Katie Arrington recently appeared on CMMC Uncovered and had a lot to say about the state of CMMC: the pause, assessor capacity, the cost to small businesses, the value of self-assessments, and what the Defense Industrial Base (DIB) actually needs to protect.
The 38North Security team also had a lot to say, so we pulled together some of our own CMMC experts and had them react to Arrington’s video: Linda Morales, our EVP, Chief Security Officer, and CMMC Practice Lead; Andrew Hennigan, Technical Project Lead and CMMC CCP; and Spence Witten, Principal of Cybersecurity Consulting.
While Linda, Spence, and Andrew couldn’t agree on everything, they kept coming back to a few of the same questions about where CMMC works, where it creates unnecessary burden, and what contractors should actually be doing now.
You can watch the full reaction here:
Self-assessments have a real problem
Right out of the gate, we had the team react to one of Arrington’s more provocative claims: that self-assessments do not work. And our panel was more sympathetic to that position than you might expect.
The problem is not necessarily that contractors are dishonest. NIST SP 800-171 can be genuinely difficult to interpret and assess correctly, particularly for smaller organizations that do not spend their days living inside NIST publications, assessment objectives, overlays, and years of accumulated interpretation.
Linda pointed to the breadth of a CMMC assessment. An organization might read a requirement and immediately think about the obvious technology implementing it while missing another system, asset, workflow, or user population that also falls within scope.
Spence used MFA as an example. Something that sounds relatively straightforward can quickly involve administrator access, backend systems, cloud root accounts, development environments, and other less-obvious authentication paths. An experienced assessor knows where to keep digging. A small contractor performing its own assessment may not know those questions exist.
That creates an uncomfortable problem for small businesses, in particular. We are asking organizations to interpret complicated requirements correctly while attaching potentially serious consequences to getting that interpretation wrong.
And that part, at least, drew broad agreement. From there, the argument shifted to how much assessment machinery is actually necessary to get that independent scrutiny, and whether the current CMMC model is worth the cost and complexity it adds.
Learn about the Cybersecurity Maturity Model Certification (CMMC) process
Assessor capacity may not be the real bottleneck
One of the major justifications for pausing the CMMC rollout has been concern about assessment capacity, and Arrington pushed back hard. Her argument: that the phased rollout was explicitly designed to allow the CMMC ecosystem to grow as more contracts incorporated the requirements.
Linda and Andrew largely agreed that the ecosystem had been building. They have watched RPOs, CCPs, CCAs, and C3PAOs grow alongside the program, and their experience with contractors suggests that assessment capacity is only part of the challenge.
Readiness is another. Organizations often arrive at assessment preparation still working through scope, documentation, control interpretation, and the evidence required to demonstrate that their implementation actually satisfies the requirement. One failed assessment objective can matter enormously, which puts significant pressure on organizations to understand their environment in much greater detail than a simple checklist would suggest.
Spence agreed that the assessment ecosystem exists, but disagreed rather spectacularly on whether building it was a good use of resources. His argument is essentially one of opportunity cost: every assessor, consultant, security engineer, and taxpayer dollar devoted to CMMC is a resource that cannot be spent somewhere else. In his view, the Defense Industrial Base has cybersecurity problems that deserve substantially more attention, particularly around classified information, modern software development, and the systems supporting genuinely sensitive national-security workloads.
That distinction became one of the central disagreements in the conversation: the question isn’t only whether CMMC can be implemented, but whether this is where the country should be concentrating this much cybersecurity effort and taxpayer dollars.
Learn more: The Cyber-AB’s Response to the CMMC Pause Tells You Everything About Who Actually Benefits From Phase 2
The cost of CMMC goes well beyond the assessment
Cost was another major point of disagreement. Arrington rejected the idea that CMMC is simply too difficult or expensive for small businesses. Contractors already absorb the cost of doing business with the federal government, she argued, and cybersecurity should be treated the same way. She also proposed a potentially interesting policy idea: SBA-backed cybersecurity loans that could eventually be forgiven for businesses that remain in good standing.
Linda pointed out that the assessment fee itself is only one part of the cost. Organizations also spend money and staff time implementing controls, preparing documentation, collecting evidence, participating in assessments, maintaining systems, and pulling employees away from their normal jobs to support the process.
Spence’s concern, on the other hand, was less about whether a small business can pay for CMMC and more about whether the investment produces enough security value to justify the cost.
A twenty-person manufacturer may be perfectly capable of implementing stronger cybersecurity. The policy question is whether asking that company to spend its limited resources satisfying an extremely detailed compliance and assessment regime is the best use of those resources, particularly when the CUI it holds may carry relatively little actual national-security risk.
Talk to us about how the CMMC pause affects your business, potential costs, and what you should be doing now -> https://38northsecurity.com/contact/
The CUI argument gets complicated very quickly
Arrington also made a broader security argument: sometimes the risk is not one individual piece of information. It is what an adversary can learn by combining many seemingly unimportant pieces.
Her construction example makes the concern easy to understand. A contractor might know where secure rooms are located, where industrial control systems sit, or how critical infrastructure is laid out. Each piece of information might appear relatively innocuous on its own while becoming much more useful when combined with other information.
Spence strongly disagreed with extending that logic too far, saying that aggregation can be used to justify protecting almost anything. An adversary can combine public reporting, solicitations, corporate information, technical documentation, maps, and enormous amounts of open-source intelligence. If the possibility of aggregation makes every piece of information deserving of CMMC-level protection, the boundary becomes functionally limitless.
Security programs have always required prioritization. Some information receives stronger protection because the consequences of disclosure are higher. Other information carries accepted risk because protecting everything with equal intensity is impossible.
Linda added another practical complication: CUI itself is not always marked or categorized consistently. Over-designation can pull additional systems, assets, and organizations into scope and increase the cost of compliance without necessarily producing an equivalent security benefit.
So where should CMMC go from here?
Interestingly, there was more agreement on reform than there was on the program itself.
Spence would dramatically narrow the program. His preference would be to concentrate assessment rigor on a smaller number of controls that meaningfully affect security outcomes rather than applying the same evidentiary burden across the entire control set. He also argued for greater use of continuous security information so the government can see meaningful indicators of posture without recreating the same evidence exercise every few years.
Linda focused on alignment. Many contractors already operate across multiple security frameworks and government programs. They may be dealing with NIST SP 800-171 Rev. 2 for one customer, Rev. 3 elsewhere, FedRAMP requirements for cloud environments, and commercial standards such as ISO 27001 or SOC 2 at the same time.
Every divergence creates additional work: separate documentation, separate evidence, separate interpretations, and separate compliance machinery. Greater reciprocity and synchronization could substantially reduce that burden while still giving the government confidence in contractor security.
And Andrew’s reaction probably captured where many contractors are sitting today: the program clearly has flaws, the industry can see opportunities to improve it, and everyone is waiting to learn what the pause will actually produce.
In the meantime, the work did not disappear
This was one of the best conversations we have had on the podcast precisely because everybody at the table had fairly strong opinions about how CMMC could be better. Those arguments are worth having.
In the meantime though, the underlying NIST SP 800-171 requirements are still there. Contractors still need defensible SPRS scores. Prime contractors may still impose their own cybersecurity expectations. Organizations handling CUI still have an obligation to protect it.
38North Security helps defense contractors work through CMMC scoping, readiness, remediation, mock assessments, evidence preparation, and the day-to-day work of protecting CUI while the program continues to evolve.
You can watch Katie Arrington’s interview with Secure-Centric here:
About the Authors
