CMMC Phase 2 Paused: Why the DoD's Reasoning Doesn't Add Up, and What to Expect After the 60-Day Review

Welcome And Breaking News Setup

Hey there. Welcome to the CMMC Compliance Guide Podcast. I'm Stacy.

And I'm Brooke.

From Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800 171 compliance. We're hard guns getting companies fast tracked to compliance, but today we're here to give you all the secrets for free. So if you want to tackle it yourself, you're equipped to do so. Let's dive into today's episode and keep your business on track. Today's episode is a breaking news one. As of just a few days before we recorded this, the Department of War suspended Siemens C phase two. And Brooke is going to walk us through exactly what happened. Okay, so let's tackle the headline first. What did the DOW actually announce?

They announced a bunch of chaos, is what they announced. Phase two is the is the implementation of certifications on contracts. So any

What Phase Two Pause Actually Means

certifications that were going to be in on contracts in November on after November 10th, or I guess on November 10th or after, those requirements are paused. So we're going to keep on uh essentially phase one is extended, is is really what it is. Uh they did make clear that uh even though they're pausing uh the phase two uh implementation, phase two, the certifications um on the contracts, even though they paused that, that they they stress that you still have the obligation to protect the data, you still have the obligation to be compliant with all 110 controls, uh all the documentation, everything else. They they stress you still have to be compliant, and you still have to protect that data. So that's what happened. That's the big thing. It's a huge, huge thing. Um, there's uh all sorts of uh the skies falling uh posts and and calls and emails and everything else. Uh but after the initial uh freakout period, you know, it uh people kind of calmed down and really thought about what it took. But that's what they announced.

Aaron Powell So with all the chaos online, I'm sure there's a bunch of misconceptions out there. Um what's the biggest misread you're worried about right now?

Well, the biggest misread is contractors thinking they're uh I kept hearing people talk about this and say that they've seen it a lot. Uh I my I myself haven't seen it a lot, and I haven't heard it a lot,

Misreads And Why CMMC Continues

especially from our clients. But what what some people have said is yay, it's suspended, we don't have to worry about CMMC. And uh that's not the case. It is absolutely not the case. Just like I said, they did stress that we're still in phase one and you still do have to uh meet all your compliance uh for a CMMC level two. Uh you still have to you know submit your scores, uh you have to do all that. You you have to protect that data still. So the biggest the biggest thing is uh from CMMC is dead to um to CMMC, you know, the certifications are going away. None of that is is true, none of that is accurate. The only thing they did was pause it so that they could regroup and figure out what to do. Uh and what I might add is that if you look back, every CIO has come in, uh got their feet on the ground, uh, got an earful about this, and they've paused the program and then restarted it. And so it may look, you know, very well may look a little bit different, but uh, you know, it's it's it's just a pause right now. So there's no CMMC's not canceled, you know, the certifications are not canceled, they may look different, they may not, who knows? There may be a better, you know, a different timeline, who knows? But CMMC or the certifications are not canceled.

Did you see any of the stated reasoning behind pulling phase two?

I did, and I I have some issues with it. Not all of it is accurate and some of it is fear-mongering, but you know, that's okay. Uh, you know, there's uh accusations of fear-mongering going back and forth, you know, uh all over the place.

Cost And Capacity Claims Examined

So however you want to look at it, the small business administration, I've I've always held that the small business administration isn't truly for the actual small, small businesses, you know. Uh they're not for what you and I think of as a small business, they're for the small businesses that are not giant enterprises, you know? So uh, you know, they're they pointed to um assessments and other things that cost uh, you know, half a million dollars and up and for small businesses, quote small businesses. Um and uh, you know, that uh what from what I've seen for small businesses, that's absolutely inaccurate. But um it may be there may have been cases of that. I don't really know. But uh that is not accurate from what I've seen. Uh they've also they also said that uh the biggest thing they raised was capacity, right? Uh for the assessments. They said there's not enough capacity for the assessments. There actually is, uh, and we can go over that. I'll in fact I'll hit on it. Uh but and I don't have numbers and I don't have a uh cool little chart. Somebody made a chart showing uh showing everything, showing the math and everything, and and they did a great job. I wish I had that chart and I can I could rip it off and show it to you right now, but it was really good. So um, but they uh the one of the other things they also said was that there's a hundred assessors. There's not a hundred CCAs. There is over a thousand CCAs. And the C through PAOs, the companies that hire the assessors, yeah, there's 107 of those. But that's not that's not uh that's not where a bottleneck would be. The bottleneck would be uh the number of assessors, right? Because the number of assessors uh govern how many assessments can be completed. And I might include and might say also that we're far ahead of the DoD's own projections of where we would be at. I believe at the end of the year, if we kept on track, we'd be like five times ahead of what they thought we would be. Uh but we've got they said we have a hundred assessors, we have a thousand, over a thousand. Uh they said we have a capacity issue, there is no capacity issue. Uh the our capacity is is much more uh than the amount of um certifications that are that are being completed right now. There's it's not that's not a problem. So um and the other the other part they said with the is that there's a uh you know the the cost is high. When you really look at it, they said the cost of getting certified is high, cost of the assessments is high, but when you really look at it and really suss out what they're talking about, what the SBA is talking about, and unfortunately what Kirsten Davies uh repeated, uh what they're really talking about is the cost of compliance. Being compliant is is not inexpensive. It does cost money, but again, they've told you that for nine years. They've told you to implement this for nine years. Since the end of 2017, since before that, but since the end of 2017, they've told you to implement this and that you had to implement all these controls and what they looked like and the the amount of documentation you needed, you know, uh that may have been different, but the controls themselves and what you were supposed to put in place uh have been the same. So uh that I understand that that is uh expensive, but when they're talking about the cer the expense of the certification portion of it, that's much less than the actual compliance part. Now, could they do things to reduce that uh reduce the cost of the assessments? I'm sure they they could, and I have my ideas and and I'm sure you know thousands, millions of other people have their ideas too. Uh but there there's absolutely things that could be done to to lower the cost. And the other thing that I would add on there is that C3PAs aren't getting rich on this. Or maybe they are, maybe no ones are getting rich, but uh and I guess that is a subjective term, right? Uh yes, they are making money on it, and they're gonna make money on it. They're not gonna do this free of charge, they're not gonna live in the poor house while they're, you know, while they're doing assessments. This is this is a very skilled, very knowledgeable person that has to do these assessments, right? Um, to pull them off and do them right. Uh because I can tell you 100% if you get one that's not skilled and very knowledgeable, that it is uh it it can be a little scary. So uh but they I have seen the price, the estimated price once the first came out, and now the prices that we see that our uh clients are good and quoting quoted for their uh mock assessment and their certification assessment, they're way down. Um I wouldn't say necessarily that they're in half of what we were initially projecting, but they are significantly less than they were. So that's good. Maybe it's not where it needs to be or where you hope it would be, uh, but this is not a SOC2 type two. This is not a um this is not an ISO 9100, you know, it's none of those things. Um this is much different. And so to hold to uh the uh certification program and the NIST 800-171 and the uh NIST 800-171 Alpha uh for the uh the assessment objectives and everything else and and how you're supposed to go about uh go about assessing all this, then that is it there's a lot to it. There just is a lot to it. So uh but that said, there are some things that could save a little money. And again, I'll say that the price has come down some. To answer your question, to go back now that I went off chasing some rabbits, they said the the biggest thing was it's a capacity problem. I don't believe for one second it's a capacity problem. They also talked about the high cost and they referenced some they referenced some shady numbers, sorry, but they did. Um and so but overall, is it a high cost uh to uh get compliant and get an assessment? Yeah, it is, you know. Uh I I will freely admit that, and I've said that from the get-go, that it is a high cost, and it's uh but it is coming down. Uh not necessarily the cost of uh being compliant. Um and we've talked about enclaves, we've talked about all sorts of things. Enclaves will sometimes work, sometimes they won't. Um and sometimes what some person means by an enclave is not what some you know something else means by enclave. But uh capacity's not a problem. Uh they said it was. Uh price is a problem, although they use some wildly uh some weird numbers, but uh, you know, I admit price is, you know, the price is high, but the price has been high this whole time. Why have you not stopped it and addressed it before? You know, the thing that mattered with this is that, you know, there's a there's a deadline or there's a there's a deadline that a timeline of when they were going to start putting those on contracts. That's not necessarily a deadline that everybody had to be assessed and everybody had to have a level two certification by November 10th. Um but uh people a lot of people viewed it that way, and rightly so. I know that L3 Harris and some other people said, hey, you know, everybody has to be uh ready to go by this date, you know. And uh so that threw a bunch of people into panic. Uh so maybe that's what L3 Harris was trying to do. I really don't know. Uh but the uh what this did do, what that deadline or the November 10th date, what it did do uh for phase two was it prompted a lot of people to go ahead and realize that they need they were supposed to have been compliant all this time. It's time to actually do it. Right. And so they were actually getting compliant. We don't we haven't necessarily seen we're only two days into it, mind you. So uh but we haven't necessarily seen a slowdown and people that we don't do assessments. So there I I have no doubt that that's ground to a halt. Uh I feel sorry for the C through POs and the assessors. Uh but as far as we go, people have said, look, we we know we still need to be compliant and we need help. And so uh we haven't we haven't there hasn't been anybody that has told us so far in these two ho two whopping days. Uh or actually I guess at this point, uh y'all previous to when we're recording this, so this is on a Wednesday uh after the Monday evening that it was announced, so a day and a half. So uh up to this point, uh, you know, people are still wanting to uh go through the process and and get compliance. So doesn't appear to have slowed that down. We'll see.

So the big question is what happens next? Is there a replacement plan coming with all of this?

You would hope. I mean that's a that's a really good question. I mean, uh uh read the memo uh that they released. Uh and I know that uh I think we've shared it. Um

What Happens Next After 60 Days

I know Austin has shared it on his LinkedIn page.

Um we can also link that memo in the description as well. Um that way you guys can reference it.

You can tell who's who's uh uh knows how to market stuff and who does it here. So uh yeah. So um yeah, if you would, that'd be great. Uh but if you actually read that memo, uh that'll give you some insight into uh or it may uh give you some insight into what they're thinking. Uh and that they it seem for me, it seems like they're gonna try really hard to find a way to uh to fix the cost problem. So I don't know exactly how they're gonna do that. That's gonna be tough without completely retooling, but we'll see. So but as as far as what I think, what what is Brooke Justice's opinion of what might happen, and I'd take for that for the two cents that it's worth, right? Uh but uh what you know, I don't see them not having some sort of third-party validation, some sort of third third-party validation. I that I just don't see them scrapping that you know completely because it's been well proven and documented through all the False Claims Act uh litigation and all the um uh all the DibCAC assessments that came before and and everything that that there are not if it's just left up to for people to say, you know, Scouts Honor, you know, I I promise I did this, you know, that they're not gonna do it in large part. Now there are gonna there are those people that those companies that will do it. And I can tell you I listened quite a bit to a lot of my a lot of our clients during calls with them that were just upset because they were they were doing this the right way. And Joe Blow down the street uh said he was doing it, but they're not doing it, and they're able to offer their product cheaper, you know. And um, and so that you know, I people know that, everybody knows that, it's not a secret. Uh so I don't see them getting ri completely getting rid of the third-party validation of in some manner, right? Um and really, uh, you know, it could be another year pause, I don't know. It could be if they're gonna completely retool, um it'll be it'll be quite a while before you get something done, right? Um because you've got to you've got to figure out a way to substantially change it. Uh and if you don't substantially change it, the cost is not gonna substantially change either, right? So, you know, I just don't see that substantially changing. So um or I b actually that may substantially change. I don't see it substantially changing in a short 60-day window. Um so but what I can see is that there was no need for all this, no need whatsoever for all this. The DOD left themselves an out. A couple of outs, a couple of caveats or wiggle room, I might say. So one of them was that they, you know, they can address this at any time, but um change it, pause it, whatever. But the other thing really is that uh is that these assessments uh can be put off to option years. That's that's the program manager's choice, right? All they really had to do was direct the program managers, hey, unless you absolutely a thousand percent need that certif the level two certification this year starting on November 10th, push it off. Push it off as long as you can. That's all they had to do. They already have mechanisms to address this, to address the capacity issue that they said was an issue. That's why I don't I don't believe that that's really why they paused it. I really now we're getting into conspiracy theories, but I I really think it was paused because uh all the right people made the right noise, made the big made some big noise, right? Um but they they already had a way to address this, they already had a way to fix it, uh, and they didn't use it. And they they decided just to pause the program, uh, throw a whole bunch of people into chaos, throw their companies into chaos, the the assessors I'm talking about, you know, um it's it's unfortunate. It is very unfortunate. Uh but they have that they have that way to address it, and they chose not to do it. Maybe what comes out of the 60 days is they say, you know what, we have a mechanism to address this, and this is what we do. You know? Uh or maybe that's one of the things, one of the one of the few things they do. I don't really know. Um but I would expect there to be some sort of uh uh some sort of validation, third-party validation uh still in place uh at to go into place at some time. I don't it may change. I have no doubt something will change uh somehow. We'll see how much. Uh but the other thing uh that um that I see is that they could uh absolutely say, you know what, we already have a mechanism to address this. So those are the two things that I think and they you know, if they change the if they change the third-party validation, the C through PAO assessments up, um, you know, then that's gonna require some rewriting and everything else, and that that'll take a while. I mean, it's the government is not fast at anything.

Right.

Except throwing chaos into uh the CMMC program itself. So uh that's what I think. That's my two cents.

Aaron Powell So what should someone do if they're already mid-contract with a level two third-party requirement written in?

There shouldn't really be any that are written in right now. There may be some uh that are written in or some that are written in for uh contracts that are looking to be awarded. Uh those uh those will come out. Uh there will be amendments

Contracts, Amendments, And More Scrutiny

uh to those uh contracts. Um and uh that's that's what the program managers have been instructed to do is amend those. So uh any that have the requirement right now for uh the certification, uh that's gonna come out. It's it's a thousand percent.

Aaron Powell With phase two being paused right now, do you think that means self-assessments get a little less scrutiny?

Well, they're gonna get less scrutiny from uh C3 PAOs because that's that's been paused. Uh but uh self-assessments, uh I think they'll actually get more scrutiny uh because now that is the only way that the DOW has to validate that somebody's actually doing what they're doing, right? It's is checking up on these. Um so I would expect to see the false claims acts. Uh um they've already been uh they've already I mean there's there's a bunch of them out there. I would expect that probably to go up uh for them to increase even more. Um, you know, uh the uh the ones they pop in and check on. Uh I don't know the DIBCAC doesn't have just a ton of time, you know. They don't have, you know, they don't have a hundred thousand employees or anything, so they can't go out and do it uh do assessments on everybody, but I would expect those to probably tick up some, the DibCAC assessments, um, the involuntary ones. Um I think there will be more scrutiny. And if you get caught, you better be compliant, or at least you better be trying very hard to be compliant. Because if you say, Yeah, I've got a 110, and they come in and take a look, and they say, Yeah, not so much, you've got a negative 63, I would expect you'd be in some trouble. So uh, and that's what what we've seen from our clients and people who are signing on to do this. They say, Look, you're not, I know that we may or may not need a certification right now, uh, but I know we need to be assessed and and or we need to be compliant and we need to be ready. And um, and so we're we're working with them to get them ready. We've explained all it. I've have been on a lot of phone calls in the last day. Uh so and a lot of emails and text messages. By the way, if uh you want to, you know, if you've had my cell phone number, you want to text me a long conversation about this, just call me. I'm not a good texture. So uh but yeah, it's uh uh I think everybody really uh that I've talked to uh in the that are in the dib, you know, we're not in the dib necessarily. We're not we don't have contracts with the government. Our our clients do. So but if you're in the dib, uh, you know uh it seems like most everybody I've talked to uh is knows that they need to be compliant and they need to be ready, uh, and that they they think like I do that there's there's gonna be some sort of validation of this. And so there's no sense in putting that off, right? So I think that's where we're at.

So for anyone who's listening out there who's mid remediation and now they're thinking this is a great time to pause work, what would you have to say?

Uh just Exactly what I was just talking about be about being compliant is you know, don't don't stop. Uh use this as an opportunity to have a little breathing room, but but keep on trucking. Just keep on remediating, uh, keep chewing through those poem items and keep getting them done.

I know this is speculative, but are there any early read-ons what the reform version might look like or any tells of what we may be looking at after the 60 days?

It's all speculative right now, other than what I just gave you of my two cents of what I think might happen, uh, which isn't exact either. Uh, you know, um there's there's nothing there's they certainly didn't let anything slip that they were gonna do this, uh, which is surprising. Or maybe it's not surprising, but uh they uh they're certainly not gonna let slip what they think, you know, they're thinking, you know. Um and I take that back. There may be some uh some insiders that you can get some information from, but uh but it's all gonna be speculative and and you know there's there's no telling what it'll look like. So um might it cost a little less money? Yep, and that'd be good, you know. Uh might you have a little more time? Might poems be allowed? Might, you know, yes, all those things are possible. And what I might say also to add to that, they are there's a request for information that they posted. Uh we are formulating our response right now. Uh, and I I encourage you to uh go look at that and

Keep Remediating And Submit RFI Feedback

submit a professional, very professional um uh RFI or uh uh response to the RFI. So uh and they list in there what they want to know and questions they want answered. Um and basically it's how do we go from what what was what was hard, what was easy, what was good, what was bad, and then where do we go from here? Basically is what it is. Um so I I uh encourage everyone to go fill that out and give them some responses so they have some good responses from uh from Dib companies, small and large, from assessors, from implementers like us, to, you know, all sorts of people. So they have good responses from everyone and don't and don't just have an oversized sampling of, you know, large companies or oversized sampling of assessors or something like that. So there is no indication right now of what's gonna happen other than there's a high likelihood uh there might be less cost involved. What that looks like, I don't know.

Right. Is there any precedent for this kind of pause in the CMMC um history?

Uh yeah, there's there's absolutely uh precedent for uh uh for this is what is happening. Um I may have said this a while ago. Uh if I didn't, it was I was talking to somebody uh out there just a minute ago about it, but they uh there is precedent for this. Uh every CIO, DOW or DOD at the time, CIO that came in uh has paused the program. They they get in, they get their feet on the ground, they get an ear full about CMMC and how expensive and how terrible and oh, you know, the sky's falling, it is. Um and I don't want to dismiss anybody's uh fears or or um or concerns about it, that it is expensive. Uh and we'll just leave it right there. So it is expensive and I realize that. Um but we're a small company, a very small company. We have, you know, 12 people. So uh but we did it. So um which I actually I might just I might share. I don't think we shared that. No, we haven't. Oh my gosh, we should have let off at that. So uh we did uh pass our uh we we've been waiting uh a little bit on it, but uh we uh we got our final uh a recommendation for final certification and then we actually got our certificate today. So uh we're official. Uh nope, sorry, we can't post the uh certificate uh on social media. Stacey, please don't do that.

You won't be seeing those screenshots from here.

But we will we will post that we are now certified. You know, how much matters now, I don't know. And I'm just joking, it does matter. Um so uh we are certified now. So uh and we've gotten a uh client through uh successfully through a mock, and hopefully, who knows, uh we'll see. Uh we'll see if they move forward with uh certification or not, but uh or how soon they do that or how however that works. So right now it's on the calendar. We'll see. But as far as the president goes, you know, every every uh CIO, uh DOW, DOD, CIO that's come in, uh that's Department of War or Department of Defense beforehand. Uh CIO is the chief information officer, so the top dog in charge of uh IT there, right? And so that's Kirsten Davies right now. Uh everyone that comes in uh gets their feet on the ground, uh gets an ear full, uh, and then at some point goes, you know what, this is expensive. We got to pause this and we got to look at it, you know. Um this is this is way too much administrative burden. We've got to take a look at it. So they take a look at it, and they essentially come up with the same thing. It looks a little different. You still have to meet the controls, you still have to be uh, you still have to have all the documentation, you still have to do all that. Uh so back in 2021 it happened, and so now it's happening again. So expect a pause, expect probably something to happen. Don't know exactly what. Uh personally, I think it was kind of crappy to pull the rug out from everybody at this close of a juncture to uh the date, but you know.

It is what it is. It is what it is, right?

I don't I was trying to think of something good to say, but it is what it is. So um so we'll see. But there is precedent for this, absolutely. And and CMMC was not canceled any of the other times it was paused. Uh it was retooled and and made better. And you can argue whether it was made better or not, but uh we'll just say we'll just leave it at it was retooled. Right. Yeah. So uh it may be retooled uh a lot or a little this time, don't really know. Uh we'll just have to wait and see.

So before we head off, if someone's listening right now, what are some actual to-dos they can do this week?

Uh this week, uh it depends on where you're at in your journey, really. Uh, but uh if you've got uh open poam items, keep working on them, keep getting those done, keep chewing through it. Uh if you've got uh if you need to upload your SPR score um into PIE or the SPR system or whatever you want to call it, uh absolutely uh get your score uploaded. If you have a mock scheduled, I would now it's a business decision, but it's up to you. But like I said, I don't see any of these third-party validations going away. And these

Practical To Dos For This Week

assessments that have already been done are going to mean something uh for whatever comes of all this, right? They're not gonna just poo-poo all this and make you go through it again. So uh but uh if you've got a mock assessment scheduled, go through it. It's great to know where you stand, right? Uh it's great to go through an assessment and figure out whether mock or real, it's it's uh uh it's good to go through that assessment and and get an assessor's mindset, right? Uh all assessors a little different, understand that, but it's still value, still very huge, very valuable, hugely valuable, big, bigly, it's bigly valuable, you know. Uh so uh go through that mock assessment. Uh if you have a certification uh assessment scheduled and you think you're ready for it, I hopefully you wouldn't schedule one if you didn't think you were ready. But if you're going through a certification uh assessment, I'd say go ahead and do that because uh it's it's gonna mean something, right? So uh I would say go ahead and go through it. I could see whether there's an argument that you know it might get a little cheaper, you know. I think that'll take a long time to to to suss out. So if you've already got it scheduled, get it done. Uh whenever things turn, whenever something else comes out, uh then you're in a good spot. You've already been assessed and you're good to go. You're good for three years, right? Uh so uh I think that's uh uh I think those are good sound ideas and good sound thoughts. You you you own your own business or run a business and you may think otherwise, but that's that's my two cents. Watch for the 60-day window. There's September 14th. We'll know something. Don't know what we'll know, but we'll know something, right? So uh absolutely. Um, and also I would take the time also to go check your solicitations. Go check your POs, go check your uh contracts, whatever it may be. Look for the D clause deep defarge clauses that are in there and make sure you know. You should already know if you've got business with the DOD, DOW, uh, but uh check those uh check those solicitations or check the solicitations you're gonna bid on. You know, just check those and see what's in it. So that's what I would say.

All right, Brooke. So before we round out this episode, I want to give you the floor on any final parting thoughts or things that we may have not covered earlier about the memo.

Uh I think we I think we covered all the important stuff. Uh really the the biggest thing, uh I know I just listed you know five most important things off or whatever it was. Uh but really the biggest thing is uh don't have any jerk reaction. Keep on keeping on, keep going down the path, you know, uh keep everything, getting everything done. If you do have a if you just put a down payment, for instance, on a certification assessment uh and you haven't gotten it scheduled yet, uh then possibly push it out, you know, see what the C through PAO is willing to do. They're probably willing to do quite a bit right now. Feel sorry for those guys. Again, I'm I'm sorry, assessors. That's a it's it's a tough go for y'all. Uh but uh, you know, it's push that uh certification out, you know, because you don't know what it's gonna look like. I don't think we'll have a concrete answer on on what's gonna happen uh in 60 days. I think we'll have a a plan of what they're gonna do. And there may be some concrete things they decide, but I think there may be a plan more than anything else, but I could be wrong. Um the but really the biggest thing is don't have any jerk reaction, don't pull the plug on anything, don't just keep on doing what you're doing and wait for 60 days to hear out and see what's gonna happen.

All right. If you have any questions about what we covered, reach out to us. We're here to help fast track your compliance journey. Text, email, or call in your questions, and we'll answer them for free here on the podcast. You can find our contact info at cmc compliance guide dot com. Stay tuned for our next episode. Until then, stay compliant, stay secure, and make sure to subscribe.