This is part 2 of a two-part investigation into the Defense Department’s Cybersecurity Maturity Model Certification (CMMC) program. You can find part 1 here .

While the future of the Cybersecurity Maturity Model Certification is unclear, the Defense Department has a host of options to not only save face after its self-imposed, months-long pause, but also to address several of its publicly expressed concerns.

Current and former federal officials and industry experts say DoD’s reasons for pausing CMMC have little to nothing to do with the actual program, but they are all about the underlying security control requirements outlined in National Institute of Standards and Technology Special Publication 800-171.

And while rewriting SP 800-171 is a long process and moving away from it altogether is possible, but difficult, there are several initiatives DoD could implement over the short and medium term to address real or perceived concerns.

“Industry identified several common approaches to easing these burdens,…