# DoD Reviews CMMC Implementation Costs

The Department of Defense’s pause and review of the Cybersecurity Maturity Model Certification (CMMC) program are under scrutiny after its request for information received 997 responses, including 509 from the defense industrial base. Respondents identified costs and implementation challenges primarily with the underlying NIST SP 800-171 controls; the reported average CMMC assessment cost was $47,000 among the respondents cited. DoD’s review findings and final recommendations remain pending. CMMC Level 2 requirements are expected to begin appearing in DoD contracts in November 2026, but that is not a universal certification deadline for all vendors.

- Contractors should distinguish the cost of CMMC assessments from the broader costs of implementing and maintaining the underlying NIST SP 800-171 controls when planning budgets.
- Companies pursuing DoD work should account for the expected inclusion of Level 2 requirements in contracts beginning in November 2026 and assess how those clauses may affect their specific bids and contract performance.
- The RFI responses do not establish a change to the controls or a final DoD policy decision; contractors should continue tracking DoD guidance and applicable contract clauses while the review remains pending.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 26, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Key Quotes
> When it comes to the challenges of CMMC, DoD is still back to ground zero because there was nothing in the RFI that talked about moving away from those requirements.
> — Katie Arrington, former official performing the duties of DoD CIO

> The cost of program is blamed on certification instead of underlying certification controls, which are not part of the CMMC program.
> — Eric Crusius, Partner at Hunton

### Sources
- [
        DoD’s reasons for CMMC pause falling apart in face of RFI responses - Federal News Network](https://federalnewsnetwork.com/defense-news/2026/10/dods-reasons-for-cmmc-pause-falling-apart-in-face-of-rfi-responses) - Federal News Network