DoD Pauses New CMMC Third‑Party Assessments but Stresses Unchanged Supply‑Chain Security Requirements
What Happened — On July 13 the U.S. Department of Defense suspended the rollout of new independent third‑party assessments required by the Cybersecurity Maturity Model Certification (CMMC) for subcontractors. A 60‑day review by the CMMC Reform Task Force is under way, but the DoD reaffirmed that NIST 800‑171 controls and third‑party verification must remain in place for any organization handling Controlled Unclassified Information (CUI).
Why It Matters for Compliance & Audit Readiness
- Continuous vendor‑risk monitoring is a core SOC 2 control; the pause does not eliminate the need to collect and retain evidence of third‑party security posture.
- Maintaining NIST 800‑171 compliance provides the audit‑ready artifacts required for both CMMC and SOC 2 assessments.
- Verifying supplier controls through an automated vendor‑risk platform supplies defensible audit trails and reduces reliance on ad‑hoc questionnaires.
Who Is Affected — Defense contractors, aerospace and satellite suppliers, SaaS providers to the DoD, and any small‑business subcontractor that processes CUI.
Recommended Actions
- Map all supplier contracts to the specific NIST 800‑171 controls they must meet.
- Collect and centralize third‑party assessment reports (even if the DoD assessment is paused) as audit evidence.
- Deploy continuous vendor‑risk monitoring to flag gaps in real‑time and generate SOC 2‑ready evidence.
- Begin planning for post‑quantum cryptography to meet upcoming “Q‑Day” requirements.
Source: DataBreachToday – DoD Regulatory Pause
Technical Notes — The article discusses regulatory policy, not a technical exploit. The focus is on Controlled Unclassified Information (CUI), NIST 800‑171 control sets, and the risk of adversaries leveraging weakly protected subcontractors as entry points. No CVEs or malware are cited.