Get tomorrow's brief in your inbox
Today: Practitioners report confusion about Level 2 self-assessment vs C3PAO timelines during the suspension, the Senate CR extends key cyber information-sharing authorities through December, and an ASBCA decision underscores the government's burden before issuing pre-completion default terminations.
The Senate Appropriations Committee's continuing resolution would extend two cybersecurity authorities through Dec. 11: the Cybersecurity Information Sharing Act of 2015 (CISA 2015) and the Federal Cybersecurity Enhancement Act of 2015. CISA 2015 provides liability protections that underpin voluntary information sharing between defense contractors and government on cyber vulnerabilities and threats. The Trump administration's GOLD EAGLE AI vulnerability-sharing program depends on these protections. A lapse would freeze that collaboration during the middle of the CMMC suspension when self-attestation plus FCA enforcement is the primary compliance mechanism. Watch the Senate-House CR negotiations; the House version does not include the CISA extension. Source
Default termination burden: The ASBCA ruled in Jaxon Construction, Inc. that the government must prove a contractor was unlikely to finish within the time reasonably available before issuing a pre-completion default termination. Performance problems alone are not enough; the Army failed to show no reasonable prospect of completion when the record supported a winter suspension and spring resumption. The Board also rejected an anticipatory repudiation claim where the contractor continued submitting documentation and proposed a weather-adjusted schedule rather than refusing performance. For DIB contractors facing cure notices during the suspension, this reinforces that requesting additional time is not repudiation and the government must still prove impossibility of timely completion. Document all progress, propose realistic revised schedules, and force the contracting officer to make the case. Source
Space Force acquisition shift: General Saltzman's "minimum viable capability" push means USSF procurements will increasingly favor rapid prototyping (18-24 months) over fully mature solutions. Expect more OTAs, Commercial Solutions Openings, Middle Tier Acquisition authorities, and Software Acquisition Pathway use. For DIB contractors, this means proposals should demonstrate speed, adaptability, and proven commercial capability over customization. CMMC Level 2 self-assessments and POA&Ms become a competitive differentiator when the acquisition timeline is compressed and cyber compliance can't delay delivery. Align your SSP with agile delivery models; overly rigid proposals lose. Source
A compliance manager interviewing for a role reports the org "needs L2 by Nov" but wasn't clear whether that means final C3PAO assessment or just a POA&M and SPRS score. With three months until November and the C3PAO phase-in suspended, this is a common confusion point. During the suspension, only Level 1 (Self) and Level 2 (Self) designations are allowed. A November "L2" requirement most likely means a self-assessment (System Security Plan, POA&M, SPRS score of 110 submitted to SPRS portal) unless the prime is contractually flowing down a future C3PAO requirement. Clarify with the hiring manager what the contract actually requires and whether the prime is imposing stricter-than-DFARS terms. If it's self-assessment, three months is tight but doable if the org has already scoped its CUI and started the SSP. If they haven't, that's a red flag. Source
Another practitioner asked where to get reliable CMMC updates, citing daily checks of the DoW CIO and Cyber AB sites and hearing rumors the suspension may lift "with minimal to no changes" but finding no confirmation. The official sources remain the DoD CIO CMMC page and Cyber AB announcements; Federal Register for rulemaking; and the Reform Task Force when it publishes. Rumors without sourcing should be ignored. As of today, the suspension is in force, the task force has not published findings, and no Federal Register notice has proposed lifting it. Continue planning for self-assessment compliance and False Claims Act attestation risk. Source