Get tomorrow's brief in your inbox
Today: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review, SBA commended the move after months of small-business pressure, and contractors learned that DFARS 7012 self-assessments plus False Claims Act enforcement remain fully in force during the suspension.
DoD suspended CMMC Phase 2 C3PAO requirements (signed policy). On July 13, 2026, the Department of War suspended the CMMC Phase 2 third-party assessment requirements originally scheduled to take effect November 10, 2026, and launched a 60-day Reform Task Force review. Only Level 1 (Self) and Level 2 (Self) designations are allowed during the suspension; contracting officers are amending active contracts to remove C3PAO designations. The CMMC rule itself (32 CFR 170, DFARS 252.204-7021) was not repealed, DFARS 252.204-7012 and NIST 800-171 self-assessments remain in force, and primes can still flow down certification requirements contractually. PreVeil, PilieroMazzo
SBA commended the suspension after small-business pressure (signed policy). The Small Business Administration issued News Release 26-73 yesterday commending DoD's decision, following "months of engagement between the DOD, SBA, and small business stakeholders" who warned that Phase 2 imposed "costly bureaucratic burdens" driving small contractors out of the defense industrial base. The suspension aims to "recalibrate the CMMC program so it preserves strong cybersecurity while eliminating regulatory barriers." Action: If you paused CMMC prep work, restart your Level 2 (Self) self-assessment now - self-attestation is the active pathway, and the False Claims Act is the enforcement lever. PilieroMazzo
Trump EO mandates AI-assisted supply-chain mapping for all national-security acquisitions (signed policy). A new executive order issued this week directs the Secretary of Defense to develop policy within 180 days requiring all prime contractors and subcontractors to submit a complete indentured bill of materials tracing all components, parts, equipment, and software back to raw-material origins for acquisitions "that support, implicate, or relate to United States national security." Contractors must implement risk-assessment procedures and proactively vet suppliers; DoD may use AI to map vulnerabilities and bottlenecks. Waiver requests under 10 U.S.C. 4872(c)(1) or (e) must include a formal mitigation plan; knowingly misleading the government or failing to implement an approved plan triggers fraud penalties. Action: If you hold or bid on national-security contracts, prepare for new supply-chain-transparency requirements by Q1 2027; start documenting your software supply chain now. DefenseScoop
DoD class deviation implements Chinese-military-company covered-lobbyist prohibition (signed policy, limited detail). A July 16, 2026 class deviation (revised from June 29) implements Section 851 of the FY 2025 NDAA, codified at 10 U.S.C. § 4663, which took effect June 30, 2026. The deviation prohibits defense contractors from retaining outside consultants designated as "covered lobbyists" associated with Chinese military companies. The deviation implements the prohibition as part of the Revolutionary FAR Overhaul (RFO) but does not provide definitions beyond the legislative text or guidance on a key safe-harbor provision. DoD abandoned formal DFARS rulemaking (Case 2025-D0007) in favor of this class deviation. Action: Review your consulting and lobbying relationships for China-nexus ties; the definition ambiguity leaves enforcement risk unclear. Covington
Federal News Network commentary argues for software-sovereignty requirements in defense procurement (opinion). Amanda Phelps, a strategic advisor at Coder, argues that "America-first" manufacturing should extend to the software supply chain, defining software sovereignty as four pillars: code written on U.S.-controlled infrastructure, runs on government-owned servers, U.S.-sourced and auditable toolchains, and no dependency on foreign SaaS/cloud services. The SHIPS Act restricts where ships are built but imposes no requirements on where the software running those ships is developed. "A modern destroyer is a software platform that happens to float," Phelps writes, noting that combat-system code can be pushed from a laptop syncing to a commercial cloud build server in a foreign region with no sovereign boundary. This is commentary, not policy, but expect similar arguments in future rulemakings. Federal News Network
No cyber-related False Claims Act settlements today. The DOJ press feed included a $1.175M PPP-fraud settlement by a defense-sector stainless-steel supplier (Matrix Metals LLC, Stafford-based), but the case involves pandemic-loan fraud, not cybersecurity or CMMC self-attestation. DOJ
Action: With Phase 2 suspended, self-attestation plus FCA enforcement is the compliance center of gravity. If your SPRS score knowingly misrepresents your compliance, the False Claims Act exposure is the same today as it was on July 12. Do not treat the suspension as a compliance holiday.
No Cyber AB or C3PAO announcements today. The PreVeil webinar recap (published July 2026 but covering a year of assessments before the suspension) confirms that C3PAO assessment economics and POA&M rules are now frozen during the Reform Task Force review. Contractors planning future Level 2 (C3PAO) certifications should monitor the task force's 60-day timeline for guidance on when the third-party pathway will resume and under what rules.
No NIST 800-171/172 revisions today. The PreVeil recap confirms that POA&M rules locked down before the suspension: only one-point controls are eligible, contractors must already be 80% compliant (88/110), and they have 180 days to close the gap including reassessment time. These rules remain in force for self-assessments. Action: If you are building a POA&M for your Level 2 (Self) assessment, hit 88/110 first or the POA&M is invalid.
Contracting officers began inserting CMMC requirements in Q4 2025, then suspended C3PAO designations in July 2026 (signed policy). The PreVeil recap notes that 48 CFR took effect November 10, 2025, and contracting officers began writing CMMC requirements into new awards. The July suspension triggered amendments to remove C3PAO designations from active contracts, but Level 2 (Self) requirements remain. Action: Review solicitations and contract modifications issued after November 2025 for CMMC clauses; confirm whether your contracts were amended to remove C3PAO language or still require Level 2 (Self).
Scoping, documentation, and MSPs are the assessment killers (practitioner analysis). PreVeil's recap of hundreds of CMMC assessments identifies three failure patterns: contractors failing to reduce scope (Virtual Desktop Infrastructure is now officially recognized for taking endpoints out of scope if implemented correctly), poor documentation (accurate System Security Plans aligned with real-world configurations are the assessment centerpiece), and MSP in-scope creep (if your MSP can access CUI and isn't certified, you are paying for two assessments). Tom Tolerton, Principal at Forvis Mazars, warns: "If your MSP touches CUI and isn't certified, guess what? You're now paying for two assessments." Action: Define technical and contractual boundaries to keep MSPs classified as "security protection assets" and away from CUI; treat your SSP as the centerpiece of your self-assessment and keep it aligned with actual configurations. PreVeil