Politics & Government · Government Contracting & Cybersecurity
Compliance Without Visibility Is Theater
October 6, 2026 · Commentary
When the Department of War suspended CMMC Phase II on July 13, 2026, it delayed the broader rollout of third-party assessment requirements that had been scheduled for November 10, 2026. It did not suspend Phase I self-assessment requirements, the underlying obligation to protect covered information, or the government’s reliance on contractor status and affirmations where CMMC applies. (war.gov)
Current DFARS rules define whether CMMC status is current in part by whether compliance has changed since the assessment and whether an affirming official has provided the required affirmation of continuous compliance. Contracting officers also check SPRS for current CMMC status when the requirement applies. (acquisition.gov)
The practical question for leadership is therefore not simply whether the company has completed an assessment. It is whether the evidence supporting that assessment still describes the environment that exists today.
Imagine a contractor completes its security review on Monday. The company has two privileged administrators. Both accounts are properly configured, multifactor authentication is enabled, access has been reviewed, and the evidence supporting the control is current.
On Thursday, an operations problem comes up. A third employee receives administrator privileges so the team can fix it quickly. The access is supposed to be temporary, but the additional privileges are never removed. Multifactor authentication is never fully configured, and the documentation is never updated.
Nothing dramatic happens. Nobody deliberately ignores the security program. The change is operationally understandable.
But by Thursday, the compliance record still describes Monday even though the network has already moved on. That is the weakness of point-in-time evidence: the documentation may remain perfectly organized while the environment it describes changes underneath it.
Cybersecurity programs need policies, system security plans, access records, assessments, and evidence. The mistake is treating proof that a control was operating at one point as proof that it is still operating now.
A policy can say that privileged accounts require multifactor authentication. An assessment can establish that the requirement was met. What leadership needs to know later is whether anyone created an exception, whether access has changed, and whether the evidence supporting the company’s representation still matches reality.
A binder can tell you what was supposed to happen. It cannot notice Thursday.
That gap matters for more than audit readiness.
The Justice Department has increasingly scrutinized cybersecurity representations under the False Claims Act. On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that a business unit failed to comply with NIST SP 800-171 requirements incorporated into a Defense Department contract. The settlement resolved allegations only, and there was no determination of liability. (justice.gov)
That does not mean every missed control becomes a False Claims Act case. Cybersecurity environments change. Controls can fail. The False Claims Act also turns on legal questions including knowledge and materiality.
For an executive, though, “Did we complete the assessment?” is still an incomplete question.
A better one is: If I had to stand behind this representation today, what could I see that would tell me it is still true?
For privileged access, the answer should be reasonably accessible. Who has elevated privileges now? Who received them recently? Does each person still need them? Are the required protections in place? Has anything changed since the evidence was collected?
If answering those questions requires three meetings, four exports, and an archaeological expedition through SharePoint, the organization may have compliance data. It does not have much visibility.
And the source of change does not matter much. A new administrator, a newly connected software tool, or an automated workflow with expanded permissions can all create the same Thursday problem: the live environment changes faster than the evidence describing it.
The Department says its CMMC review is intended to reduce cost and bureaucracy while moving toward cybersecurity measures that are more scalable and resilient, particularly for smaller and nontraditional suppliers. During the pause, it says NIST SP 800-171 compliance will continue to be enforced through self-assessments and selected government-led assessments. (war.gov)
That creates an opportunity for contractors to use the pause for something more useful than waiting to see what the next assessment regime looks like.
Pick one consequential control and trace it into the operating environment. If it governs privileged access, can leadership see who has that access today and what changed this week? If it protects controlled unclassified information (CUI), can the organization see where the information actually moves? If a system change affects the control, does anyone know before the next affirmation or assessment forces the question?
The distance between what leadership believes is true and what the operating environment can actually substantiate is what Helix Stratus Group calls the Intelligence Gap™.
The useful goal during the pause is to make the eventual assessment less important to your own understanding of your security. An assessor should confirm what you already know, not tell you what happened while you were not looking.
Compliance without visibility is theater. And the adversary is not in the audience.
Implementation guidance: DoW CIO CMMC status and Phase II suspension memorandum.