Get tomorrow's brief in your inbox
Today: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2 rollout, while the SBA publicly credited itself with pushing the Department of War into that suspension. Separately, the DFARS proposed rule expanding Foreign Ownership, Control, or Influence (FOCI) disclosure to unclassified defense contracts closed its comment period, and a bipartisan Senate bill would drop the disclosure threshold from $5 million to $500,000 in contract value. None of this touches your existing DFARS 252.204-7012 or NIST SP 800-171 self-assessment obligations, which remain in force.
DoD opens RFI on the post-suspension CMMC model; suspension itself is signed and in force. Alongside the July suspension of the CMMC Phase 2 third-party (C3PAO) phase-in, DoD posted a request for information (RFI) on SAM.gov asking industry how to cut compliance costs and administrative burden while keeping Controlled Unclassified Information (CUI) protected. This is task force review territory, not a new requirement. Do: if your company has an SSP (System Security Plan) or has been through an assessment cycle, submit RFI comments now while the process is genuinely open to input; watch the SAM.gov docket for the comment deadline. (Federal News Network, PilieroMazza, JD Supra via Google News)
SBA takes a public victory lap on the suspension. The SBA Office of Advocacy announced July 13 that it worked with industry groups, including PilieroMazza, to push DoW into suspending Phase 2 pending a cost-and-burden review. This is politics and framing, not new policy text, but it signals continued small-business pressure against reinstating a hard C3PAO mandate. Do: nothing required; useful context if you're drafting your own RFI comment or leadership briefing on why the pause happened. (PilieroMazza)
C3PAO pipeline in limbo, but Level 2 work should not stop. Practitioner discussion this week (opinion, not official guidance) argues the suspension is a Phase pause, not a Level pause: companies pursuing Level 2 (Self) still need the same 800-171 controls in place, they just cannot get third-party certified right now. One 20-year compliance veteran frames this as a normal cycle in validation frameworks, not a reason to stop documentation work. Do: if your team paused SSP and evidence-collection work assuming Level 2 was frozen, correct that internally; the controls requirement did not move, only the assessment pathway did. (Reddit r/CMMC - "The Day After")
Assessor/tooling economics still bite regardless of the pause. A contractor building toward Level 2 with under 50 endpoints flagged NinjaOne's $15K/year FedRAMP surcharge on top of standard RMM (Remote Monitoring and Management) licensing as a dealbreaker, pushing them toward an on-prem alternative instead. This is anecdotal, but it is a real data point on what FedRAMP-authorized tooling costs a small DIB (defense industrial base) shop compared to commercial equivalents. Do: if you're pricing GCC High (Microsoft Government Community Cloud High) or FedRAMP-authorized tooling for a sub-50-endpoint environment, budget for premium surcharges on top of list price, and get quotes for on-prem alternatives before committing. (Reddit r/CMMC)
FOCI disclosure rule comment period closed; Congress wants to go further. The DFARS proposed rule extending Foreign Ownership, Control, or Influence (FOCI) disclosure beyond classified contracts to unclassified work involving CUI and cybersecurity systems closed its public comment period July 6. It would apply to prime and subcontractor DoW contracts above $5 million, affecting an estimated 40,000 entities, with a carve-out for commercial items unless a senior DoW official flags a national-security risk. Separately, Senators Warren and Grassley introduced a bill June 1 that would drop the disclosure threshold to $500,000 and redefine "beneficial owner" under Title 10 rather than SEC rules. This is proposed rule plus pending legislation, not current law. Do: if you hold or bid on DoW contracts in the $500K-$5M range and have any foreign ownership, investment, or board involvement, start tracking this now; a $500K threshold would sweep in far more small and mid-size DIB contractors than the current $5M line. Watch both the DFARS case and the FY2027 NDAA conference process. (Covington Inside Government Contracts)
SMBs split on wait-and-see versus continuing to build evidence. A r/CMMC thread asks small and mid-size contractors what they're actually doing during the 60-day review: some are pausing engagement with RPOs (Registered Practitioner Organizations) and C3PAOs, others are continuing SSP documentation and evidence collection regardless of the assessment freeze. No consensus in the thread, but the split itself is the signal: contractors who keep building evidence now avoid a scramble whenever Phase 2 resumes. Do: keep collecting POA&M (Plan of Action and Milestones) and control-implementation evidence even if you've paused formal C3PAO engagement; that work does not expire when the pause lifts. (opinion/discussion) (Reddit r/CMMC)
CUI markings are inconsistent, and that does not change your obligation. A contractor reported receiving a USAF task order with no CUI marking from an office that "habitually marked everything CUI." Missing markings do not mean data isn't CUI; contract clauses and DFARS 252.204-7012 govern the obligation independent of marking hygiene on any single document. Do: if a task order arrives without expected CUI markings, confirm with the contracting officer rather than assuming the requirement dropped; document the inquiry for your file. (opinion/discussion) (Reddit r/CMMC)
Microsoft won't commit to end-to-end encryption guarantees in GCC for EAR-controlled data. A practitioner flagged that Microsoft declines to endorse putting Export Administration Regulations (EAR)-controlled data into standard GCC (Government Community Cloud), even with Customer Lockbox and customer-managed keys enabled, because Microsoft itself can't guarantee full end-to-end encryption in that tier. This matters for any DIB contractor treating GCC as sufficient for export-controlled or CUI-adjacent data without a documented boundary. Do: if your SSP scopes GCC (not GCC High) as your CUI enclave, get Microsoft's boundary commitments in writing and confirm with your RPO whether GCC High is actually required for your data types. (opinion/discussion) (Reddit r/CMMC)
"Claude for Government" raises FedRAMP-authorization questions practitioners can't answer yet. A thread asks whether Anthropic is an approved entity for CMMC Level 2 environments, referencing marketing claims tied to a FedRAMP High boundary via Palantir's cloud. No one in the thread had a definitive answer. Do: before letting any team member near an LLM tool inside a CUI boundary, confirm the actual FedRAMP authorization (not marketing language) and whether the specific deployment model, not just the vendor name, carries that authorization. (opinion/discussion) (Reddit r/CMMC)