Today: A Federal News Network interview with early CMMC Level 2 adopter IntelliGenesis highlights the real costs of certification and the frustration small contractors face after DoD suspended Phase 2, while DSCA's expansion of Foreign Military Financing to 52 countries for direct commercial contracts creates new export pathways that still carry DFARS and CUI compliance obligations.
Policy & Rulemaking
- CMMC Phase 2 suspension remains in effect; no new rulemaking this cycle. There are no new Federal Register notices, memos, or Reform Task Force developments today. 32 CFR 170 and DFARS 252.204-7021 remain on the books; DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting) is still enforceable. Self-assessment under NIST SP 800-171 is still required. The C3PAO assessment pathway is frozen pending the Reform Task Force review. Action: No changes to your compliance posture today. Continue maintaining your NIST 800-171 self-assessment, SSP (System Security Plan), and SPRS (Supplier Performance Risk System) score.
Enforcement & False Claims
- No new cyber-related FCA cases today. The DOJ press release feed is dominated by immigration, firearms, and drug trafficking cases with no connection to defense contractor cybersecurity attestation. The Civil Cyber-Fraud Initiative remains the primary enforcement mechanism during the Phase 2 suspension, but no new settlements, qui tam (whistleblower) actions, or cyber-fraud complaints were announced. Action: No immediate action, but the enforcement posture has not changed. If your self-assessment score does not match your actual implementation, you remain exposed to FCA liability.
Contracting Impact
- DSCA expands Foreign Military Financing for direct commercial contracts to 52 countries. DSCA issued policy guidance implementing the Consolidated Appropriations Act of 2023, expanding FMF eligibility from 10 countries to all 32 NATO members and 19 Major Non-NATO Allies. This means more foreign buyers can finance direct commercial purchases from U.S. defense contractors without routing through the FMS (Foreign Military Sales) government-to-government channel. Taiwan's eligibility is arguable under a separate statutory authorization. (Covington analysis)
-
DIB compliance angle: Direct commercial contracts with foreign buyers still require ITAR (International Traffic in Arms Regulations) export licenses, and contractors handling CUI (Controlled Unclassified Information) in connection with these contracts remain subject to DFARS 252.204-7012 and NIST 800-171 requirements. If your company pursues DCC opportunities with newly eligible countries, ensure your SSP scope covers any CUI generated or handled in those transactions. Action: Brief your BD and export compliance teams. If you are pursuing international defense sales, verify your CUI handling procedures cover DCC workflows.
-
War Data Platform core integration contract ($821M to Accenture Federal Services) draws scrutiny. DoD's Chief Digital and AI Office awarded a single-source task order via GSA Alliant 2 for the War Data Platform (formerly Advana), the enterprise data and analytics backbone that integrates 700+ data sources for AI-driven warfighter decisions. Critics question whether a "traditional cost-plus consultancy" can deliver the mission-focused transformation the rebranding promised. (DefenseScoop)
- DIB relevance: WDP/Advana integration touches data flowing from contractors into DoD analytics systems. Subcontractors providing data feeds or integration services to CDAO programs should watch for flow-down cybersecurity requirements tied to this contract vehicle. Action: If your company feeds data into DoD enterprise analytics platforms, monitor for updated security requirements in task order modifications.
Practitioner Pulse
- IntelliGenesis interview surfaces the real cost of early CMMC Level 2 certification. Angie Lienert (IntelliGenesis CEO) and Jeremiah Jensen detailed their experience pursuing C3PAO-assessed Level 2 certification before it was required. Key takeaways from the Federal News Network interview: the team wrote 50+ policy and procedure documents, migrated CUI to GCC High, and worked seven days a week for four months. They moved early because primes were "threatening to remove businesses from the team" without certification. When DoD suspended Phase 2, Lienert described deep frustration at the investment made against a requirement that is now on hold. (Federal News Network)
- What this means for you: The certification itself is not wasted; IntelliGenesis still holds a validated NIST 800-171 implementation that satisfies the self-assessment requirement and gives them a competitive edge when primes evaluate subcontractor risk. But the interview underscores a real tension: the government encouraged early adoption, industry invested heavily, and the pause creates uncertainty about whether the C3PAO pathway will resume in its current form.
-
Action: If you have already achieved Level 2 certification, maintain it. Your assessment evidence supports your SPRS score and reduces FCA risk. If you have not started, continue building toward full NIST 800-171 implementation (self-assessment pathway) rather than waiting for the C3PAO phase-in to resume. Primes are still flowing down cybersecurity requirements contractually regardless of the Phase 2 freeze.
-
NIST publishes OT remote access security guide for water/wastewater sector. While not DIB-specific, NIST's new operational technology remote access guidance reflects the agency's continued focus on securing remote connections to critical infrastructure. Defense contractors with OT environments (manufacturing floors, test ranges, SCADA systems) should note the principles; CISA and DoD have historically adopted NIST OT guidance into supply chain security expectations. (Federal News Network)
- Action: If your company operates OT systems that process defense work, review NIST's remote access recommendations against your own OT segmentation and access controls. No compliance mandate today, but expect primes with OT supply chains to reference this guidance in future flow-downs.
Thin day for CMMC-specific developments. The IntelliGenesis interview is the most actionable item: it validates that early movers are frustrated but not worse off, and that primes are enforcing cybersecurity requirements contractually even without the C3PAO mandate. The FMF expansion is worth flagging for contractors with international sales exposure. No new enforcement actions, rulemaking, or Cyber AB announcements.