.

A self-certification supported by weak evidence creates more than an audit problem. It may create legal exposure.

The Supreme Court’s decision in Universal Health Services v. Escobar recognized implied certification theories under the False Claims Act when a contractor’s payment claim omits compliance with material requirements. In the CMMC context, the risk is even more direct when executives make explicit affirmations about compliance.

Whistleblower suits are also becoming more common. Employees, former employees, subcontractors, and security personnel may have direct knowledge of the difference between a written policy and actual implementation.

A defensible compliance program therefore requires more than a completed questionnaire. It requires evidence that your organization knew its scope, understood its gaps, documented its decisions, and maintained controls in operation.

What contractors should do this week

Here is the sequence I recommend.

1. Audit before buying anything

Start with an objective audit of your current environment.

Review:

• CUI and FCI data flows;
• System boundaries and connected assets;
• Cloud and external service providers;
• Facility and operational technology environments;
• Access control and privileged accounts;
• Logging and monitoring;
• Vulnerability management;
• Incident response;
• Supplier and subcontractor dependencies;
• SSP, POA&M, policies, procedures, and evidence.

Do not begin by selecting a compliance platform. A tool cannot determine your legal scope, correct an inaccurate data-flow diagram, or decide whether a facility control system belongs inside your assessment boundary.

2. Build a Rev. 2 remediation plan

Your current plan should identify each Rev. 2 requirement, implementation status, deficiency, responsible owner, due date, risk, and evidence source.

If you use a POA&M, ensure it accurately represents the state of implementation. Do not use a future Rev. 3 roadmap to obscure current Rev. 2 gaps.

3. Build the Rev. 3 crosswalk in parallel

For each Rev. 2 requirement, document the Rev. 3 relationship. Then separately track:

• New Rev. 3 requirements;
• Consolidated or withdrawn mappings;
• Significant wording changes;
• ODP values and responsible owners;
• Additional assessment determination statements;
• New evidence and testing procedures.

This approach preserves current traceability while reducing the cost of transition later.

4. Review every solicitation and contract modification

The suspension may require contracting officers to amend solicitations or remove C3PAO and DIBCAC requirements from existing contract documents. Monitor amendments closely.

At the same time, review civilian-agency opportunities for Rev. 3 language based on FAR Case 2026-001. Your compliance plan should follow the requirements in the contract, not assumptions based on headlines.

Tier 3: Where Complynt fits

Compliance tools and the compliance process are not the same thing.

The process begins with scope, audit, risk decisions, remediation, governance, and accountability. A platform supports that process after the organization understands what it is protecting and what the governing requirements demand.

That is the role of H&V Complynt.

Complynt is an enterprise-grade compliance automation platform designed to reduce the manual work involved in control mapping, evidence collection, documentation, and continuous monitoring. It can help your team:

• Map controls across CMMC, NIST SP 800-53, RMF, SOC 2, FedRAMP, and other frameworks;
• Maintain Rev. 2 and Rev. 3 crosswalks;
• Track ODP assignments and ownership;
• Collect evidence from connected systems;
• Monitor control performance continuously;
• Maintain an audit-ready evidence trail;
• Provide real-time visibility through a continuous compliance dashboard.

This “map once, satisfy many” model is especially valuable for contractors managing CMMC alongside NIST 800-53 compliance automation, RMF compliance solutions, SOC 2, or FedRAMP requirements.

The platform is hosted on infrastructure authorized at FedRAMP High and DoD IL5, which is important for organizations managing sensitive federal workloads and complex facility-related control systems.

But automation does not replace judgment. Complynt does not eliminate the need to audit your environment, define your scope, validate your evidence, or build a remediation plan. It supports the ongoing process once those decisions are made.

The right response is preparation, not panic

The CMMC Reform Task Force may recommend a simpler, cheaper, or more flexible model. The Pentagon may fast-track the Rev. 3 transition. Civilian agencies may begin requiring Rev. 3 under FAR 52.240-7. The final sequence is still developing.

Your underlying responsibility is more stable than the headlines suggest.

If your organization handles CUI, you need to understand the data, define the system boundary, implement the applicable safeguards, preserve evidence, and make accurate representations about your security posture.

The best time to prepare is not after the task force report, the interim final rule, or the next solicitation amendment. It is now.

Audit first. Build the plan second. Select automation and advisory support third.

That sequence protects your current CMMC 2.0 readiness, reduces transition risk, and gives you a defensible foundation for Rev. 3, RMF, NIST SP 800-53, FedRAMP, and the broader future of cybersecurity for federal contractors.

Start with H&V’s free compliance readiness check or request a gap assessment. You can also learn more about Complynt cyber compliance as a service.