Today: No new CMMC rulemaking or enforcement actions dropped today. The acquisition restructuring wave continues with Air Force completing its PAE consolidation, and practitioners are trading notes on Group Policy hardening for Level 2.
Policy & Rulemaking
No new CMMC-specific policy actions today. The Phase 2 (C3PAO) suspension remains in effect pending the Reform Task Force review. 32 CFR 170 and DFARS 252.204-7021 are not repealed. DFARS 252.204-7012 safeguarding requirements and NIST 800-171 self-assessment obligations remain in force.
What to do: Continue maintaining your SSP and POA&M against NIST 800-171 Rev 2. If you have not submitted your self-assessment score to SPRS, that obligation is current and enforceable regardless of the C3PAO suspension.
Contracting Impact
- Air Force completes PAE acquisition overhaul. All Air Force program executive offices have been consolidated into 17 portfolio acquisition executive (PAE) organizations, including a new PAE for cyber and networks. PAEs now hold cradle-to-grave authority over programs in their mission area, replacing the fragmented PEO structure. For DIB contractors, this means a single decision-maker per mission portfolio with broader authority to set requirements and timelines. Expect solicitation language and evaluation criteria to shift as PAEs exercise new delegation authorities. (DefenseScoop)
What to do: If you hold or pursue Air Force contracts in cyber, networks, or electronic systems portfolios, identify the relevant PAE. Relationship mapping matters more now that authority is concentrated.
- PilieroMazza weekly update flags several contracting developments. Key items: (1) The Court of Federal Claims confirmed jurisdiction over SBIR Phase III procurement disputes in Strategi Consulting v. United States, expanding bid protest options for SBIR contractors. (2) Space Force is shifting to "minimum viable capability" with 18-24 month delivery windows, favoring speed over maturity. (3) An ASBCA decision in Jaxon Construction reminds contractors that the government must meet its burden of proof before a default termination; it cannot simply point to performance problems. (4) DISA is seeking industry input on migrating combatant command IT services to the DoD network. (PilieroMazza)
What to do: SBIR participants with Phase III disputes now have clearer protest standing at the Court of Federal Claims. Contractors bidding USSF work should adjust proposals for rapid delivery timelines. If you face a default termination threat, document the government's own performance obligations carefully.
- Presidential Determination adds recoverable critical minerals to Defense Production Act list. On July 30, the President added recoverable critical minerals and materials as items necessary to promote national defense. This expands DPA Title III authorities for these materials. (PilieroMazza)
What to do: DIB suppliers in the critical minerals supply chain should monitor for new DPA-backed contracts and funding opportunities.
Practitioner Pulse
- r/CMMC: GPO hardening for Level 2. A practitioner who built out Group Policy Objects (GPOs) for enterprise-wide CMMC Level 2 compliance is asking the community what admins most commonly overlook. This is a practical thread for anyone using Active Directory to enforce 800-171 controls. Common blind spots in GPO-based compliance include: audit policy gaps (especially advanced audit policy vs. legacy audit policy conflicts), incomplete account lockout settings, unrestricted PowerShell execution policies, and missing screensaver/session lock enforcement. (r/CMMC)
What to do: If you are using GPOs to implement 800-171 controls, audit your policies against the NIST 800-171A assessment objectives, not just the control families. Pay particular attention to AC-2 (account management), AU-2/AU-3 (audit events and content), and SC-7 (boundary protection) where GPO misconfigurations are most common.
Sections omitted today (no relevant articles): Enforcement & False Claims, Cyber AB & Ecosystem, NIST & Standards.