Get tomorrow's brief in your inbox
Today: Honeywell settled a $2M False Claims Act case for failing to implement NIST 800-171 controls on a DoD contract, the 60-day CMMC Phase 2 suspension pause period ended with no announced next steps, and practitioners are wrestling with FIPS-validated encryption requirements for browser-based CUI access.
60-Day Suspension Review Period Ends, No Public Guidance Yet September 12 marks the end of the 60-day window following DoD's July 13 suspension of CMMC Phase 2 (C3PAO assessments). As of today, no new memo, Federal Register notice, or Reform Task Force announcement has been published. The suspension remains in effect until DoD acts. What is still in force: DFARS 252.204-7012, NIST 800-171 self-assessment obligations, SPRS score submissions, and cyber incident reporting. What is not: no third-party (C3PAO) assessments are being scheduled or required. Action: Do not treat the end of the 60-day window as a deadline that changes your obligations. Continue maintaining your SSP, POA&M, and SPRS score. Watch for a Reform Task Force announcement, likely next week. (r/CMMC discussion) Status: Task force review (no new signed policy).
White House Quantum Executive Orders Set PQC Migration Deadlines President Trump signed two executive orders directing accelerated migration to post-quantum cryptography (PQC). Federal agencies must transition high-value key establishment to PQC by 2030, digital signatures by 2031, with a pilot program due December 31, 2027. The Federal Acquisition Regulatory Council is directed to hold covered contractors to federal cybersecurity standards by end of 2030. DIB contractors should expect PQC requirements to flow down through DFARS and contract clauses within the next few years. Action: Begin inventorying your cryptographic implementations now. If you handle CUI, your SSP will eventually need to document PQC readiness. This is not yet a contract requirement for most DIB contractors, but primes working classified programs should start planning. (Federal News Network) Status: Signed executive orders. FAR Council rulemaking to follow.
Honeywell Pays $2M to Settle NIST 800-171 Noncompliance Allegations Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to implement NIST SP 800-171 security controls required under DFARS 252.204-7012 from April 2020 through December 2023. The case originated from a qui tam whistleblower. Key context: DOJ cybersecurity FCA settlements totaled $52 million in FY2025, more than triple the prior year. With C3PAO assessments suspended, the FCA is the primary enforcement mechanism for NIST 800-171 compliance. Self-attestation carries real legal exposure.
Action: Audit your SPRS score against your actual control implementation. If your score claims controls you have not fully implemented, you have FCA exposure right now. Review subcontractor flow-downs; Honeywell's obligations extended to subs handling covered defense information. Brief leadership on the acceleration of cyber-FCA enforcement. (Fox Rothschild analysis) Status: Settlement finalized.
No new Cyber AB announcements or C3PAO market developments today. The ecosystem remains frozen pending the Reform Task Force outcome. C3PAOs and Registered Practitioners should monitor for post-60-day guidance.
No new NIST SP 800-171/172 revisions or CUI guidance published today.
DoD Multi-Model AI Migration Signals Vendor Diversification Expectations DoD is 90% complete migrating classified AI workloads away from Anthropic, with full transition expected by end of September. Under Secretary Emil Michael emphasized the risk of single-vendor dependency. While this is an AI procurement story, the principle applies to DIB cybersecurity tooling: contracting officers increasingly expect vendor diversification and supply chain resilience. Contractors relying on a single security vendor for CMMC compliance tooling should note the department's direction. (DefenseScoop)
Browser FIPS Validation for CUI Access: No Easy Answer An r/CMMC thread highlights a persistent pain point: how to satisfy FIPS 140 encryption requirements (NIST 800-171 control 3.13.11) when users access CUI through a web browser. The server side can use FIPS-validated TLS, but mainstream browsers (Chrome, Firefox, Edge) do not use FIPS-validated cryptographic modules. Practitioner consensus points toward VDI solutions (Citrix, AWS WorkSpaces, PreVeil) as the cleanest path, with technical controls blocking direct browser access to the CUI service. Opinion: This is one of the most common "last mile" compliance gaps. If your SSP says you enforce FIPS-validated encryption for CUI in transit and your users access it from a standard browser, your documentation does not match your implementation. That gap is exactly the kind of discrepancy a qui tam relator notices. (r/CMMC)
60-Day Pause Thread: Practitioners Watching, Not Expecting The r/CMMC community notes the 60-day mark with measured expectations. Most practitioners anticipate no announcement before Monday at the earliest. The prevailing sentiment: continue operating under current requirements (self-assessment, DFARS 7012, SPRS) and do not pause compliance work waiting for clarity. Opinion: This is the right posture. The suspension removed the C3PAO requirement; it did not create a compliance holiday. (r/CMMC)