Watchdog urges DOD to address external factors affecting CMMC implementation

The Government Accountability Office (GAO) found that the Department of Defense (DOD) has not fully identified external factors hindering the defense industry's compliance with the Cybersecurity Maturity Model Certification (CMMC) 2.0 model. The GAO report, published Thursday, noted that while the DOD has a comprehensive strategy, it has not systematically identified external factors beyond its control that risk the program's overall success. These factors include the capacity of the CMMC ecosystem, the cost and difficulty for small businesses, and evolving cybersecurity requirements. DOD Chief Information Officer Kirsten Davies stated the department concurs with the GAO's recommendations and will assess and document these significant external factors affecting CMMC Program implementation. The GAO warned that relying on waivers, as suggested by the Pentagon, could undermine the CMMC program's long-term viability and its intent to verify federal cybersecurity requirements.