Defense Contractors Have a rev. 2 vs rev.3 Problem (again)

Speak With Our Team: https://summit7.us/contact DoD already solved the problem of CMMC requiring NIST SP 800-171 Rev. 2 while other cybersecurity requirements moved to Rev. 3. Then it suspended CMMC Phase 2. Now the FAR CUI rule is approaching with Rev. 3, CMMC remains tied to Rev. 2, and defense contractors could once again find themselves juggling different cybersecurity baselines for the same data. We break down how DoD got here, the options for fixing it, and why CMMC reform could make the problem even more complicated. Crisis Averted (2024): https://youtu.be/voziZRAMvv4?si=LLlm4VUmBR-G3hno Phase 2 Suspension: https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/ Unified Agenda: https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0790-AM01 DoD CIO (Feb 2026): https://www.linkedin.com/posts/dow-cio_ot-cyber-cybersecurity-activity-7433151492745879552-b_It