This is part 1 of a two-part investigation into the Cybersecurity Maturity Model Certification (CMMC) program. Part 2 will come out on Oct. 27.

The Defense Department has backed itself into a corner with the Cybersecurity Maturity Model Certification program.

Every reason Kirsten Davies, the DoD chief information officer, gave for pausing CMMC and for conducting a “top-to-bottom” review has been called into question based on data in its own request for information.

Davies, who at least three sources say has privately stated that her goal is to “get rid of the program,” now can’t make the forthcoming recommendations fit her narrative and has a limited path to move forward with CMMC.

“The final CMMC report is delayed because Davies can’t make it say what she wants it to say. The RFI responses and data didn’t support her goals,” said a former government official, who is familiar with CMMC and requested anonymity for fear of retribution.…