07/10/2026
A lot of the conversation on Day 1 of Land Forces has centred around .
And one question keeps coming up:
“Should we still bother?”
My answer is yes.
The pause to the CMMC Program does not mean the underlying cyber requirements have disappeared. Phase I remains in place, and the expectation to protect sensitive defence information through measures aligned to NIST 800-171 is still very real.
More importantly, this is bigger than simply ticking a CMMC box.
These controls are building the cyber resilience Australian SMEs will increasingly need if they want to participate in global defence supply chains, work with international primes and export into markets where cybersecurity maturity is becoming a baseline expectation.
My view is that the pause is less about CMMC going away and more about giving the supply chain time to catch up.
SME uptake has been slower than anticipated, and moving too quickly into broader Level 2 certification requirements risked creating a significant gap in an already critical defence supply chain.
My prediction? We may see the next major deadline pushed to November 2027, giving SMEs more runway to complete Level 2 self-assessments and lift their maturity before certification requirements set in.
Whether that exact date eventuates or not, I wouldn’t be using the pause as a reason to stop.
I’d be using it as time to get ready.
Luke Smith
Founder, Secure State
