CMMC Pause Rationale Unravels as DoD's Own RFI Data Puts Average Assessment Cost at $47,000

The Pentagon's case for freezing the Cybersecurity Maturity Model Certification program is weakening under its own numbers, and defense contractors are left waiting on a review that has run well past its deadline. A Federal News Network investigation published Oct. 26 found that the responses DoD collected through its CMMC request for information point to the underlying NIST security controls, not CMMC certification, as the main source of contractor cost and burden.

The report, the first of a two-part series by executive editor Jason Miller, draws on internal DoD documents summarizing 997 RFI responses. Its central finding is blunt: "Every reason Kirsten Davies, the DoD chief information officer, gave for pausing CMMC and for conducting a “top-to-bottom” review has been called into question based on data in its own request for information." DoD declined to comment after FNN sent 15 specific questions.

How a 75-Day CMMC Review Passed 100 Days

When DoD paused CMMC in July, Davies said the review team would have 60 days to gather feedback and review the program, then 15 days to deliver recommendations to her and Under Secretary of Defense for Acquisition and Sustainment Michael Duffey. That 75-day timeline is now pushing past 100 days, and no final report has surfaced.

DoD reviewed 997 responses. Of those, 509, or 51%, came from the defense industrial base; the rest came from vendors, consultants, the CMMC "ecosystem" and others. A government source told FNN that 509 companies represent less than 1% of the sector, and that the RFI was open for only 30 days.

Is CMMC or NIST 800-171 Driving Contractor Costs?

Davies, Duffey and Small Business Administration Administrator Kelly Loeffler have all argued that CMMC costs are prohibitive for small firms. The RFI data, as described in documents FNN obtained, points elsewhere. The top cost driver respondents cited was implementing and maintaining the security controls in NIST Special Publication 800-171, the standard for protecting controlled unclassified information (CUI) that CMMC exists to verify.

An internal DoD email summarizing the responses listed the specific pain points: "licensing and recurring annual costs (e.g. Microsoft 365 GCC high); enclaves with separate and dedicated hardware and associated operability with enterprise systems." Respondents also said they need "specialized, dedicated personnel to assist with understanding requirements, implementing solutions and documenting evidence."

Inconsistent CUI marking across DoD ranked as another top cost driver, because it leaves companies unsure when NIST 800-171 protections apply. That complaint is not new. In August, FNN reported that industry groups raised the same issue in comments to the CMMC Reform Task Force. "Without addressing the underlying CUI program, the current inconsistent marking process will continue to lead to increased costs and burdens on industry and degraded security for department information," the National Defense Industrial Association wrote. SBA's Office of Advocacy called CUI uncertainty the "most frequently cited concern" for small businesses.

On burden, respondents ranked system security plans highest among requirements that create overhead, followed by FIPS-validated encryption. FNN reports that respondents said the burden of NIST 800-171 was high, specifically around certain security controls, and that they did not say the burden of CMMC itself was too high.

The $47,000 Assessment Figure vs. the $600,000 Claim

The cost argument faces its sharpest test on the price of third-party assessments. Loeffler said in July that complying with CMMC could cost as much as $600,000. The RFI found the average cost to comply with CMMC itself, as distinct from NIST 800-171, was $47,000.

About 47% of respondents named the cost of third-party assessors as a top cost driver, ranking it fifth overall. DoD's own summary pushed back on that perception: "This perception, as was noted by many commentors, is in contrast to the average assessment cost ($47,000) directly cited by a subset of respondents. Notably, prices have reduced over the first year of CMMC implementation as the natural forces of supply and demand have taken effect." FNN sources said assessment organizations gave DoD copies of contracts to show actual prices.

Did CMMC Really Face an Assessor Shortage?

Davies also cited "severe shortages in third-party assessment capacity" when announcing the pause. An industry source quoted anonymously by FNN disputed that, saying the ecosystem never used more than half of available assessment capacity at any point during Phase 1. That claim comes from the source's reading of Cyber AB and DoD data, not from a published DoD figure, and the Cyber AB declined to comment. FNN separately reported that 2,433 companies had received Level 2 third-party certifications as of September.

Anonymous Sources Describe a CIO Skeptical of the Program

The FNN report includes pointed claims about Davies' intent, all from sources who requested anonymity. At least three sources told FNN that Davies has privately said her goal is to "get rid of the program." A former government official said the final report is delayed because the RFI data "didn’t support her goals." A third source said, "The CMMC program office wasn’t notified or consulted before the suspension was announced." DoD has not responded to any of these claims, and contractors should treat them as reporting, not as a statement of department policy.

Eric Crusius, a partner at the law firm Hunton, offered an on-the-record read. He said the RFI tried to address too many issues and that there is a disconnect between complaints about CMMC and concerns about NIST 800-171. "The underlying certification controls haven’t changed and the department has not retreated from it," Crusius said.

What It Means for Contractors

The NIST 800-171 obligation has not moved. Katie Arrington, who performed the duties of the DoD CIO before Davies was confirmed, told FNN that nothing DoD is doing would change the requirement under DFARS 7012 or NIST 800-171, and the RFI data suggests that work, not the assessment, is where most compliance dollars go. Pausing third-party certification does not shrink that bill.

For companies weighing whether to keep paying for a Level 2 assessment, the $47,000 average and DoD's own note that prices fell over the program's first year are useful benchmarks when comparing quotes. Professional Services Council President Stephanie Kostro told FNN in September that the class deviation is "not the death knell of CMMC," and that money already spent on an outside assessment was well spent because cybersecurity requirements will continue.

Contractors should also push contracting officers for clear CUI identification at the solicitation stage. Both the RFI and earlier industry comments single out inconsistent marking as a cost driver, and a narrowly scoped CUI boundary is a compliance lever a small business can influence.

Finally, watch for the task force recommendations to Davies and Duffey. FNN said part two of its series was due Oct. 27. Whether DoD resumes CMMC, restructures it or extends its timeline, the RFI record now makes it harder to argue that certification itself is the program's main cost.