Get tomorrow's brief in your inbox
Today: Federal agencies are debating whether commercial technology acquisition policies can coexist with CUI protection requirements, the CyberAB confirmed fraudulent Level 2 certifications are circulating and provided verification guidance, and practitioners continue to surface confusion over FIPS requirements and boundary enforcement for CUI enclaves.
CUI requirements creating commercial technology access tension across federal agencies. Federal News Network reports that DoD's CMMC program suspension signals concern that cybersecurity requirements may limit access to the defense industrial base. The article frames the debate as part of a larger struggle between agencies wanting commercial innovation and the reality that government procurement comes with unique requirements including cyber controls, trade policy, and socioeconomic obligations. GSA is working on government-wide CUI rules (FAR Part 40) while DoD pursues CMMC as a mission-specific implementation of the same underlying NIST standards. The commercial technology community is pushing back on fragmentation. Read more
What to do: If you're tracking the Reform Task Force review, this signals the review scope extends beyond CMMC mechanics to the broader question of whether strict cyber requirements are pricing DoD out of commercial innovation. Watch for potential relaxation of CUI handling requirements or a push to harmonize FAR Part 40 and CMMC. No immediate action required, but brief leadership that the suspension is part of a wider policy fight.
CyberAB warns fraudulent Level 2 certifications are circulating, provides verification path. At this week's CyberAB Town Hall, officials confirmed fraudulent Level 2 CMMC certifications are a concern and provided guidance for primes vetting subcontractors. The verification method: request a PDF export of the sub's SPRS entry. The CyberAB also clarified that the Reform Task Force review extends beyond CMMC to Pentagon-wide issues including cost, agility, resilience, automation, and small business burden. Fraudulent certs remain a risk even during the Phase 2 suspension because primes can still require certification contractually. Read more
What to do: If you're a prime vetting subs for CMMC compliance, do not rely on verbal attestations or contractor-provided "certificates." Request a SPRS PDF export showing the sub's self-assessment score and any recorded certifications. If you're a sub, be prepared to provide that export on request.
FIPS compliance confusion continues for CUI enclaves. A Reddit thread surfaced a common misunderstanding: a contractor deploying a commercial product into a government cloud enclave for CUI workflows was told the "entire deployment" must be FIPS-validated to achieve "100% compliance." The poster questioned whether FIPS applies to the entire system or just the cryptographic boundary protecting CUI. This reflects ongoing confusion about where NIST 800-171 control boundaries apply. FIPS 140-2/140-3 validation is required for cryptographic modules protecting CUI at rest and in transit (SC.L2-3.13.11), not for every component in the environment. Read more
Outbound firewall scoping questions for cloud-only GCC-High environments. A practitioner running a cloud-only GCC-High deployment with Intune-managed Windows laptops and no on-prem servers asked how granular outbound firewall rules need to be for SC.L2-3.13.6 (boundary protection). The poster noted inbound was straightforward but questioned whether outbound requires per-app rules, a short port list, or something in between. NIST 800-171 does not mandate a specific granularity, but assessors typically look for documented justification for what is allowed outbound and evidence that the boundary is monitored. In a cloud-only environment, endpoint firewall plus Azure/M365 egress logging is the compensating control for lack of edge filtering. Read more
CNC machine access control raises OT network CUI boundary questions. A manufacturer reported that while they restrict who can pull drawings from network drives, once a drawing is loaded onto a CNC machine, it becomes accessible to anyone at the machine. This is a classic OT (operational technology) problem: CUI data at rest is controlled, but CUI in use on the shop floor is not. NIST 800-171 AC.L2-3.1.1 (access control) and AC.L2-3.1.22 (control public information) both apply. Practical mitigations include physical access controls for the machine area, role-based HMI (human-machine interface) lockouts, or air-gapping CUI-processing machines from general shop floor networks. Document the residual risk and the mitigation in your SSP. Read more
What these signal: Practitioners are still struggling with boundary enforcement in non-traditional environments (cloud-only, OT, edge devices). If you're advising clients or preparing for assessment, focus on documenting why a control is scoped the way it is and what compensating controls exist. "We followed vendor defaults" is not an acceptable answer.