CMMC crunch: Pentagon hits pause as assessor shortage derails defense contractor compliance

The looming November 10, 2026, CMMC Phase 2 deadline casts a long shadow over approximately 118,000 defense contractors required to obtain Level 2 certification, yet only about 1,100 have succeeded so far. This gap is exacerbated by a severe shortage of authorized assessors—just 103 C3PAOs are available to serve tens of thousands of organizations, with firms like Kieri Solutions able to conduct only around 250 assessments annually. As Logan Therrien starkly warns, 'I’m afraid not everybody who wants to get certified can get certified in October this year,' underscoring the bottleneck that threatens to derail compliance efforts.

Readiness remains a critical and widespread challenge, with research revealing that a mere 1% of contractors feel fully prepared for the mandatory third-party assessments. This lack of preparation, particularly in accurately defining and validating the scope of assessments, is causing up to 50% of certification attempts to stall or fail, as Vince Scott explains. The certification process itself can span a year or more depending on organizational complexity, meaning that contractors who have yet to start are already at risk of losing contract eligibility, a risk emphasized by CyberSheath CEO Emil Sayegh who warns that delays could jeopardize supply chain security.

In response to these daunting challenges, CyberSheath has stepped up by reopening its free Defense Contractor Cybersecurity Compliance Training program, featuring a structured, belt-based curriculum designed to equip contractors with practical guidance for efficient compliance. Additionally, the upcoming CMMC CON 2026 virtual conference scheduled for September 23–24 aims to foster knowledge sharing and accelerate readiness. Industry experts like Joe Devine advocate for early engagement with C3PAOs in advisory and pre-assessment roles to mitigate surprises and improve outcomes, while also stressing the importance of selecting assessors with relevant industry experience and budget alignment given the high costs and complexity involved.

By mid-2026, the operational hurdles in achieving CMMC Level 2 certification remain formidable, with only 1% of roughly 80,000 defense contractors feeling fully prepared to meet the demanding 110 security controls. The bar is set exceptionally high, as demonstrated by Dynamic Quest’s rare perfect score of 110 with zero findings on the first attempt, underscoring the rigorous evidence and procedural discipline required—challenges that cause many organizations to stumble during initial assessments.

Navigating the multifaceted CMMC assessment lifecycle—from gap and readiness assessments to formal C3PAO evaluations and ongoing compliance maintenance—adds layers of complexity and cost that contractors must carefully manage. Superficial gap assessments risk underestimating vulnerabilities, while readiness assessments serve as critical dry runs to mitigate failure risks. Moreover, the limited capacity of certified assessors, such as Kieri Solutions’ 250 annual assessments versus the Defense Department’s expectation of 118,000 certifications, creates significant bottlenecks, with up to half of assessments delayed or failed due to poor scope validation and preparation.

Scoping challenges—particularly identifying where Controlled Unclassified Information (CUI) resides—compound compliance difficulties, with about 20% of contractors still unable to define their CUI environment, a foundational step for all subsequent controls. This uncertainty, coupled with reliance on compliance checklists rather than threat-driven security programs, leaves many organizations vulnerable between assessments. Additionally, cost concerns loom large, with 51% of contractors citing readiness and assessment expenses as prohibitive, while assessor inconsistency further exacerbates operational strain.

Managed Service Providers (MSPs) have evolved from peripheral support roles to integral players within the CMMC audit boundary, especially when managing client firewalls, backups, or admin access tied to CUI. Yet, misconceptions persist, as contractors often mistakenly believe MSPs alone ensure compliance, whereas responsibility ultimately rests with the contractor. MSPs like Dynamic Quest and Eclipse Networks now offer innovative shared compliance models and readiness services that reduce complexity and cost, but their limited resources also spotlight supplier and third-party risk as the largest unresolved vulnerability in the defense industrial base.

Dynamic Quest exemplifies how managed IT environments offering pre-certified compliance can dramatically accelerate CMMC readiness by allowing defense contractors to 'inherit or share' a substantial portion of the 110 required security controls. CEO John Guillaume emphasizes that their credibility stems from having 'walked the entire 110-control path ourselves,' demonstrating that proactive, comprehensive certification efforts by managed service providers create a robust foundation that contractors can build upon, effectively 'building a house on a pre-certified foundation.'

Fortreum’s AI-powered CMMC Assessment Readiness Review represents a breakthrough in accelerating certification timelines, slashing the typical 12-month process down to as little as one to three months. Leveraging Kovr.AI’s Agent Artemis technology within a FedRAMP-authorized environment, this solution combines AI-native compliance tools with in-house C3PAO expertise and a strict Zero Data Retention policy to unify evidence, documentation, and security toolchains. This integrated approach not only streamlines readiness verification in the critical 30–60 days before official assessments but also helps contractors avoid costly rework and False Claims Act penalties ranging from $13,946 to $27,894 per violation.

Dynamic Quest’s achievement of a perfect CMMC Level 2 score on the first attempt—an exceptionally rare feat with zero findings across all 110 controls—sets a new benchmark for cybersecurity maturity and procedural discipline. This accomplishment underscores the feasibility of full compliance and serves as a powerful proof point that managed service providers can lead the way in helping defense contractors navigate the complex certification landscape with confidence and efficiency.

By mid-2026, the Senate NDAA recognized the financial hurdles small businesses and nontraditional contractors face in meeting CMMC Level Two requirements, proposing a grant program offering up to $100,000 per recipient with a $50 million cap to ease this burden and encourage broader participation in DoD contracts. This legislative support complements broader federal efforts to enhance cybersecurity, including imposing insider threat reporting on major AI contractors and setting firm deadlines for post-quantum cryptography adoption by 2030-2031, signaling a comprehensive approach to modernizing defense cybersecurity standards.

Simultaneously, the Pentagon and federal agencies have intensified cybersecurity and foreign ownership compliance across the defense supply chain, with proposed FAR and DFARS rules extending NIST SP 800-171 Rev. 3 safeguarding requirements to all federal contractors handling Controlled Unclassified Information (CUI), not just Department of War contractors. These reforms also mandate disclosure and mitigation of foreign ownership, control, or influence (FOCI) for contracts exceeding $5 million, while expanding flowdown obligations to subcontractors and cloud providers, thereby broadening the compliance net and reinforcing supply chain security.

However, the ambitious CMMC Phase II rollout faced a critical scalability crisis, prompting the Pentagon in July 2026 to pause implementation and establish a 60-day task force aimed at redesigning the certification framework. With over 100,000 contractors requiring third-party assessments but only a fraction of assessment capacity available, Under Secretary Michael Duffey emphasized the need to reduce 'paralyzing costs' and preserve innovation by shifting towards automated continuous monitoring instead of static audits. Despite this pause, mandatory compliance with NIST 800-171 and DFARS clauses remains fully enforceable, underscoring the government's unwavering commitment to protecting CUI even amid programmatic recalibration.

This suspension has ripple effects across the defense contracting ecosystem, forcing procurement officers to rewrite RFPs and limiting new contracts to Level 1 and Level 2 self-assessments during the review period, thereby disrupting third-party assessment organizations and cybersecurity service providers aligned with the original CMMC timeline. Moreover, the Pentagon’s pivot resonates globally, influencing regulators like Kenya’s KE-CIRT and the UK’s NCSC to reconsider heavy audit mandates in favor of continuous compliance models powered by AI and automated threat intelligence sharing, marking a potential paradigm shift in how cybersecurity readiness is enforced worldwide.

The ongoing CMMC compliance challenge starkly echoes the Y2K remediation effort, yet the defense industrial base has yet to replicate the coordinated industry collaboration that proved pivotal in the late 1990s. Unlike the financial services sector, which by 1998 had unified around a common operational understanding of Y2K requirements, defense contractors today largely navigate CMMC compliance individually, leading to duplicated discovery efforts and inconsistent assessment outcomes across thousands of organizations. This fragmented approach exacerbates inefficiencies and delays certification throughput, underscoring the urgent need for a collective industry response to streamline processes and share best practices.

A critical lesson from the Y2K experience lies in the value of regulatory flexibility on peripheral requirements to concentrate resources on core remediation without compromising fundamental standards. During Y2K, agencies like the SEC and Federal Reserve adjusted reporting and examination expectations, enabling firms to prioritize essential fixes. In contrast, while the Pentagon has made some timeline adjustments for CMMC, the broader defense contracting environment lacks comparable regulatory leniency, leaving contractors stretched thin and risking compliance failures amid insufficient certification capacity projected to reach only about 145 authorized organizations by the end of 2028—far short of demand within the enforcement timeline.

Clear, standardized communication about compliance requirements and evidence expectations was a hallmark of the Y2K remediation success, facilitating consistent assessments and smoother certification processes. The financial services industry’s convergence on a unified operational understanding by 1998 contrasts sharply with the current CMMC landscape, where contractors passing one pre-assessment may face divergent criteria in subsequent formal evaluations. This inconsistency not only hampers certification throughput but also fuels frustration and uncertainty, highlighting the necessity for the Department of Defense and industry stakeholders to establish transparent, harmonized guidance to reduce variability and build trust in the compliance process.

By mid-2026, the Pentagon’s decision to pause and redesign the CMMC program underscores a critical pivot from static, costly third-party audits toward a more scalable, automated continuous monitoring framework. This shift responds directly to the unsustainable compliance costs burdening over 100,000 defense contractors—particularly small businesses spending up to 15% of their annual budgets on CMMC preparation—and addresses the limited assessment capacity that Chief Information Officer Davies highlighted. The 60-day CMMC Reform Task Force is tasked with crafting a framework that leverages AI and automation to streamline certification, ensuring long-term sustainability without compromising security.

The Pentagon’s redesign efforts are not occurring in isolation but are influencing a broader global trend toward continuous, AI-powered cybersecurity compliance. As international regulators grapple with balancing stringent security mandates and operational feasibility, the CMMC overhaul is poised to set a new de facto international standard for supply chain security. This emerging model emphasizes sustainable compliance that preserves industrial innovation and the commercial ecosystems vital to technological leadership, marking a departure from binary certification models toward dynamic, intelligence-driven frameworks.

Despite the freeze on CMMC Phase II, existing cybersecurity obligations—such as adherence to NIST SP 800-171 Revision 2 and DFARS clauses—remain firmly in place, reinforcing the imperative for continuous protection of Controlled Unclassified Information. This continuity highlights the Pentagon’s commitment to robust cybersecurity even as it reimagines compliance mechanisms, signaling that while certification processes evolve, the foundational security requirements for defense contractors will not waver during the transition.