Small Business

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

The CMMC pause was not a CMMC decision. It was Pillar 3 of a five-pillar acquisition doctrine building since Executive Order 14265, and it moved the compliance question from who signs the certificate to how the government will confirm security at all.

Open source removes CMMC's license fees and vendor lock-in, but it moves the entire burden of proof onto the small business that adopts it. The push toward continuous monitoring cuts both ways.