Get tomorrow's brief in your inbox
Today: The CMMC suspension continues to drive confusion among practitioners preparing for presentations and town halls, PreVeil published a comprehensive guide for international defense contractors navigating CMMC certification requirements, and two quantum computing executive orders set a 2031 deadline for federal post-quantum cryptography migration that will cascade into DIB contract requirements.
Quantum Computing Executive Orders Set 2031 PQC Migration Deadline President Trump signed two executive orders on June 22 directing federal agencies to migrate to post-quantum cryptography (PQC) by December 31, 2031, and targeting a commercially relevant quantum computer by 2028. The orders also require critical infrastructure operators, space systems, and defense agencies to adopt quantum-enabled sensors and communications within five years. No dedicated funding mechanism accompanies the mandates, creating pressure on mid-tier DIB contractors who will absorb compliance costs through flow-downs. Status: signed executive orders (in force). Action: begin inventorying cryptographic implementations in your environment now. Expect NIST-approved PQC algorithms to appear in future DFARS clauses and prime contractor flow-downs well before the 2031 deadline. The "harvest now, decrypt later" threat makes CUI-handling systems a priority target for early migration. (Federal News Network)
No cyber-related False Claims Act actions or Civil Cyber-Fraud Initiative settlements were announced today. The DOJ press release feed was dominated by firearms, drug trafficking, tax evasion, and healthcare fraud cases, none of which involve defense contractor cybersecurity attestation. The $2.6M PPP fraud settlement (Universal Environmental Services, a German subsidiary) involved COVID-era loan fraud, not cyber self-assessment. (DOJ)
The quiet day does not reduce attestation risk. With C3PAO assessments suspended and Level 2 self-assessment as the only active pathway, the FCA remains the primary enforcement lever. Every self-assessment score you submit to SPRS is a certification under penalty of law. Keep your SSP and POA&M current.
No new NIST SP 800-171 or 800-172 revisions published today. The PQC executive orders (above) will eventually drive updates to cryptographic requirements in 800-171 controls (SC.L2-3.13.8 and related). No action required yet, but track NIST's PQC standards finalization timeline alongside your SSP cryptographic inventory.
Claim Sponsorship in Federal Subcontracts: What DIB Subs Need in Their Agreements PilieroMazza published a detailed analysis of CDA claim sponsorship, the mechanism by which subcontractors pursue recovery for government-caused impacts through their prime contractor. Key points for DIB subcontractors: your subcontract must expressly require the prime to cooperate on claim preparation and presentation; define notice requirements, documentation standards, and cost allocation up front; and understand the Severin doctrine, which bars the prime from recovering on your behalf if the prime has been completely relieved of liability to you. This matters for CMMC-adjacent disputes: if a prime's flow-down of cybersecurity requirements causes you additional compliance costs due to a government-directed change, your subcontract's claim sponsorship provisions determine whether you can recover. Action: review your subcontract dispute clauses during your next contract review cycle. (PilieroMazza)
International Contractors: CMMC Certification Is Available but Complicated PreVeil published a guide covering CMMC for foreign-based defense contractors. The core takeaway: certification follows the CUI, not the company's headquarters. Canadian, UK, Australian, and other allied-nation suppliers handling CUI under DoD contracts must meet the same CMMC requirements as domestic companies. Additional challenges include data residency requirements, cross-border data transfer, and finding authorized C3PAOs willing to conduct international assessments (most currently operate in the US). Action for international subs: coordinate with your US prime to confirm the required CMMC level per contract, and begin evaluating cloud environments that satisfy both FedRAMP equivalency and local data sovereignty regulations. During the suspension, Level 2 self-assessment is the active pathway regardless of geography. (PreVeil)
Reddit: Consolidating Suspension Confusion for a Presentation A practitioner thread attempted to clarify what the Phase 2 suspension actually changes. The consensus: DoD paused mandatory Level 2 C3PAO assessments in new solicitations while the Reform Task Force reviews Phase II implementation. Acquisition officials must require Level 2 self-assessments instead. The underlying rule (32 CFR 170, DFARS 252.204-7021) was not repealed; DFARS 252.204-7012 and NIST 800-171 self-assessments remain in force; and primes can still contractually require third-party assessments from subcontractors as part of supply-chain risk management. If you are presenting to leadership or clients, frame it this way: the requirement is not gone, only the government-mandated third-party verification step is paused. (Reddit r/CMMC)
Reddit: ChatGPT Enterprise FedRAMP Capability Questions A practitioner reported 8+ weeks of conflicting responses from OpenAI support regarding whether ChatGPT Enterprise FedRAMP can accept and extract data from PDFs. No resolution posted. This signals a broader problem: FedRAMP-authorized AI tools in the DIB need clear documentation on data-handling capabilities before contractors can safely process CUI-adjacent content. Do not assume a FedRAMP authorization covers every feature of a product; verify the authorization boundary. (Reddit r/CMMC)
Reddit: Town Hall Anticipation Practitioners are watching an upcoming town hall (likely Cyber AB or DoD-related) for signals on the Phase 2 suspension timeline and potential policy shifts. No predictions posted beyond general excitement. Worth monitoring for any announcements that change the self-assessment status quo. (Reddit r/CMMC)