Sentinel Blue report says CMMC delays stem from cost and complexity, not assessor shortage

A new Sentinel Blue report, based on interviews with five independent C3PAOs, argues the Defense Industrial Base’s CMMC Level 2 readiness gap is being driven by cost, complexity and poor preparation more than a lack of assessors. The findings land as the Defense Department reviews the program after pausing Phase II in July and seeks industry input on the framework’s burden.

Why it matters: - The Defense Industrial Base still faces a CMMC readiness gap even after the Department of Defense paused Phase II. - Sentinel Blue says the bottleneck is not just assessor capacity, but the cost and complexity of getting contractor organizations ready for certification. - The report matters because CMMC is the main cybersecurity gate for contractors handling sensitive defense information.

What happened: - Sentinel Blue released a new report on CMMC Level 2 readiness after the DoD suspended CMMC Phase II on July 13. - The report is based on interviews with five independent C3PAOs: Cybersec Investments, Hive Systems, Kieri Solutions, Sentinel Blue and Smithers. - Sentinel Blue said the report found defense contractor unpreparedness is rooted more in framework burden than in a shortage of assessors. - The report says assessors have turned away prospective clients because those organizations were not prepared for assessment. - The report was published in Culpeper, Virginia, on August 11, 2026.

The details: - The DoD has cited a shortage of available C3PAOs for roughly 100,000 DIB businesses that need assessment. - The report says two barriers show up again and again: weak understanding of what a CMMC assessment requires and the high cost of preparation and certification. - The report also examines which types of organizations tend to perform better or worse in assessments. - It identifies documentation failures that most often derail engagements. - It also points to the controls that most often trip up organizations. - The full report is available as The CMMC Readiness Gap: What the Assessors Saw Before Phase II Was Paused. - Sentinel Blue CEO Andy Sauer said the company wanted to talk to the people running the assessments, not just follow the headlines. - Sauer said the interviews showed the DIB’s lack of preparedness is driven by complexity and cost as much as assessor capacity.

Between the lines: - The report pushes back on the idea that the main problem is simply a lack of assessors. - That distinction matters because it shifts attention from scaling certification capacity to reducing the friction organizations face before they can even enter the process. - The timing also suggests the industry is trying to influence the DoD review while the program is still in flux. - The DoD’s RFI closes August 14, and five of its seven questions ask contractors about the cost and burden of implementing CMMC. - A task force is expected to deliver recommendations in mid-September.

What's next: - Industry feedback collected through the DoD’s RFI will inform next steps for the program. - The task force is expected to deliver recommendations in mid-September. - Sentinel Blue said the cybersecurity work behind CMMC remains urgent regardless of how the assessment process changes. - Sauer said threats to sensitive defense information are not slowing down while enforcement is paused.

The bottom line: - Sentinel Blue’s report says the CMMC problem is bigger than staffing. The deeper issue is whether defense contractors can afford and understand the work required to become ready for assessment.