John Grancarich, EVP, Head of Defense & Intelligence at Fortra, explains in Cyber Security News that the pause in CMMC Phase II implementation does not change defense contractors' responsibility to protect Controlled Unclassified Information (CUI). He argues that NIST SP 800-171 requirements, DFARS obligations, and broader federal cybersecurity expectations remain in place regardless of certification timelines. The article emphasizes the importance of maintaining readiness, improving visibility into sensitive data, strengthening supply chain security, and treating cybersecurity as an ongoing capability rather than a compliance deadline.
"The CMMC Phase II pause may alter certification timelines, but it does not change the fundamental responsibility to protect controlled information." — John Grancarich
