Clarion Street

The Vendors Now Write the CMMC Reform

·5 min read

Deep Fathom spent the spring selling a compliance product. In April it put a Compliance Readiness Suite into general availability, and I wrote about that launch when it happened: an orchestration platform, a boundary-resident evidence agent called Outpost, a “compliance fabric” that ties controls to evidence, assets, policies, and people. The pitch was that the suite “doesn’t just monitor compliance. It produces it, maintains it, and proves it,” compressing months of preparation into days.

Over the summer the company moved from selling the product to lobbying the program it serves. On August 13 it filed a response to the CMMC Reform RFI. On August 18 it published CMMC 20X, a working blueprint for securing the defense industrial base: a five-principle reform thesis, a systems analysis of seven policy paths, a working system, and a proposed Government pilot.

The RFI response is the part that matters. Deep Fathom asks the Department of War to keep the Level 2 baseline while separating the cost of implementing security from the cost of producing and repeatedly verifying evidence. It proposes a common, vendor-neutral evidence profile, verification depth tied to risk and material change, and a “controlled test of software-assisted review under accountable human authority.”

A company that sells software for reviewing compliance evidence is proposing that the Department adopt software-assisted review of compliance evidence as policy.

The disclosure is on the record

None of this is hidden. CMMC 20X labels itself “an independent Deep Fathom publication. Not affiliated with, or endorsed by, the Department of War.” The conflict section is more candid than anything I have seen from a vendor in this space: “Deep Fathom also builds compliance software for the DIB, and adoption of some of this would benefit us. A common evidence profile is something our platform produces. An assisted-review tier is something it could serve.”

The disclosure goes further than the minimum. Deep Fathom argues for keeping all 110 Level 2 requirements even though, by its own note, a smaller baseline “would shrink the market we sell into.” It publishes the evidence schema so any tool can implement it. It publishes the conditions under which its own proposal should be abandoned. The model results are labeled “conditional model results, not predictions.”

I do not think this is a scandal. I think it is what happens when the official process goes dark and a vendor writes the reform because someone had to. The disclosure is real, and it is better than the rest of this category manages.

The category filled in around it

Deep Fathom is no longer alone. Scytale sells “agentic compliance that collects evidence continuously.” Fortreum launched an AI-native CMMC Assessment Readiness Review in June, combining its in-house C3PAO with Kovr.AI’s Agent Artemis in a FedRAMP-authorized environment. “Agentic compliance” has stopped being one company’s coinage and become a category, and all of it is aimed at the same obligation: contractors who still face self-assessment, SPRS scoring, and False Claims Act exposure while third-party certification sits in a 60-day review.

That review was supposed to produce an answer, and so far it has not.

The report is the missing piece

The CMMC Reform Task Force’s 60-day clock ran out on September 11. Its report was due to DoW CIO Kirsten Davies. Nothing has been published, and by the Department’s own account it is her call whether it ever is. The inputs were invisible too. The RFI collected more than 1,100 comments by email, into inboxes, with no public docket.

The one glimpse came from Davies two days before the deadline, at Billington: more than half the comments supported the Phase II suspension, and the loudest concerns came from the third-party assessor community. A parallel review of the Risk Management Framework and a focus on operational technology surfaced in the same remarks. A reform that rolls back third-party assessment could, in the same stroke, extend requirements toward the shop-floor machines most small contractors have never treated as a compliance surface.

Deep Fathom quotes the CIO putting the capacity problem in arithmetic: more than 100,000 suppliers need a third-party assessment, roughly 100 assessors exist to do them, and “the math just simply doesn’t math.”

What I make of it

I would rather read a disclosed conflict than an undisclosed one, and Deep Fathom has handed me a disclosed one. The structural problem does not go away because the vendor behaved well. The verification mechanism under debate is now being described, in detail, by a company that sells the verification tooling, while the official report that would settle the question sits unreleased with an office that decides whether the public ever sees it.

That is not opportunism in the cartoon sense. It is a reform process running with its inputs and its outputs both closed to the public, and the vendors filling the space in between. The question is not whether a vendor’s proposal serves the vendor. Of course it does. It is whether anyone will produce the independent version, and whether anyone will see it if they do.

Sources

  1. CMMC 20X: A Working Blueprint for Securing the DIB — Deep Fathom, Aug 18, 2026
  2. The CMMC Task Force Deadline Passed. Where’s the Report? — Objective320, Sep 24, 2026
  3. Deep Fathom Launches CMMC Compliance Readiness Suite — Deep Fathom, Apr 7, 2026
  4. Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements — U.S. Department of War, Jul 13, 2026
  5. Fortreum Launches AI-Native CMMC Assessment Readiness Review — Fortreum, Jun 25, 2026
  6. Scytale: Automated CMMC Compliance — Scytale