- DOW has launched a formal review of the CMMC program
- Review includes a 60-day feedback period and a 15-day report timeline
- Attend the Potomac Officers Club’s DOW summits this summer
Kirsten Davies, chief information officer of the Department of War and a 2026 Wash100 awardee, said DOW has published a request for information on its review of the Cybersecurity Maturity Model Certification, or CMMC, program, and will host listening sessions across the U.S. to gather feedback from defense contractors, including small businesses and cybersecurity operators, Federal News Network reported Friday.
As the department works through its cybersecurity compliance review, defense professionals have an opportunity to stay ahead of related policy shifts at the Potomac Officers Club’s upcoming DOW events this summer. Sign up now for the 2026 Air and Space Summit on July 30 to hear discussions on artificial intelligence, Golden Dome, network modernization and other defense technology priorities. You can also save your seat today for the 2026 Navy Summit on Aug. 27 to explore naval modernization, autonomous systems and next-generation capabilities.
What Is the Timeline for the CMMC Review?
According to Davies, the review team will spend 60 days collecting feedback and evaluating the program, followed by a 15-day window to deliver a report with recommendations to her and Michael Duffey, under secretary of war for acquisition and sustainment and a fellow 2026 Wash100 honoree. Under that timeline, DOW expects the CMMC review to be finalized by late September.
“We’re hoping shortly thereafter that we’ll be able to make that report public along with the recommendations,” Davies said.
What Changes Could Result From the Review?
Davies declined to specify whether the review would result in the complete removal of third-party assessments.
“It could include everything from an overhaul to small tweaks here and there,” she said. “But what we’re not going to do is death by a thousand cuts and just change for the sake of change.”
How Will Small Businesses Factor Into the Review?
Davies said the department will incorporate feedback from small and innovative companies throughout the review process.
“We are going to listen to what the defense industrial base has to say, especially small and innovative companies,” she said. “And we are going to incorporate the voice of small companies to make sure that we are truly reducing barriers to entry for them to do business with [DOW].”
Her remarks came days after the Pentagon suspended the planned implementation of the CMMC program’s Phase II requirements, which were scheduled to take effect on Nov. 10.
In November of last year, DOW began the phased rollout of the CMMC program, marking the end of its voluntary phase.
