The suspension of CMMC Phase II will undoubtedly create mixed reactions across the Defense Industrial Base…
James W. — Decision Intelligence Executive
The suspension of CMMC Phase II will undoubtedly create mixed reactions across the Defense Industrial Base. Some organizations will see it as welcome relief, others as frustration after years of investment. I think both perspectives miss the more important question.
From a cyber threat intelligence perspective, adversaries don't suspend their operations because compliance timelines change. Nation-state actors targeting the DIB are not interested in whether an organization has achieved CMMC certification. They're interested in intellectual property, controlled unclassified information, supply chain access, and opportunities to influence critical defense programs. Those objectives remain unchanged regardless of regulatory adjustments.
This is why I've always believed CMMC should be viewed as the floor, not the objective. Compliance may satisfy a contractual requirement, but it does not automatically reduce business risk unless it is accompanied by an understanding of who is targeting your organization, why they are targeting it, and which business capabilities they are most likely to disrupt.
The organizations that will benefit most from this pause won't be the ones that stop preparing. They'll be the ones that use the additional time to mature beyond compliance. Build a complete asset inventory. Understand where your CUI actually resides. Validate your identity architecture. Prioritize vulnerabilities based on active threat intelligence rather than severity alone. Exercise incident response. Improve visibility into your supply chain. Turn security from a documentation exercise into an operational capability.
Perhaps this is an opportunity to shift the conversation entirely. Instead of asking, "How quickly can we become compliant?" maybe we should be asking, "If an advanced adversary targeted us tomorrow, would our current investments meaningfully change the outcome?"
Those are two very different questions, and only one of them measures resilience.
2 reactions · 2 comments
Comments
Lara B.: in your opinion, how do you make decision makers listen? and make them prepared on time?
James W.: Lara Borenovic You don't start by talking about threats but by talking about the business. Decision makers aren't responsible for stopping threat actors. They're responsible for protecting revenue, contracts, operations, and strategic objectives. CTI becomes valuable when you translate intelligence into those terms. Preparation follows the same principle. Don't wait until there's an incident to ha