Cyber Grants Alliance pushes DIB manufacturers to seek CMMC gap assessment grants

Cyber Grants Alliance is urging defense industrial base manufacturers to use its Level 1 and Level 2 gap assessment grants before changing CMMC enforcement timelines create new compliance risk. The group says core cybersecurity obligations still apply even after the Pentagon paused Phase 2 third-party assessments.

Why it matters: - Defense industrial base manufacturers still face enforceable cybersecurity obligations even as the Department of Defense pauses one part of the CMMC rollout. - The group says companies that delay assessments risk contract losses, rushed remediation and weaker standing with prime contractors. - Gap assessments can help manufacturers document compliance now and prepare for whatever framework follows the current review period.

What happened: - Cyber Grants Alliance on July 23 urged DIB companies to act on cybersecurity compliance after the Department of Defense's July 13 announcement suspending Phase 2 CMMC third-party assessments. - The nonprofit said manufacturing DIB companies should not treat the pause as relief from self-assessment or baseline security obligations. - Cyber Grants Alliance offered in-kind grant readiness programs for CMMC Level 1 and Level 2 gap assessments.

The details: - Phase 1 self-assessments, NIST SP 800-171 Rev. 2 compliance and DFARS 252.204-7012 safeguarding requirements remain legally enforceable obligations. - The organization said those obligations can still carry False Claims Act exposure. - Prime contractors may continue to require third-party certifications for supplier programs even during the 60-day review period. - Companies without documented compliance posture may lose contract opportunities while the review period continues. - The pause affects certification paperwork, not the underlying duty to protect Federal Contract Information and Controlled Unclassified Information. - The Level 1 Gap Assessment Grant is valued at $5,000 in-kind and evaluates 17 basic cyber hygiene practices across six control families under FAR 52.204-21. - The Level 2 Gap Assessment Grant is valued at $10,000 in-kind and reviews all 110 NIST SP 800-171 Rev. 2 controls across 14 control families for companies handling CUI. - Rick Dassler, executive director of Cyber Grants Alliance, said: "Manufacturers cannot afford to sit on the sidelines." - Dassler said establishing an accurate baseline today is a step to safeguard defense contracts. - The application links for the grant programs are Level 1 Grant and Level 2 Grant.

Between the lines: - The message is as much about timing as compliance. - Cyber Grants Alliance is arguing that the current pause creates uncertainty, not a reprieve. - That uncertainty could widen the gap between companies that can document controls now and those that wait for the final shape of enforcement.

What's next: - Cyber Grants Alliance expects companies to use the 60-day review window to document gaps and strengthen remediation plans. - The review could produce modified, reinstated or alternative assessment frameworks. - Companies without current gap assessments may face more expensive and compressed remediation later.

The bottom line: - The assessment pause may slow certification, but it does not eliminate cyber compliance pressure for DIB manufacturers.