23
Department of War Suspends CMMC Phase II Requirements (www.war.gov)
submitted 3 months ago by to c/cybersecurity@sh.itjust.works
7 comments fedilink hide all child comments
 

The Department of War today announces the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally scheduled to come into effect on November 10, 2026. All Phase I self-assessment requirements remain firmly in place.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 months ago* (2 children)

CMMC is more about how well your processes work. Low level = more chaotic, stuff basically works but people have to scurry around and improvise when it breaks. Mid level = it can break but procedures for fixing it are documented and regular, and various good practices are followed to make it reliable. High level = can't break, very rigorous standards. No attempt at certifying to any level at all = never mind, just wing everything.

I wonder how much turning everything into piles of AI crap is involved with this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 3 months ago* (1 child)

    Having worked with compliance across multiple industries, CMMC was created for very good reasons, but was poorly implemented, almost like it was being deliberately sabotaged (spoiler: it was).

    Our supply chain security is a joke in America and the big players have wanted it to stay that way this whole time. I do not think meaningful security standards can be adopted in a system with this level of blatant corruption.

    I've also had to do compliance for California Dept. Of Cannabis Control regulations. I've been telling people for years: If you want to do security theater, follow the NIST SP 800-171. If you want to do real security, follow CA Cannabis Control standards. I'm not joking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •