The suspension of CMMC Phase II did not lower the cybersecurity bar. It exposed a harder problem: how to verify security across a large and diverse defense industrial base without creating a process too costly and complex to scale.

As the Department of War reexamines CMMC and FedRAMP modernizes its own framework, contractors have an opportunity to move beyond point-in-time audit preparation toward reusable evidence, continuous assurance, and clearly defined responsibility.

In this session, John Bullough will explain what the CMMC pause changed, which obligations for protecting Controlled Unclassified Information remain, and how FedRAMP-certified cloud services can support a more efficient and defensible compliance program. He will break down what providers can substantiate through independently validated controls and reusable evidence, what remains the contractor’s responsibility, and how to evaluate cloud services without relying on labels alone.

Attendees will leave with a practical approach to making compliance investments that improve security, reduce duplicated reviews, and help their organizations move at mission speed.

Key takeaways

• What the CMMC Phase II suspension changed—and what remains required for contractors handling CUI..
• How CMMC and FedRAMP fit together, including where FedRAMP can provide independently validated controls and reusable evidence..
• How to distinguish provider responsibilities from the controls, configurations, processes, and documentation the contractor still owns..
• A practical framework for evaluating cloud providers and focusing compliance investments on meaningful security and operational outcomes..