CMMC author and former DoD CISO Katie Arrington explains why the CMMC pause needs to end, and what’s at stake for the Defense Industrial Base if it doesn’t.
Katie Arrington wrote the CMMC. She got it funded inside the Pentagon, carried it through the DAR Council, OMB, and OIRA, and signed off on it to the Under Secretary in May 2025 with the words “this is good and solid.” Then she resigned to go warn industry about a bigger threat. Now she is watching the program she built sit under a pause, and she has one message for the Department: lift it before November, or trigger a new rule change.
Why CMMC became a rule she never wanted
Katie came into the Office of the Under Secretary for Acquisition and Sustainment in January 2019 with one task: get the DIB accountable for NIST SP 800-171. Leadership wanted 900 government cyber auditors. She knew the Fourth Estate would never fund that in perpetuity, so she put out an RFI and handed the problem to industry. Her team cross mapped NIST SP 800-171, NIST SP 800-53, ISO 27001, and GDPR, then asked contractors what they paid per seat for 800-171 compliance. Nobody could answer. Everyone could quote their G&A. That was the proof: companies were checking the box, not doing compliance, with POA&Ms dated out to 2099.
She wanted CMMC to live in Sections L and M so each program manager could decide what was CUI. The Paperwork Reduction Act made that impossible. Anything that affects ten or more contractors has to go through the FAR or DFARS, which is how CMMC became a static rule instead of a dynamic program.
What the CMMC pause actually does
Katie’s argument is procedural, not political. CMMC was written against NIST SP 800-171 Rev 2. The Department is moving to Rev 3. If the pause is not lifted before November, the program cannot start, cannot be modified, and will automatically require another rulemaking cycle. You cannot change a program that never went into effect. Her ask to the CIO is direct: release the pause, let the program start, then overhaul it from the inside.
She also separates two things people keep conflating. NIST SP 800-171 compliance is the requirement. CMMC is the audit. If the Department believes compliance is too burdensome for small businesses, the answer is a small business loan program, not a pause on the audit. She cites the Verizon report showing 88 percent of ransomware targeted small businesses, and notes that DFARS 252.204-7012 is still on the books either way.
Where AI belongs in an assessment
Katie supports AI in auditing with guardrails. The example she gives: let the tool review the software intake policy, then have a human auditor pick two deployed applications at random, pull the patch dates, and interview the person who runs intake. Generating an SSP from a prompt is not the same as knowing your network. Steven adds the IntelliGRC position: use AI to speed you up, not to replace you.
Why she left to talk about Q Day
Katie’s nickname in the Deputy’s management group was Crypto Katie, because every program review ended with the same question: where is your money for cryptography? She left the CISO seat once CMMC was signed, because the next elephant in the room is post quantum cryptography. She points to China implementing quantum key distribution across critical infrastructure since 2008, to the gap in national quantum investment, and to the two June executive orders requiring a PQC strategy for national security systems and high value assets by 2027. Her bad day is simple: she wakes up in DC and hears birds instead of traffic, because critical infrastructure has stopped.
Adversaries, she says, are banking on the DIB arguing about CMMC instead of implementing it. A third episode on quantum is already on the table.