Get tomorrow's brief in your inbox
Today: The r/CMMC community is working through FIPS 140-3 validation requirements and GCC-High migration logistics, while the White House signed a presidential memorandum authorizing contracted private-sector offensive cyber operations against transnational criminal organizations, a program DIB contractors should monitor for potential flow-down implications.
FIPS 140-3 Validation: What DIB Contractors Need to Know
An r/CMMC thread surfaces a common practitioner question: how to obtain FIPS 140-3 (Federal Information Processing Standard for cryptographic module validation) certified products, and whether using a vendor whose product is already validated (e.g., Rubrik) satisfies the requirement. The short answer: FIPS 140-3 validation attaches to the cryptographic module, not the end customer. If your vendor's product uses a FIPS 140-3 validated module and you deploy it in approved mode, you inherit that validation. You do not need your own certificate. Check NIST's CMVP (Cryptographic Module Validation Program) list to confirm your vendor's module is current, and document the validated module version in your SSP (System Security Plan). If you are evaluating backup or encryption vendors, confirm they run validated modules, not just "FIPS-compliant" ones; the distinction matters for NIST SP 800-171 control 3.13.11.
Action: Verify your encryption and key management products appear on the NIST CMVP validated modules list. Update your SSP to cite specific module names and certificate numbers.
Commercial-to-GCC-High Migration: Practitioner War Stories
A practitioner running a 40-user migration from Microsoft 365 Commercial to GCC-High (the Microsoft cloud environment required for CUI handling under DFARS 252.204-7012) reports they skipped third-party migration tools due to minimal SharePoint/Teams data and are now tackling mailbox migration via PST export/import plus MDM (Mobile Device Management) enrollment. This is a common small-org approach, but comes with risks: PST migrations can lose folder permissions and retention labels, and manual MDM re-enrollment means a window where devices are unmanaged. Practitioners in the thread are sharing alternative workflows. Opinion: for orgs under 50 users with minimal SharePoint, PST export is pragmatic, but document the gap period in your POA&M (Plan of Action and Milestones) and ensure Intune enrollment is completed before users access CUI in the new tenant.
Action: If you are planning a GCC-High migration, document your migration method, identify any compliance gaps during transition, and track device re-enrollment in your POA&M.
White House Authorizes Private-Sector Offensive Cyber Operations
President Trump signed a national security presidential memorandum establishing a government-run program contracting with private companies to conduct offensive cyber operations against transnational criminal organizations. The program will be co-led by DHS and DOJ executive directors, with operations conducted under federal supervision and authority. This is not "hack back" authorization for individual companies; participants must be approved and operate under government direction. For DIB contractors: this does not change your CMMC obligations, but watch for two downstream effects. First, if your company provides cybersecurity services, the program could create new contract vehicles. Second, expect primes and contracting officers to start asking about offensive capability and vetting during subcontractor evaluations, particularly for companies working cyber-adjacent DoD contracts. The liability framework is still being defined.
Action: No immediate compliance action required. MSPs and MSSPs serving the DIB should track this program's implementation for potential contract opportunities and liability implications.
No CMMC-specific policy, rulemaking, or Reform Task Force developments today. The Phase 2 C3PAO suspension remains in effect. DFARS 252.204-7012 and NIST SP 800-171 self-assessment requirements remain in force. No new Federal Register notices relevant to 32 CFR 170 or DFARS 252.204-7021.
No DOJ Civil Cyber-Fraud Initiative activity or cyber-related False Claims Act cases today. The 30 DOJ press releases in today's feed were general criminal matters (violent crimes, drug trafficking, immigration) with no connection to defense contractor compliance or cyber attestation fraud.
No Cyber AB statements or C3PAO ecosystem developments today.