Get tomorrow's brief in your inbox
Today: Cyber AB CEO Matthew Travis outlined reform proposals including continuous monitoring and smaller assessment teams in response to the CMMC Reform Task Force RFI, DoW issued Revision 3 of its Class Deviation retaining the Phase 2 suspension while adding new supply chain and data protection clauses, and a PreVeil survey of 700+ DIB professionals confirmed 62% of contractors budgeted less than half the government's estimated certification cost.
Cyber AB submits reform recommendations to DoW Reform Task Force (task force review). CEO Matthew Travis told Federal News Network the Cyber AB's RFI response focuses on changes that could be implemented without new rulemaking: allowing C3PAOs to conduct delta assessments and continuous monitoring instead of full-point-in-time re-assessments, reducing the mandatory three-assessor team requirement to two for well-organized small companies, and streamlining the background investigation process that is bottlenecking assessor supply. Travis also flagged the "fraught with confusion" relationship between CMMC and FedRAMP as needing clarification. Action: These are proposals, not policy. No changes to current requirements. If you are planning a future Level 2 (C3PAO) assessment, track these recommendations; reduced team sizes and continuous monitoring would lower costs if adopted. Federal News Network
DoW Class Deviation Revision 3 retains Phase 2 suspension, adds new clauses (signed deviation, in force). The September 3 revision implements the new DFARS Part 240 (aligning with the Revolutionary FAR Overhaul) and retains Revision 2's instructions directing contracting officers to remove or revise C3PAO third-party assessment requirements from new and existing contracts and solicitations. The suspension does not affect the underlying obligation to comply with NIST SP 800-171 Rev 2. New in Rev 3: mandatory flow-down clauses prohibiting contractors from transferring covered PII of DoW employees (per NDAA FY2024 Sec. 803 and FY2025 Sec. 836), expanded UAS procurement bans (China, Russia, Iran, North Korea), and a tightened definition of "Chinese military company" limited to Section 1260H designees. Action: Review active contracts for updated DFARS clauses. The PII transfer restriction flows down to subcontracts; if you handle DoW employee data, verify your data handling agreements comply. Self-assessment under 800-171 remains your compliance obligation. Inside Government Contracts
Pentagon issues AI-assisted software development procedures (signed instruction, effective Sept. 8). CIO Kirsten Davies signed a 37-page instruction requiring that AI-generated code be treated as "unverified input," subject to the same security review and testing as manually written code. Developers remain fully accountable for AI-generated output. The instruction prohibits entering non-public DoW code, configuration scripts, or infrastructure documentation into unapproved generative AI tools. Components must maintain records of AI models and datasets used, analogous to an SBOM. Action: If you develop software for DoW contracts, update your development policies to reflect these requirements. AI code review obligations and the prohibition on using unapproved AI tools with government data will likely appear in flow-down language. Build your AI usage documentation process now. DefenseScoop
No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related False Claims Act cases appeared in today's collection. The DOJ feed was dominated by COVID loan fraud enforcement (Operation No Doze, $245M across 40+ districts), narcotics, and violent crime cases with no DIB nexus.
Standing reminder: With Phase 2 suspended, self-attestation plus the FCA remains the primary enforcement mechanism. Your SPRS (Supplier Performance Risk System) score is a legal statement. If your score does not reflect your actual implementation status, that is FCA exposure. Ensure your self-assessment is accurate and documented.
Travis confirms assessor supply bottleneck is a cost driver. The Cyber AB's RFI response identifies background investigation delays as a key constraint limiting the number of certified assessors entering the market. Fewer assessors means higher assessment costs passed to contractors. Travis argued that increasing supply would naturally drive costs down, and proposed streamlining the investigation process. Action: If you are waiting on a future C3PAO assessment, this bottleneck is not resolving quickly. Use the suspension period to complete your 800-171 implementation so you are assessment-ready when the pipeline reopens. Federal News Network
No new NIST SP 800-171 or 800-172 revisions in today's collection. The Class Deviation Revision 3 reconfirms that compliance with NIST SP 800-171 Revision 2 remains the operative standard during the Phase 2 suspension.
Army Directive 2026-19: commercial-first software acquisition (signed directive). The Army is prioritizing commercial software configured for military use over custom-built solutions, with CSOs (Commercial Solutions Openings) and OTAs (Other Transaction Authorities) as default solicitation vehicles. The directive requires continuous authorization to operate, reciprocity across Army organizations, and acceptance of vendor test data. Action: Software vendors serving Army contracts should frame proposals around proven commercial capabilities with clear configuration paths. Prepare for continuous ATO processes rather than one-time certifications. Companies unfamiliar with OTAs should invest in understanding non-FAR-based procurement terms, particularly data rights and IP implications. PilieroMazza
PreVeil survey: the affordability gap is widening (survey data, opinion marked). A survey of 700+ DIB professionals found that 62% budgeted under $50,000 for CMMC compliance, against DoW's own estimate of $101,752 for a small entity Level 2 certification. The share of contractors at the earliest compliance stage grew from 30% to 34% year over year. DIY compliance rose from 46% to 55% while MSP engagement dropped from 26% to 18%. Only 18% had completed a self-attestation. PreVeil's interpretation: new entrants are arriving faster than existing ones are finishing, and budget pressure is pushing companies to absorb compliance work internally. This data was collected before the July 2026 suspension. Action: If you are in the 34% just getting started, the suspension is not a reason to wait. Self-assessment under 800-171 is still required, primes are still flowing down requirements contractually, and the FCA applies to your SPRS score today. Use the suspension window to close gaps at lower cost before third-party assessments resume. PreVeil
PIEE access delays blocking self-assessments. A practitioner on r/CMMC reported being stuck in "Pending" status on PIEE (Procurement Integrated Enterprise Environment) for a month with no response from administrators or customer support. PIEE access is required for CMMC self-assessments. Action: If you are approaching a self-assessment deadline, start your PIEE account setup early. If stuck, escalate through your contracting officer or DCMA representative rather than relying solely on the PIEE help desk. r/CMMC
Cloud enclave vendor comparison. A practitioner is comparing Rimstorm (lower cost, ~60-day standup) against CyberSheath (higher cost, 9-12 month timeline) for a CUI enclave. No resolution in the thread yet. Action (opinion): Timeline and cost differences this large typically reflect scope differences: what is included in the base price, how much configuration is customer-owned, and what level of ongoing management is bundled. Get detailed SOWs from both vendors and compare apples to apples before deciding. r/CMMC