# DoD Reviews CMMC Reform Options

In an October 28, 2026, commentary, Island Vice President of Federal Scott Montgomery proposed nine ways the Department of Defense could make Cybersecurity Maturity Model Certification (CMMC) more efficient without reducing its cybersecurity protections. Recommendations include aligning CMMC with DFARS, accepting equivalent security architectures, using continuous risk-based reassessment, and clarifying rules for cloud services and managed service providers. DoD is reviewing the program, but no reforms, solicitation, contract value, or procurement deadline were announced.

- The proposals could affect contractors’ CMMC compliance costs and eligibility to compete for defense work if DoD adopts changes; they are recommendations, not current requirements.
- Defense contractors and cloud or managed-service providers can assess how the suggested approaches relate to their existing security architectures and CMMC processes.
- Because DoD is reviewing the program, contractors should follow DoD announcements and related rulemaking for any changes that could affect compliance obligations or defense-market entry.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 28, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Sources
- [
        Nine ways the Pentagon can fix CMMC without lowering the cybersecurity bar - Federal News Network](https://federalnewsnetwork.com/commentary/2026/10/nine-ways-the-pentagon-can-fix-cmmc-without-lowering-the-cybersecurity-bar) - Federal News Network