Get tomorrow's brief in your inbox
Today: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about underlying NIST 800-171 obligations, PSC member companies report continuing C3PAO assessments voluntarily, and the RFI comment deadline of August 14 gives contractors a narrow window to shape what comes next.
CMMC Phase 2 suspended, but 800-171 obligations unchanged (task force review, not a repeal). DoD suspended the Phase 2 third-party certification rollout pending a Reform Task Force review. The suspension affects only the requirement for C3PAO assessments; it does not touch DFARS 252.204-7012, NIST SP 800-171 compliance, or Phase 1 self-assessment requirements. Contractors must still self-certify under penalty of perjury that they implement required security controls. As attorney Eric Crusius noted: "The CMMC program is just a certification program on top of the security controls that are still required and will be required." Phase 2 was not scheduled to begin until November anyway, so the practical near-term impact is limited, but the signal matters. - Federal News Network - Federal News Network
Action: Do not slow down 800-171 implementation. Self-attestation remains legally binding and FCA-enforceable. If you are mid-assessment with a C3PAO, the consensus from PSC members is to finish it; the investment is already made and a compliance regime will return in some form.
RFI comments due August 14. The Reform Task Force has issued a request for information from industry and the public. Responses are due before the 60-day review concludes. PSC's Stephanie Kostro urged contractors to submit feedback on what works, what does not, and what requirements are "potentially superfluous to cybersecurity." - Federal News Network
Action: Submit RFI comments by August 14. If your company has specific pain points with assessment scope, control interpretation, or cost burden, this is the window to get them on record. Coordinate through your trade association if applicable.
No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related False Claims Act cases appeared in today's collection. The DOJ press releases in this batch involved drug trafficking, weapons, immigration, and other matters unrelated to defense contractor cybersecurity compliance.
Standing guidance: The FCA remains the primary enforcement lever during the Phase 2 suspension. Self-attestation under CMMC Phase 1 carries penalties of perjury. Any contractor who attests to 800-171 compliance without actually implementing the controls is exposed to qui tam whistleblower suits and DOJ enforcement. The absence of new cases today does not reduce the risk; DOJ has consistently signaled that cyber-fraud is an active enforcement priority.
PSC members continuing C3PAO assessments despite suspension. Every contractor PSC spoke with who was mid-assessment is completing the process. Their rationale: sunk costs, good governance, and certainty that a compliance regime will return. This signals that the C3PAO pipeline is not collapsing, but new assessment starts may slow while the Task Force review plays out. - Federal News Network
Risk to watch: Crusius reported anecdotal evidence of some companies (not his clients) already saying "let's see if we actually have to put these security controls in." If this attitude spreads, it creates a two-tier market: companies that maintained compliance and can bid immediately when requirements return, and companies that will face months of catch-up. Primes paying attention will note who kept their house in order.
Primes can still flow down certification requirements contractually. The suspension applies to DoD's CMMC program office approval process for including CMMC in solicitations. It does not prevent prime contractors from requiring subcontractor compliance via contract terms. Expect flow-down language to continue referencing 800-171 and potentially voluntary C3PAO certification. - Federal News Network
GSA's revised AI acquisition clause (watch item for DIB). GSA revised its proposed LLM-focused acquisition clause after industry pushback. The new version narrows scope to contracts where government data is processed by large language models, excludes embedded commercial AI (word processors, navigation), and replaces the broad "American AI systems" mandate with more flexible language. This is not a CMMC requirement, but DIB contractors using AI in contract performance should track it; if GSA finalizes the clause, DoD adoption or parallel rulemaking is likely. - Federal News Network
Action: Review any active solicitations for updated CMMC or cybersecurity language. Monitor SAM.gov for amendments referencing the suspension or revised assessment timelines.
No notable r/CMMC threads or practitioner analysis surfaced in today's collection.
The key practitioner question right now: Should I keep spending on 800-171 implementation during the suspension? The answer from every expert interviewed this week is unambiguous: yes. The controls are still legally required under DFARS 7012, self-attestation is enforceable under the FCA, and the suspension only affects whether a third party checks your work. Stopping now is a compliance and legal risk, not a cost savings.
Brief generated 2026-07-22. Sources: Federal News Network (3 articles), DefenseScoop. 34 articles reviewed; 30 excluded as not relevant to DIB compliance.