CMMC Brief

Today: A new FCA cybersecurity settlement reinforces that DOJ is actively enforcing self-attestation compliance even during the CMMC Phase 2 suspension, CISA's upcoming CIRCIA final rule will stack new incident reporting deadlines on top of DFARS 7012 obligations for defense contractors, and CCA exam candidates are flagging quality problems in training courses as the assessor pipeline sits in limbo.

Policy & Rulemaking

CIRCIA Final Rule Expected This Month; DIB Contractors Face Overlapping Reporting Obligations CISA plans to publish the final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September 2026, imposing 72-hour incident reporting and 24-hour ransomware payment notification deadlines across 16 critical infrastructure sectors. CISA estimates over 300,000 entities could fall under the rule's scope, and many defense contractors will be covered based on their sector role or supply chain position, not just headcount. The practical problem for DIB companies: CIRCIA obligations will stack directly on top of existing DFARS 252.204-7012 72-hour reporting requirements and evidence preservation duties, with different definitions, thresholds, and recipients. Reporting to CISA will not satisfy DFARS, and vice versa. (Federal News Network)

• Status: Final rule expected September 2026; enforceable deadlines likely late 2026 or early 2027.
• Action: Map your current DFARS 7012 incident response playbook against CIRCIA's draft definitions now. Identify who makes the CISA notification, confirm it is a separate workflow from your DC3 report, and brief your IR team on the parallel obligations before the rule hits the Federal Register.

Enforcement & False Claims

New FCA Cybersecurity Settlement Signals DOJ Keeps Foot on the Gas Another False Claims Act cybersecurity settlement confirms DOJ's Civil Cyber-Fraud Initiative remains the primary enforcement mechanism during the CMMC Phase 2 suspension. With third-party C3PAO (Certified Third-Party Assessment Organization) assessments frozen, the government's leverage point is the self-attestation: if you submitted an SPRS (Supplier Performance Risk System) score or made compliance representations in contract proposals, DOJ can and will test those claims under the FCA. The pattern is now consistent across multiple settlements in 2025-2026. (The National Law Review / Google News)

• Status: Signed settlement (enforcement action, not rulemaking).
• Action: Audit your current SPRS score against your actual implementation. If your SSP (System Security Plan) or POA&M (Plan of Action and Milestones) has items that have been "in progress" for months without movement, that gap is exactly what qui tam relators and DOJ investigators target. Document remediation timelines and hold to them.

Former Army Soldier Pleads Guilty to Transmitting National Defense Information A Hillsboro, Oregon man pleaded guilty to conspiracy to gather and transmit national defense information. Not an FCA case, but a direct insider threat reminder for cleared contractors. (DOJ)

• Action: Review your insider threat program and CUI (Controlled Unclassified Information) access controls. NIST 800-171 control families 3.1 (Access Control) and 3.10 (Physical Protection) are the relevant SSP checkpoints.

Cyber AB & Ecosystem

No significant Cyber AB or C3PAO ecosystem developments today. The assessment pipeline remains frozen pending the Reform Task Force review. C3PAO businesses continue to wait.

Contracting Impact

Air Force Stands Up 'Megatron' IDIQ for Battle Network Acquisitions The Air Force is establishing a multi-award IDIQ contract vehicle called Megatron to accelerate procurement for the DAF Battle Network and C3BM (Command, Control, Communications and Battle Management) capabilities. The vehicle is designed to support multiple appropriation types and acquisition pathways, including commercial solutions and continuous software delivery. A draft statement of work was posted in August; the Air Force is soliciting industry feedback now. (DefenseScoop)

• Status: Draft SOW posted; acquisition strategy still being defined.
• Action: If you provide C2, networking, sensor integration, or software capabilities to the Air Force or Space Force, review the special notice and provide feedback. Expect DFARS 252.204-7012 and potentially CMMC Level 2 (Self) requirements in the final solicitation. Companies positioning for task orders under this vehicle should have their SPRS score current and SSP audit-ready.

U.S.-India RDPA Negotiations Advancing; OCI Risks in GovCon M&A Two legal analysis articles flag procurement and compliance considerations for defense contractors. The U.S.-India Reciprocal Defense Procurement Agreement would open Indian defense markets to U.S. firms and vice versa, potentially adding supply chain complexity and export control considerations. Separately, a detailed PilieroMazza analysis of organizational conflicts of interest in GovCon M&A warns buyers that acquisitions can create OCI problems that restrict the combined company's pipeline, even when neither entity had issues independently. (Inside Government Contracts) (PilieroMazza)

• Action: For RDPA, monitor for new DFARS clauses or flow-down requirements if the agreement concludes. For M&A, evaluate OCI and cybersecurity compliance posture together during diligence; inheriting a target's SPRS score and SSP gaps is a real liability.

Practitioner Pulse

CCA Exam Candidates Frustrated with Training Quality An r/CMMC post reports significant dissatisfaction with a CCA (Certified CMMC Assessor) training course: inconsistent instructor guidance, material focused on memorization over practical understanding, and a practice exam that does not align with the actual assessment methodology. The poster is looking for alternative prep resources beyond the official scoping guides, CAP, and CMMC assessment guides. (r/CMMC)

• Context: With the Phase 2 C3PAO phase-in suspended, the CCA pipeline is in an awkward position: candidates are investing in certification for a role that has no active demand. Training providers have less incentive to invest in quality when the market is frozen. This is worth watching. If the Reform Task Force restores Phase 2, the rush to get certified assessors online will expose whoever skimped on training quality.
• Action (for aspiring assessors): Stick to primary sources. The CMMC Assessment Process (CAP), NIST SP 800-171A assessment procedures, and the scoping guides are the authoritative material. Third-party courses vary wildly; vet instructors' actual assessment experience before paying.