Defense Cybersecurity Group – There has been a lot of discussion about what happens to CMMC after the pause and after we hear from the Reform Task Force. For defense contractors, the CMMC pause (more precisely, the CMMC Level 2 pause, a pause in Level 2 enforcement) has raised a practical question about which CMMC requirements still apply. The answer is also arriving under the broader changes of the Revolutionary FAR Overhaul. A common assumption is that if CMMC Level 2 certification requirements are delayed, reduced, or removed from solicitations, then the cybersecurity requirements have largely disappeared with them. That is not what we thought would happen, and that is NOT what we are seeing.

Read the full post at Defense Cybersecurity Group