Different CMMC reforms produce different DIB outcomes.

We modeled seven policy options for CMMC’s next phase across supplier survival, verification coverage, review capacity, cost, and security exposure.

Follow each option through 2049 and examine the tradeoffs across nineteen published measures. The results are conditional, not a forecast.

Compare the seven policy options Read methodology

Model bf91444e3fcc · Assumption set graduated-verification-2026-08-13.v1

Seven policy options · five outcomes

Read the tradeoffs together.

The same security requirements can produce very different levels of assurance, supplier loss, review backlog, exposure, and cost.

Read security assurance and supplier survival together. The mission needs current safeguards and a supplier base able to keep delivering; a program that improves one by sacrificing the other does not hold up.

These are median modeled results under the conditions stated for each policy option. Read the five outcomes together. This is a comparison, not a forecast.

Seven CMMC policy options compared across current assurance, suppliers lost, peak review backlog, time to the modeled control-exposure target, and annual contractor burden. — Figure 01 · 100 paired runs per policy option · Model bf91444e3fcc · graduated-verification-2026-08-13.v1

Inspect each policy option Download PNG Download editable SVG Download PowerPoint slide

Read the figure as a table

Median modeled results by CMMC policy option
Policy option	Current assurance 2049	Suppliers lost through 2049	Peak review backlog organizations	Exposure target reached first sustained month at or below 0.35	Contractor burden 2049 per year
Current suspension	65%	0%	17k	Feb. 2044 (87% reached)	$1.74B
Reopen unchanged	97%	36%	33k	Feb. 2031	$1.44B
Capacity expansion	97%	18%	27k	Sep. 2031	$1.85B
Evidence modernization	97%	13%	23k	Aug. 2033	$1.72B
Graduated verification	90%	3%	12k	Feb. 2034	$1.62B
Coordinated reform	91%	1%	7.4k	Dec. 2032	$1.08B
Program rescission	0%	0%	4.5k	Not reached	$0.5B

Interactive analysis

Inspect each policy option.

Choose a policy option, then change the measure. The workbench includes all nineteen published measures, stress tests, resource costs, and implementation steps.

Model bf91444e3fcc100 paired runs per policy option24 stress-test cases5 coordinated-reform testsPublished Aug 14, 2026

Selected policy option

Continue the current suspension

Keep the Phase 2 gate closed. Existing status retains its normal clock, and underlying safeguarding work continues, but no new policy-scale independent-verification demand is released.

Current verification65%

Suppliers lost0%

Question testedWhat does the existing program produce when leadership preserves time to reform but adds no new route, capacity, scope, or supplier intervention?

Controlled comparisonNo new intervention; the current 110-requirement Level 2 baseline, workforce, scope, and verification topology remain unchanged.

Outcome conditionThe chart assumes the listed changes take effect and receive the modeled resources.Inside all 2049 limits: 0%No new policy implementation in this baseline

Current assurance coverage, 2026–2049 Selected median and P10–P90 Current-suspension median

2049

Current assurance never reaches 70%

The median ends at 65% in 2049.

Current assurance65%P10–P90 34%–66%Outside modeled limit

DIB attrition0%P10–P90 0%–0%Inside modeled limit

Control exposure0.25P10–P90 0.25–0.48Inside modeled limit

Total backlog11kP10–P90 1.9k–11k

Decision readout

Suspension buys time; it does not build a verification steady state.

Action modeledKeep the Phase 2 gate closed and introduce no replacement intervention.

Median current assurance reaches 65% by 2049 while attrition remains 0%. The approach never reaches the full outcome set.

Why it happens

Prime flow-down and voluntary safeguarding work continue at baseline rates, so implementation improves slowly. Without new contractual demand or a different route, current independent status grows much more slowly than the population-level requirement.

Leadership implication

Use suspension as a planned implementation window with entry and exit criteria. Elapsed time is not evidence that the system is ready to reopen.

What could change this conclusion

The result is most sensitive to how much prime flow-down pressure persists while the formal gate remains closed.

Modeled cost

Where the money goes

Cumulative resource cost through 2049, split between implementing safeguards, maintaining evidence, contractor-paid reviews, and Government reviews.

Safeguard implementation and sustainment$17.6BP10–P90 $13.6B–$17.6B

Evidence creation and maintenance$8.5BP10–P90 $3.1B–$8.5B

Contractor-paid verification$10.4BP10–P90 $4.8B–$10.4B

Government verification and sampling$0MP10–P90 $0M–$0M

Implementation timing

A decision is not yet an operating change.

For each action, the model tracks its start date, legal instrument, implementation delay, and chance of taking effect. The outcome chart assumes every listed action becomes effective; implementation risk is estimated separately.

This policy option introduces no new intervention.

What it can support

Comparative systems analysis

Whether an intervention removes a constraint or merely moves the bottleneck
How implementation lead times interact with a deadline-clustered demand wave
Why scope, verification routes, capacity, technology, and supplier survival must move together
Which conclusions remain stable across different implementation conditions

What it cannot support

Predictions or guarantees

A prediction of what the Department or Congress will do
Per-company readiness, cost, revenue, or breach probability
Third-significant-figure precision or an exact implementation date
A claim that any vendor, technology, or isolated lever is sufficient

From result to mechanism