EDUCAUSE Comments: CMMC Program Review August 2026

Abstract

The U.S. Department of Defense (DoD) announced in July 2026 that it was suspending the November 2026 implementation deadline for Level 2 third-party certification of NIST SP 800-171 compliance under the Cybersecurity Maturity Model Certification (CMMC) program. At the same time, the DoD launched a task force to review the program and recommend changes to streamline requirements and reduce compliance burdens, especially for small to mid-size organizations.

The DoD released a request for information (RFI) to gather input to inform the task force’s work and EDUCAUSE submitted a response reflecting broad feedback from member representatives who focus on research cybersecurity. The association’s comments stressed that higher education institutions need the DoD to set cybersecurity requirements that are sufficiently flexible to allow for compliance within academic research contexts that differ greatly from the operating environments of traditional defense contractors.

EDUCAUSE members also stressed that existing CMMC requirements place heavy documentation and administrative overhead requirements on institutions that divert resources from cybersecurity to compliance. In particular, EDUCAUSE provided a detailed listing of 800-171 requirements that should be revised or reconsidered, noting in many cases how the controls are open to widely divergent interpretations that frustrate good-faith efforts at achieving compliance. The response concludes by highlighting ways in which the DoD could more effectively support compliance with its cybersecurity requirements, such as by providing institutions with access to DoD compliance specialists who could help colleges and universities better understand and meet DoD expectations.