Key Takeaways
- Despite the Pentagon’s pause on the Cybersecurity Maturity Model Certification (CMMC) process, most PSC member companies already underway with third‑party assessments are choosing to continue the effort.
- Contractors cite prior investment, the inevitability of a cybersecurity regime for government work, and a commitment to good cyber‑hygiene as reasons to press forward.
- The Department of Defense is reviewing whether self‑attestation will remain sufficient or if third‑party validation will be required; a request for information (RFI) is open until August 14, with industry feedback expected to shape the final decision.
- The CMMC pause is not unexpected; the program has undergone revisions under both the Trump and Biden administrations, so contractors view the current suspension as another routine policy tweak.
- A broader business‑planning concern is the lack of a unified U.S. government cybersecurity framework—contractors prefer a single set of rules that applies across all departments rather than agency‑specific variations.
- In response to a perceived gap in PSC’s international portfolio, the association launched an International Affairs Council to cover the full spectrum of State, Commerce, USDA, DOD foreign‑sales, and humanitarian‑assistance programs.
- The council’s top priority is securing reimbursement for outstanding invoices and ensuring fair termination settlements for member companies working on foreign‑assistance contracts.
- PSC intends to engage actively with the State Department, the Millennium Challenge Corporation, and congressional committees to shape the future of foreign assistance, emphasizing the contracting community’s role in delivering taxpayer value and advancing U.S. interests overseas.
Overview of CMMC Pause and PSC Member Response
The Pentagon’s recent decision to suspend the CMMC accreditation process has sparked considerable discussion across the defense‑industrial base. Stephanie Kostro, president of the Professional Services Council (PSC), notes that while the suspension has generated uncertainty, many PSC member companies that were already midway through certification by a Certified Third‑Party Assessment Organization (C3PAO) have opted to keep moving forward. Roughly 40 % of PSC’s 400 members perform work under Department of Defense (DoD) contracts, placing them directly in the path of the CMMC rollout.
Reasons for Continuing Certification Despite the Pause
When asked why firms are persisting with the assessment, Kostro highlighted two recurring themes. First, contractors have already expended time, money, and internal resources to begin the process and see value in seeing it through to completion. Second, and more importantly, there is a shared recognition that a cybersecurity regime for government contractors is inevitable. Members view continued participation as an expression of good governance—ensuring their cyber hygiene meets the standards needed to protect federal information, regardless of the interim procedural hiccup.
DoD’s Position on Self‑Attestation Versus Third‑Party Validation
Kostro clarifies that the DoD has not signaled any intention to lower cybersecurity standards; the debate centers on whether self‑attestation will remain an acceptable path to compliance or whether third‑party verification will be mandated. As part of its 60‑day review, the department has issued a request for information (RFI) soliciting input from industry and the public, with responses due August 14. The feedback collected will inform the task force already convened to evaluate the CMMC framework, potentially shaping whether the final model leans more heavily on self‑certification or retains a robust third‑party assessment component.
Historical Context and Expectations of Change
The CMMC initiative originated in the late 2010s under the first Trump administration, with PSC present at its inception. Subsequent administrations have tweaked the program, and the current suspension aligns with that pattern of periodic reassessment. Kostro observes that the pause was, in fact, telegraphed by executive‑branch signals earlier in the spring, so industry was not caught off‑guard. Contractors therefore treat the suspension as another iteration in an evolving policy landscape rather than a fundamental shift away from the goal of securing the defense supply chain.
Business‑Planning Implications and the Desire for a Unified Regime
From a planning standpoint, Kostro points out that the larger issue for many firms is the fragmentation of cybersecurity requirements across the U.S. government. While DoD’s DFARS supplements the Federal Acquisition Regulation (FAR), other agencies maintain their own clauses, forcing contractors to juggle multiple, sometimes overlapping, compliance regimes. A unified, government‑wide cybersecurity framework would reduce administrative burden, simplify contracting, and provide clearer guidance for long‑term investment in security capabilities.
Launch of the PSC International Affairs Council
Shifting focus, Kostro explains that the creation of PSC’s International Affairs Council emerged from a strategic review after the appointment of a new CEO and her own elevation to president. The council was designed to fill a gap left by the existing International Development Council, which concentrated primarily on development‑oriented programs but did not adequately address the broader spectrum of State Department activities, international narcotics control, law‑enforcement, rule‑of‑justice initiatives, humanitarian assistance, or the foreign‑sales arms of Commerce, USDA, and Defense.
Scope and Mission of the International Affairs Council
The new council’s mandate is deliberately expansive: it will engage with the State Department’s diplomatic and consular arms, the Department of Commerce’s Foreign Commercial Service, the USDA’s Foreign Agricultural Service, and the DoD’s foreign military sales and direct commercial sales programs. Additionally, it will cover humanitarian‑assistance efforts, security cooperation, and support to multilateral organizations such as the United Nations. By widening the aperture, PSC aims to provide a cohesive voice for contractors operating across the entire international‑affairs landscape.
Primary Concerns of Members in Foreign Assistance
Kostro identifies reimbursement for work performed as the most pressing issue for PSC’s international‑affairs members. Outstanding invoices dating back to the Biden administration and the early months of the Trump administration remain unpaid, creating cash‑flow strains. Parallel to invoice recovery, contractors are navigating termination settlement proposals—negotiations that determine what costs can be recouped when a government contract is ended prematurely. Ensuring that these settlements are fair and timely is a top priority for the council.
Engagement on the Future of Foreign Assistance and Value to Taxpayers
Beyond immediate financial concerns, PSC seeks to influence the shaping of future foreign‑assistance policy. Kostro notes that senior officials, including Secretary of State Marco Rubio, have emphasized humanitarian aid, security cooperation, and support for international organizations as pillars of U.S. engagement abroad. PSC intends to bring the contracting community’s expertise to discussions with the State Department, the Millennium Challenge Corporation, and relevant congressional committees, arguing that effective contract management enhances the return on investment for American taxpayers while advancing national security and diplomatic objectives.
Outlook and Closing Thoughts
Looking ahead, Kostro stresses the importance of sustained dialogue between industry and government. Whether addressing the evolving CMMC framework or reforming foreign‑assistance contracting, the goal remains to balance rigorous security and accountability with practical, business‑friendly policies. By continuing certification efforts despite the pause, advocating for a unified cybersecurity regime, and championing fair payment and strategic input in international programs, PSC members aim to uphold the integrity of the defense industrial base while contributing effectively to U.S. global missions.