CMMC Pause Exposes High Compliance Costs for Small Defense Contractors — Jeremiah Jensen — Business of Tech: Daily MSP News & IT Services Analysis

The core mechanism discussed is the regulatory pressure and resulting operational risk created by the Department of Defense’s (DoD) abrupt suspension of the CMMC Level 2 third-party certification mandate. IntelliGenesis, led operationally by Jeremiah Jensen, illustrates how rapidly shifting compliance expectations can expose defense contractors and their MSP partners to unrecoverable sunk costs, increased governance complexity, and unclear accountability. The episode highlights the structural disconnect between government-mandated cybersecurity standards and the practical realities of implementing and maintaining those requirements at scale.

According to Jeremiah Jensen, IntelliGenesis incurred more than $200,000 in direct costs, invested four months of intensive labor, and committed a team of five to six staff to achieve early CMMC Level 2 certification—including significant documentation, hardware upgrades, and consultant fees. Despite this investment, the DoD paused the entire third-party assessment program on July 13, citing small business cost burdens and insufficient assessor capacity. This left companies like IntelliGenesis having already completed—and paid for—requirements that were no longer mandated for the time being, but with underlying security obligations still in effect.

Secondary issues reinforce the underlying risk: the audit process was described as inflexible and expensive, with a binary pass/fail outcome that offered no remediation for minor deficiencies—requiring full re-audit at the original cost if any portion was not met. Further, both Dave Sobel and Jeremiah Jensen noted a lack of clarity in ongoing expectations, as large defense primes were previously flowing down certification pressures to subcontractors, but have gone quiet since the mandate was paused. The temporary pause, coupled with ongoing self-attestation requirements and a comment period through August 14, creates a regulatory gray area with uneven impacts across the defense supply chain.

For MSPs and IT providers supporting government contractors, these developments translate to increased contract risk, ongoing uncertainty in governance requirements, and exposure to costs that may not deliver a return if regulations shift again. The episode clarifies that self-attestation standards are still in place, but the lack of authoritative third-party oversight introduces ambiguity and potential liability. Providers should anticipate further regulatory refinement, engage with clients regarding their compliance posture, and treat sunk certification costs and compliance-driven operational overhead as persistent risks rather than guaranteed business advantages.

Supported by:

Pax8
Guardz

About Business of Tech: The daily MSP news and analysis podcast for managed service providers and IT services leaders. Host Dave Sobel covers AI for MSPs, MSP pricing and profitability, MSP M&A and private equity, vendor partner programs, MSP cybersecurity and liability, and MSP operations — and answers the question every story raises: Why do we care? Produced by MSP Radio.

💼 All Our Sponsors

MSP Radio is supported by our partners:

ABC Solutions · CometBackup · Firetail · HaloPSA · LogMeIn · Mailprotector · Pax8 · Rythmz · ScalePad · TimeZest · Transit AI

Supporting the IT services community through insights, analysis, and transparency.