GAO Flags Gaps in Pentagon Cyber Certification Rollout for Defense Contractors

Rojoef ManuelMarch 18, 2026

1 minute read

The US Government Accountability Office (GAO) has found that the Department of Defense has not fully evaluated outside risks that could slow the adoption of its Cybersecurity Maturity Model Certification (CMMC) program.

Launched in 2020 and updated in 2024, the CMMC obligates industry partners to employ their respective networks under certain cybersecurity standards to protect sensitive government data.

The Pentagon began phasing in requirements in November 2025 as it shifted from voluntary compliance to mandatory certification.

Findings and Risks

According to the GAO, the Department of Defense has developed multiple planning documents and addressed most elements of a comprehensive strategy under the CMMC.

However, it “has not systematically assessed and documented the external factors that could affect the department meeting its goals,” passing only six out of seven of that benchmark.

The agency noted that a key risk is the private sector’s capacity to meet demand, as the Pentagon relies on third-party assessors to certify tens of thousands of contractors, but has not outlined how it would respond if there are too few qualified assessors.

“By assessing and documenting key external factors and developing approaches to address them, [Department of Defense] would better understand program implementation risks,” the GAO said.

The government watchdog added that the department could issue waivers if issues occur, but warned that relying on waivers “could undermine the long-term viability” of the program.

The report also cited uncertainty around workforce competency projects and evolving cybersecurity standards, including updates from the National Institute of Standards and Technology that have yet to be incorporated.