Valor Cybersecurity’s response to the CMMC Reform Task Force includes two more recommendations that work together to attack the same root constraint from both ends: there aren’t enough assessors, and not every company needs the same level of assessment in the first place.

Valor Cybersecurity’s submission to the CMMC Reform Task Force lays out a set of reforms aimed at reducing cost and complexity for small and mid-size defense contractors without weakening the standard itself. Two of those recommendations, an accelerated C3PAO training pipeline and a tiered assurance model, are best understood together. One expands the supply of assessment. The other reduces how much of that supply gets consumed on companies that don’t need the full-strength version of it. Here’s the thinking behind both.

The Root Constraint: Not Enough Assessors for the Population That Needs Them

Nearly every cost and scheduling problem described in Valor’s submission traces back to the same bottleneck. Roughly 100 authorized C3PAOs currently exist to assess a population of more than 100,000 companies. Valor’s submission calls this out directly as the root constraint behind both cost and scheduling delay: when demand for assessment slots dramatically outpaces supply, prices rise and timelines stretch, regardless of how efficient any individual assessment process is.

This is a supply problem, and Valor’s submission treats it as one. The recommendation is straightforward: an accelerated, DoW-supported training pipeline to expand the number of authorized assessors, closing the gap between the current bench of roughly 100 C3PAOs and the six-figure population of companies that ultimately need to be assessed.

Valor is candid about the timeline here. Unlike the cohort assessment model, which could be piloted within the current 60-day review window, an accelerated training pipeline is described as a near-term investment with a payoff on a longer timeline, likely 12 to 24 months before it meaningfully expands capacity. That’s not a reason to deprioritize it. It’s a reason to start it immediately. Every month the pipeline isn’t funded is a month added to that 12-to-24-month clock, and assessor scarcity doesn’t resolve itself while the Task Force considers other reforms.

The Complementary Move: Not Every Company Needs the Same Assessment

Expanding the number of assessors addresses supply. Valor’s second recommendation addresses demand, by questioning whether every company in the compliance population actually needs a full C3PAO engagement in the first place.

The proposal is a tiered assurance model: the smallest companies would rely on a standardized self-assessment plus review from a Registered Provider Organization (RPO), with full C3PAO assessment reserved for the highest-risk contract work. This isn’t a new concept invented for this recommendation. Valor’s submission raises a closely related idea in response to the Task Force’s question on Phase I self-assessments, proposing a defined, documented middle assurance tier for self-assessments that have been independently reviewed by an RPO, short of a full C3PAO engagement. The tiered assurance model in the cost-and-barriers section extends that same logic into a structural recommendation: match the intensity of the assessment to the actual risk of the work, rather than applying the same full-scale process regardless of what a company handles.

For a small manufacturer with a narrow CUI footprint and low-risk contract work, that could mean the difference between a standardized self-assessment with independent RPO review and a six-figure C3PAO engagement built for a much larger, higher-risk environment. Critically, this isn’t a proposal to skip assessment. It’s a proposal to route company after company toward the level of scrutiny that’s proportionate to what they actually touch, freeing up scarce full C3PAO capacity for the contract work where it’s genuinely needed.

Why These Two Belong Together

Neither recommendation solves the assessor shortage on its own, but together they attack it from both directions. The training pipeline grows the pool of assessors over the next one to two years. The tiered model reduces, starting now, how much of that already-scarce pool gets spent on assessments that don’t need to be full-scale. A bigger supply of assessors matters more if the demand hitting that supply is also being right-sized at the same time.

This pairing also reflects a theme that runs through Valor’s entire submission: the goal isn’t a lighter standard, it’s a better-matched one. Reserving full C3PAO assessment for the highest-risk contract work doesn’t mean lower-risk companies go unchecked; RPO review still provides independent verification. It means the most resource-intensive form of assessment gets applied where the underlying risk actually justifies it.

Guardrails Worth Keeping in View

Valor’s submission pairs its cost-reduction recommendations with a clear caution: any economies of scale created by these reforms should benefit companies doing the work with integrity, not companies gaming a lighter-touch model. That principle applies directly here. A tiered model only holds up if the criteria for which tier a company falls into are clear and consistently applied, and if the RPO review layer carries real substance rather than becoming a rubber stamp. Valor’s broader submission recommends pairing any cost relief with clearer, well-publicized False Claims Act consequences for false attestation, precisely so that lighter tiers of assurance don’t become an invitation to cut corners.

The Bigger Picture

Taken together with the cohort assessment model and the centralized DIB network, these two recommendations round out a fuller picture of how Valor’s submission approaches CMMC reform: reduce the cost of individual assessments, reduce the number of boundaries that need assessing, expand the pool of people who can do the assessing, and make sure the intensity of each assessment matches the actual risk involved. No single lever solves the problem. Pulled together, they represent a credible path toward a Defense Industrial Base that small and non-traditional businesses can actually afford to join.

Valor Cybersecurity will continue advocating for this and the other reforms outlined in our full submission to the CMMC Reform Task Force, and we remain available to provide further detail on any recommendation.

Valor Cybersecurity is a CMMC compliance and cybersecurity readiness company based in Norfolk, Virginia, serving defense manufacturers and shipyards across the Defense Industrial Base.