The CMMC Rule May Be Gone—But Your Cybersecurity Responsibilities Are Not
If you’ve heard that the Cybersecurity Maturity Model Certification (CMMC) mandate has been lifted, you might be tempted to breathe a sigh of relief. Many Department of Defense (DoD) contractors are asking the same question: Does this mean we no longer have to worry about CMMC? The short answer is no.
While the certification requirement has changed, the Department of Defense has not eliminated its cybersecurity expectations. In fact, Phase I requirements remain in effect, and many contractors are still expected to complete a CMMC Level 2 self-assessment and maintain compliance with NIST SP 800-171 before they can continue handling Controlled Unclassified Information (CUI).
The result is that cybersecurity compliance is still very much a business requirement, it just looks different than many organizations expected.
What Changed?
The biggest change is that not every defense contractor will immediately need to undergo an assessment by an authorized third-party assessor. Instead, many contracts will begin under Phase I, where qualifying organizations perform their own assessment and affirm that they meet the required security controls.
This change reduces some of the administrative burden, but it does not lower the security standard.
Contractors are still expected to implement the required safeguards, document their security program, and accurately report their compliance status. A self-assessment is not simply checking a box—it is an attestation that your organization has implemented the required controls.
Phase I Still Carries Significant Responsibilities
Many organizations mistakenly believe that self-assessment means there are no consequences for being unprepared. In reality, your organization is certifying that its cybersecurity program accurately reflects the requirements.
That means you should still be prepared to demonstrate:
- Implementation of the 110 security requirements in NIST SP 800-171.
- A current System Security Plan (SSP).
- A documented Plan of Action and Milestones (POA&M) for any remaining deficiencies.
- Proper protection of Controlled Unclassified Information (CUI).
- Policies and procedures supporting your cybersecurity program.
- Evidence that security controls are operating as intended.
- Annual review and maintenance of your cybersecurity documentation.
Simply completing a questionnaire without the supporting evidence creates unnecessary business and contractual risk.
NIST SP 800-171 Remains the Foundation
One misconception is that CMMC created entirely new cybersecurity requirements. It did not.
CMMC is built upon NIST SP 800-171, which continues to be the primary cybersecurity framework for contractors handling CUI. Organizations must still protect federal information using well-established security practices such as:
- Multi-factor authentication
- Access control and least privilege
- Security awareness training
- Audit logging and monitoring
- Vulnerability management
- Incident response planning
- Configuration management
- Media protection
- Encryption of sensitive information
- Continuous risk management
Whether your organization performs a self-assessment today or undergoes a formal assessment later, these technical and administrative safeguards remain essential.
Why Waiting Is a Costly Strategy
Some contractors are delaying compliance because they assume enforcement has disappeared. Unfortunately, that assumption can create serious problems later.
Organizations that postpone implementation often discover they need months—not weeks—to close security gaps, create documentation, train employees, and establish repeatable processes.
Waiting until a solicitation requires compliance frequently results in:
- Lost contract opportunities.
- Delayed proposal submissions.
- Higher consulting costs.
- Increased implementation pressure.
- Greater operational disruption.
- Higher cybersecurity risk.
Companies that begin preparing now have the advantage of spreading the work over time while strengthening their overall security posture.
Self-Assessments Should Be Taken Seriously
A quality self-assessment is more than reviewing spreadsheets or answering “yes” to compliance questions. It should include technical validation, policy review, interviews, documentation analysis, and evidence collection.
Organizations should ask themselves questions such as:
- Can we demonstrate every required security control?
- Are our documented policies actually being followed?
- Do we know where CUI resides?
- Are our employees trained on their cybersecurity responsibilities?
- Would our documentation withstand government scrutiny?
If the answer to any of these questions is uncertain, additional preparation is warranted.
Compliance Is More Than Winning Contracts
Strong cybersecurity is no longer just a government requirement—it is a business necessity.
The same controls that help satisfy NIST SP 800-171 also reduce the likelihood of ransomware, phishing attacks, insider threats, credential theft, and data breaches. Investing in compliance often improves operational resilience while increasing customer confidence.
Organizations that treat compliance as an opportunity to strengthen security typically experience long-term benefits beyond regulatory requirements.
How Total Cyber Solutions Can Help
Whether your organization is just beginning its compliance journey or preparing for a Phase I self-assessment, having experienced guidance can save significant time and reduce unnecessary risk.
Our team helps defense contractors:
- Perform CMMC Level 2 readiness assessments.
- Conduct comprehensive NIST SP 800-171 gap analyses.
- Develop System Security Plans (SSPs).
- Create and manage Plans of Action and Milestones (POA&Ms).
- Implement required technical security controls.
- Develop cybersecurity policies and procedures.
- Prepare supporting documentation and evidence.
- Improve overall cybersecurity maturity.
Our goal is simple: help your organization achieve compliance while building a stronger cybersecurity program that protects both your business and your customers.
Final Thoughts
The headlines suggesting that the CMMC mandate has been lifted have caused understandable confusion. However, the reality is much more nuanced. Phase I self-assessment requirements continue to play an important role in the Department of Defense’s cybersecurity strategy, and contractors remain responsible for implementing and maintaining the security controls required by NIST SP 800-171.
Organizations that continue investing in compliance today will be better positioned to compete for future contracts, protect sensitive information, and adapt as DoD cybersecurity requirements continue to evolve.
The certification path may have changed, but the expectation to safeguard federal information has not.