The compliance treadmill trap

The procurement gate is moving from the contract to the audit.

Pentagon cybersecurity certification was supposed to be the next compliance frontier — every defense contractor, from primes to one-person shops, assessed against the same standard before winning work. The math killed it before the rollout did: more than 100,000 defense contractors would need third-party assessments, while only a sliver of that assessor capacity exists. As Sayegh's Forbes analysis of DOD CIO Kristen Davies' remarks lays out, the program was always a queue problem disguised as a security one. Build the gate, do not staff it, and the gate becomes a tax on the people least able to absorb it — small and mid-tier suppliers, the long tail the Defense Industrial Base actually depends on.

The pattern is a recognizable one: call it the compliance treadmill trap. Regulators design a third-party assessment regime sized to a manageable population, the mandate expands to the whole market, and the assessor base does not. Costs spiral, small players drop out, and the regime either collapses mid-rollout or calcifies into a moat for the incumbents who can afford the queue. The Pentagon is doing the rare honest thing: pausing to redesign before the bottleneck locks in.

What survives the pause is the part that mattered — the NIST 800-171 Rev 2 security requirements, and the underlying DFARS obligations. What may not survive is the certification wheel itself. For the next 60 days, contractors should keep doing the cyber hygiene work, stop treating any current certification spend as locked-in, and watch whether the redesign lowers the barrier or quietly rebuilds the same bottleneck under a new label.