Get tomorrow's brief in your inbox
Today: The CMMC Reform Task Force held its first meeting Thursday and will report by late September, DoD is planning listening sessions for contractor feedback, and PreVeil published a comprehensive guide to False Claims Act enforcement showing $51.8M in cybersecurity-related settlements last year.
CMMC Reform Task Force launches with first meeting, 60-day review timeline begins. DoD CIO Kirsten Davies confirmed the task force met Thursday (July 17) across from her office at the Pentagon. The review has 60 days to gather feedback and analyze the program, then 15 days to synthesize recommendations for a public report expected by late September. Davies described this as a "soup-to-nuts" review examining CMMC alongside NIST 800-171, DFARS requirements, and the cyber threat landscape. Outcomes range from "an overhaul to small tweaks," and the task force includes leadership from A&S, I&S, OCIO, general counsel, public affairs, legislative affairs, SBA, and the White House. The report will be made public when complete. DefenseScoop, Federal News Network
DoD planning listening sessions nationwide to gather contractor input. In addition to the RFI published earlier this week, DoD will hold in-person listening sessions across the country specifically targeting small businesses, cybersecurity operators, and Cyber AB/C3PAO community feedback. Davies emphasized the goal is to "incorporate the voice of small companies to make sure we are truly reducing barriers to entry for them to do business with DoD." No dates or locations announced yet. Watch for details on DoD CIO social channels and the Cyber AB newsletter if you want a seat. Federal News Network
Under Secretary Duffey issued memo directing removal of C3PAO requirements from active solicitations. This is the administrative follow-through on the Phase 2 suspension. Contracting officers are pulling third-party assessment language from live RFPs that referenced the November 10 deadline. Level 2 (Self) requirements remain in force. If you submitted a proposal referencing a C3PAO cert timeline, expect amendment notices or reach out to the contracting officer proactively to confirm what still applies. Federal News Network
Class deviations or interim rules could accelerate changes post-review. Legal analysts (Sandeep Kathuria, Saul Ewing) note the administration has used class deviations and interim rulemaking in other areas to move fast without full notice-and-comment cycles. If the task force recommends structural changes, expect DoD to issue implementation guidance within weeks rather than waiting for a new final rule. That means your November planning window could shift again in October. Federal News Network
PreVeil analysis: False Claims Act cybersecurity settlements hit $51.8M in FY2025, up 233% year-over-year. This is now the enforcement center of gravity during the Phase 2 suspension. Self-assessment scores submitted to SPRS are certifications to the federal government. If your score doesn't match what's running on your network and you keep billing, you have FCA exposure. DOJ's Civil Cyber-Fraud Initiative (launched October 2021) pursues contractors who misrepresent cybersecurity posture, deliver deficient security products, or fail to report incidents. Treble damages and per-claim penalties apply whether DOJ sues directly or a whistleblower files qui tam. PreVeil
LOGZONE Inc. settled for $507,144 (June 2026) after Navy contracts ran on systems scoring -170 in SPRS. The Huntsville contractor failed to implement required NIST 800-171 controls on two Navy contracts from 2021-2025. DCMA assessment put the actual score near the bottom of the -203 to 110 range. Whatever LOGZONE told the Navy didn't match reality. This case is a reminder: DCMA can audit your SSP at any time under existing DFARS clauses, suspension or not. If you've been "planning to fix" that -50 score, the clock is running. PreVeil
Georgia Tech Research Corporation settled for $875,000 (September 2025) after submitting a campus-wide SPRS score for a lab with no antivirus and no SSP. GTRC's Astrolavos Lab ran DoD cyber-defense research for years with zero endpoint protection. When reporting time came, GTRC submitted a 98-out-of-110 score that DOJ called "fictitious" because it referenced a campus environment unrelated to any system processing covered defense information. Two whistleblowers from Georgia Tech's own cybersecurity team split $201,250 of the recovery. If you're using an enterprise-wide score to cover a CUI enclave that doesn't actually meet the controls, this is your risk profile. PreVeil
Aero Turbine / Gallant Capital Partners: $1.75M settlement (July 2025) shows M&A compliance liability flows to acquirers. Acquiring a defense contractor means acquiring its compliance history, not just its backlog. Due diligence on CMMC posture and historical SPRS accuracy is now a standard M&A checklist item. If you're buying a DIB company, demand SSP documentation, DCMA assessment records, and proof the submitted SPRS scores match actual control implementation. PreVeil
Raytheon / Nightwing: $8.4M settlement (May 2025) for running ~30 DoD contracts on networks non-compliant with DFARS 252.204-7008, 252.204-7012, and FAR 52.204-21. Nightwing was held liable as Raytheon's successor for conduct predating the acquisition. This is the same M&A successor-liability principle as Aero Turbine but at prime-contractor scale. If you're a subcontractor on a Raytheon/Nightwing contract, this settlement signals the prime is now hypersensitive to flow-down compliance. Expect audits. PreVeil
Health Net Federal Services / Centene: $11.25M settlement (February 2025) for falsely certifying compliance with security controls in TRICARE contract. HNFS certified at least seven controls it wasn't actually meeting. This case maps onto any health-adjacent defense IT work (DHA, TRICARE, VA). The FCA applies whether your contract is weapons systems or claims processing. Check your SSP against what's live, not what you plan to deploy. PreVeil
Live CMMC solicitations show Level 2 (Self) requirements remain in force; C3PAO references under review. PreVeil maintains a running list of SAM.gov postings citing CMMC. Recent examples include Air Force's "Grand Challenge - Relentless Wolfpack" (July 14, Level 2 verified status in SPRS required), SOCOM's Air Vehicle Computer RFI (July 14, originally requiring C3PAO cert, now under review), and Army's DAQ Electronics solicitation (July 10, Level 2 Self). If your SPRS score isn't current or accurate, you're ineligible for these awards today. The suspension didn't pause self-assessment requirements. PreVeil
Contracting officers authorized to include CMMC since November 10, 2025. Phase 1 (self-assessment) has been flowing into solicitations for eight months. If you haven't started on CMMC compliance because you were waiting for the C3PAO requirement, you misread the timeline. The vast majority of current solicitations require Level 2 (Self), which is DFARS 252.204-7012 + a logged SPRS score. Check SAM.gov attachments for buried CMMC clauses; they don't always appear in the main solicitation text. PreVeil
PreVeil's False Claims Act guide is the most practitioner-focused breakdown published this year. It walks through how DFARS 252.204-7012 maps to FCA liability, explains qui tam mechanics, and provides case-by-case analysis of recent settlements with dollar figures and fact patterns. If you're briefing leadership on why CMMC still matters during the suspension, this is your deck. The guide also covers what happens when you acquire a defense contractor (successor liability) and why campus-wide scores don't protect lab-specific CUI enclaves. Direct, blunt, and actionable. Bookmark it. PreVeil
Matt Travis (Cyber AB CEO) quoted in PreVeil's solicitation tracker: "If you haven't started getting engaged in CMMC, now is the time. It was probably the time in early 2024, but now the light is flashing red." This quote ran in the context of live solicitations requiring Level 2 (Self). The Cyber AB has no enforcement authority, but Travis is correct that the self-assessment pathway is live and contracts are being awarded under it. The suspension bought time for contractors who were planning C3PAO assessments; it did nothing for contractors who haven't implemented 800-171 controls or submitted an SPRS score. PreVeil
DoD CIO Davies described current CMMC assessments as "burdensome, red-tape ridden, check-the-box, point-in-time view" during press tour. This language signals the department's posture heading into the review. Davies hasn't said whether third-party assessments disappear entirely, but the framing is clear: DoD sees the C3PAO model as overhead that doesn't map to actual security outcomes. If you're a C3PAO or assessment org, the next 60 days will determine whether your business model survives in its current form. If you're a contractor, this suggests the final framework will lean toward continuous monitoring or commercial security solutions rather than snapshot audits. Federal News Network
This brief covers developments through 2026-07-18. For updates, see carolinacleartech.com/cmmc-brief.