This post was originally published on this site.
The U.S. Small Business Administration (SBA) recently celebrated a significant decision by the U.S. Department of War (DoW) to suspend the enforcement of its Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, originally set to begin on November 10, 2026. This suspension comes as a direct response to mounting concerns from small business stakeholders regarding the potential burdens imposed by the CMMC framework.
In a statement, SBA Administrator Kelly Loeffler emphasized the vital role that small businesses play in the nation’s defense industrial base. “Let there be no doubt: the small businesses that undergird our defense industrial base are committed to protecting our nation’s digital domain—but cybersecurity cannot come at the cost of bureaucracy that shuts out the very companies our warfighters depend on,” she said. Her remarks underscored the need for effective cybersecurity measures that do not impede the critical role these businesses serve.
The CMMC program aims to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) through a tiered certification system. However, the SBA’s analysis revealed that compliance costs for small firms could escalate dramatically, with estimates suggesting up to $600,000 for third-party assessments, making participation in defense contracts increasingly unfeasible. If implemented as planned, Phase II would have required compliance from over 120,000 small defense contractors, many of whom lack the resources to absorb such expenses.
Delays in compliance could have resulted in lost revenue, reduced competition, and additional strain on essential supply chains, hindering national security efforts. With only around 100 approved assessors available to handle the growing demand, the rush to certify could have created bottlenecks in the assessment process.
The suspension of the CMMC Phase II requirements initiates a comprehensive review aimed at recalibrating the program. The DoW seeks to ensure cybersecurity standards remain stringent while streamlining compliance processes for small businesses. According to the SBA, such measures would support the Department’s Acquisition Transformation System (ATS) and help foster a more agile defense supply chain.
Small businesses have long voiced their frustration over CMMC-related compliance challenges. During a nationwide manufacturing tour, the SBA gathered feedback through various outreach efforts, including the SBA Red Tape Hotline, where small manufacturers consistently identified CMMC compliance as a significant regulatory hurdle.
The suspension signals a collaboration between the DoW, SBA, and small business advocates to create a more inclusive and manageable cybersecurity landscape. The goal is to maintain robust protection against cyber threats while allowing innovative small firms to thrive within the Defense Industrial Base.
For small business owners, particularly those in the defense sector, this development offers a potential reprieve from costly regulatory burdens. The suspension could encourage more qualified firms to participate in government contracts, fostering a more competitive environment that benefits not only small businesses but also national security.
As the situation evolves, small business owners should remain vigilant and engaged in discussions surrounding cybersecurity regulations, ensuring that their voices are heard. With the SBA advocating for reduced compliance costs and more accessible certification processes, it appears there is an opportunity for small businesses to reposition themselves within the defense supply chain.
For more details, you can read the official announcement from the SBA here.
Image via Google Gemini
