Get tomorrow's brief in your inbox
Today: DoW CIO Kirsten Davies signaled at Black Hat that the Phase 2 hold may be termed a "pause" rather than a "suspension" and that upcoming solicitations could benefit organizations already holding C3PAO-issued Level 2 certifications. Meanwhile, practitioners are debating FedRAMP requirements for VOIP voicemail systems storing CUI and the economics of migrating to GCC High.
DoW CIO Kirsten Davies provided an update on the CMMC Phase 2 status during a Black Hat fireside chat on August 8. The program is being referred to internally as a "pause" rather than a "suspension," and upcoming solicitations are expected to include some form of benefit or award consideration for organizations that completed Level 2 (C3PAO) certification before the July 13 hold. Source
Action item: If you already hold a C3PAO-issued Level 2 cert, watch for solicitation language referencing prior certification as an evaluation factor or award preference. Contracting officers now have explicit DoW direction to recognize the investment you made before the pause. If you're mid-assessment, the comment suggests completed certs may still carry weight even though new C3PAO assessments are not currently allowed under the suspension (or "pause," depending on which term sticks).
VOIP voicemail and FedRAMP scope creep. An assessor is reportedly requiring FedRAMP Moderate for VOIP systems that store CUI voicemail, escalating to FedRAMP High if ITAR or EAR-controlled information is in play. Source
This is opinion masquerading as requirement. NIST SP 800-171 applies to CUI in any system, including voicemail, but 800-171 compliance does not automatically trigger FedRAMP. FedRAMP is a cloud service authorization framework for systems processing federal information; it is not a per-se requirement unless the contract or agency specifically mandates it. If your VOIP provider is already FedRAMP Moderate (many are), you satisfy the requirement by contract flow-down. If not, you satisfy 800-171 via your SSP controls for the system storing the voicemail (access control, audit, media protection, etc.). Push back on assessors conflating 800-171 with FedRAMP unless the solicitation explicitly requires FedRAMP authorization for the service.
GCC High migration economics. A 100-person organization received a quote of $300,000 in migration costs plus $400 per user annually to transition from Google Workspace to Microsoft 365 GCC High. Source
The per-user annual license fee ($400/year) is in line with GCC High pricing (roughly $35/user/month for E3 equivalent). The $300,000 migration cost is high but not outlandish for a 100-seat organization if it includes data migration, configuration, training, and post-migration support; that works out to $3,000 per user for the one-time transition. Whether it's justified depends on data volume, custom integrations, and how much hand-holding the migration vendor is providing. Get at least two competing quotes. Some vendors will bid the migration as a loss leader to win the recurring GCC High resale margin.
For context: GCC High is not a CMMC requirement. It satisfies DFARS 252.204-7012 and 800-171 for cloud email and collaboration, but so does any FedRAMP Moderate or equivalent service. Google Workspace does not offer a FedRAMP Moderate environment, so DIB contractors using it for CUI are out of compliance unless they've implemented compensating controls (not realistic for SaaS email). GCC High is the path of least resistance for Microsoft shops, but it is not the only compliant path. Evaluate your CUI footprint before committing to the migration cost; if CUI never touches email or SharePoint, you may not need GCC High at all.