What Actually Holds Up?

CMMC debates often isolate one change: reopen the program, add assessors, improve evidence, change who receives a full assessment, or remove the program. Each proposal fixes a different problem. Each can also move the failure somewhere else.

We built the CMMC 20X program model to make those tradeoffs visible. It follows supplier readiness, current evidence, review capacity, backlogs, cost, supplier loss, and modeled control exposure through 2049. It compares seven CMMC policy options under the same published assumptions.

Figure 01. Median modeled outcomes from 100 paired runs per policy option. These are conditional model results, not forecasts. Download the PNG or editable SVG.

The compact figure reports when each path first begins twelve consecutive months at or below the modeled 0.35 exposure target. Five active reform paths finish with nearly identical exposure values in 2049, so the final value hides years of material difference. The target month keeps that duration visible.

Reopening unchanged gets a high final number by shrinking the denominator

The unchanged path ends with 97 percent current assurance in the median run. It also loses 36 percent of active suppliers and produces a peak review backlog of 33,000 organizations.

The queue eventually falls because assessments finish and because firms leave. Looking only at final coverage makes those two mechanisms indistinguishable.

More assessors help, but do not fix the whole path

Capacity expansion raises final current assurance to 97 percent and cuts peak backlog to 27,000. Supplier loss still reaches 18 percent.

That is not an argument against adding qualified assessors. The capacity takes time to train and authorize, while every supplier still faces the same readiness work and the same full third-party route. Capacity is necessary. It is not a complete design.

Better evidence removes repeat work; review capacity still constrains the route

Evidence modernization ends at 97 percent current assurance, 13 percent supplier loss, and a 23,000-organization peak backlog. The model assumes that a common evidence structure and assisted review reduce some repeated handling. They do not change which organizations require a full assessment.

This matters for the technology argument. Software can collect facts, map them to CMMC, find contradictions, and prepare work for a reviewer. It cannot create assessment capacity or decide which verification route policy requires.

Graduated verification changes where scarce review time goes

The graduated path sends standard-risk work through evidence-backed self-assessment, elevated-risk work through assisted human review, and high-risk work through C3PAO assessment. The median result ends at 90 percent current assurance, 3 percent supplier loss, and a 12,000-organization peak backlog. High-risk route coverage reaches 98 percent.

The work does not disappear. Contractors still prepare evidence. People still review exceptions. Government still needs a sampling function. The model simply stops spending a full C3PAO assessment on every organization regardless of risk.

Coordinated reform performs best because it changes several causes in order

The coordinated path corrects scope, sequences demand, helps suppliers become ready, grows independent capacity, standardizes evidence, and activates the three verification routes before reopening. Its median result ends at 91 percent current assurance, 1 percent supplier loss, and a peak backlog of 7,400.

No single lever produces that result. The order matters. Opening the demand gate before suppliers, evidence methods, and review capacity are ready recreates the queue. Adding technology without changing the route leaves the main queue in place. Changing the route without staffing human review creates a new queue.

Suspension and rescission avoid one failure by accepting another

Keeping the program suspended avoids modeled supplier loss, but current assurance reaches only 65 percent by 2049. Rescission also avoids program-driven supplier loss and lowers annual contractor burden, but current assurance falls to zero and modeled control exposure remains far higher than every active CMMC path.

Administrative relief is not the same thing as security. A successor mechanism would have to be named, funded, and measured.

What the model does not prove

These results are not predictions of Department action, supplier behavior, breaches, litigation, or realized cost. They do not demonstrate AI accuracy or time savings. The model is an aggregate stock-and-flow system, not a simulated set of individual companies.

The useful question is not whether a reader agrees with one final percentage. It is which assumptions would have to change to reverse the mechanism: supplier readiness time, assessment productivity, evidence labor, route mix, human-review capacity, Government sampling, or cost. Those assumptions and sensitivity cases are public.

Inspect the methodology and limitations, then compare all seven policy options.