Pentagon CIO on CMMC Reform: Compliance Doesn't Equal Security

Department of War CIO Kirsten Davies says the CMMC Reform Task Force received more than 1,100 responses to its RFI, totaling over 10,000 pages, and more than half of respondents supported pausing Phase 2. Her clearest signal about where reform is headed: "Compliance doesn't equal security." Davies described CMMC as a point-in-time check and said the department wants security that is continuous and keeps pace with the threat. The details are still to come. Until then, DoW expects to enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments, so the pause does not suspend the requirement.