Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base (DIB)

DOD Washington Headquarters Service issued a Request for Information on July 13, 2026, seeking industry feedback on strategies to reform the Cybersecurity Maturity Model Certification (CMMC) program and reduce compliance burden for the Defense Industrial Base, with responses due by 12 PM Eastern Time on August 14, 2026. This is a market research effort supporting the CMMC Reform Task Force's comprehensive review and does not constitute a solicitation or lead to contract award. The government has suspended CMMC Phase II requirements and solicits direct input from DIB companies on practical approaches to protect federal data and improve operational resilience while reducing compliance costs and administrative burdens, with particular focus on reducing barriers for small, medium, and non-traditional businesses.

Respondents should address the top five cost drivers and administrative burdens related to CMMC compliance; security controls delivering the most tangible cybersecurity uplift; controls creating the highest overhead with minimal benefit; strategies utilizing commercial cybersecurity capabilities; administrative challenges with Phase I self-assessments; and specific policy recommendations for reducing costs and improving operational resilience. The government seeks industry perspectives on leveraging existing commercial cybersecurity capabilities, self-attestation capabilities, and streamlining compliance requirements. Responses must be limited to ten pages (single-spaced, Times New Roman, 10-point font, one-inch margins) plus a one-page cover letter, submitted in MS Word or PDF format to the specified mailboxes. Submissions must not contain proprietary data and should reference company DUNS/EUI, CAGE Code, and points of contact.