Beyond the Pause: What's Next for CMMC

This episode of All About the Base, a video series analyzing critical industrial base topics, examines the Department of Defense’s pause on the Cybersecurity Maturity Model Certification (CMMC) program and the challenges and opportunities associated with getting implementation back on track. Host Dr. Jerry McGinn, Director of the Center for the Industrial Base, speaks with Stephanie Sanok Kostro, President of the Professional Services Council (PSC), who provides her insights on CMMC, industry feedback on the program, and the implications of the implementation pause for federal contractors and the defense industrial base. The discussion explores the costs of compliance, the availability of third-party assessors, and the particular challenges small businesses and subcontractors face in meeting cybersecurity requirements. Kostro also discusses how the department can respond to industry concerns, clarify requirements, and improve the certification and assessment process without compromising the program’s core security objectives. As the Department of Defense evaluates the program’s future, the conversation considers what changes are needed to resume implementation, establish a credible timeline, and give contractors the clarity and confidence to move forward. Ultimately, the episode highlights the importance of collaboration between government and industry in strengthening cybersecurity protections, safeguarding sensitive defense information, and maintaining a resilient and competitive defense industrial base.

All About the Base is made possible by general funding to CSIS.