Insights2

The Pentagon’s modernization challenge is increasingly about subtraction as much as addition. The Army has cut its business-system environment from roughly 1,300 systems to about 200, DoD has identified 89 outdated systems for retirement, and the Navy reports more than $100 million in savings from shutting down legacy platforms. The lesson is larger than audit compliance: modernization is incomplete until…

CMMC Phase II is paused, but the underlying cybersecurity obligation is not. The Department has kept Phase I self-assessments in place, says it will continue enforcing NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments, and has reaffirmed contractors’ obligation to protect covered defense information. For defense companies, the durable requirement is increasingly clear: know where sensitive data…