Get tomorrow's brief in your inbox
Today: Open-CMMC v2.0 tackles CUI-to-OT workflows over SMB, a contractor reported passing a third-party Level 2 assessment and receiving certification, and practitioners continue navigating CCP/CCA exam prep and FCI scoping questions.
Open-CMMC v2.0 extends CUI workflow protection to OT systems
A practitioner released Open-CMMC v2.0 (Apache-2.0 licensed CUI enclave for RHEL/Alma 9 FIPS) addressing a persistent gap: getting CUI from IT systems to operational technology (CNC machines, quality scanners, printers) that only read SMB shares. Most shop-floor OT has no secure CUI controls, and opening a CUI enclave to the LAN or relying on VLAN segmentation creates compliance risk. This release provides an open-source option that runs on a single local server, maintaining an IT-side CMMC-compliant file system while controlling CUI flows to OT devices. If your environment processes CUI and feeds it to legacy manufacturing equipment, review the project to see if it fits your threat model and SSP design. Mark this as a community tool, not vendor-supported infrastructure. Reddit thread
Contractor reports passing third-party Level 2 CMMC assessment
A practitioner posted that their organization passed a third-party Level 2 CMMC assessment and received certification. The post describes a 6-9 month build-out of a CUI enclave from an unfixable inherited environment, managed by a 4-person IT team supporting multiple subsidiaries. The company completed the assessment during the Phase 2 suspension period. This confirms that some C3PAOs are still conducting voluntary Level 2 (C3PAO) assessments despite the suspension of mandatory third-party requirements. If you are planning a future Level 2 (C3PAO) certification or want to get ahead of the Reform Task Force outcome, note that the assessment pipeline is still operational and contractors are moving forward. Expect the thread to surface implementation details and lessons learned. Reddit thread
FCI scoping question: do assessors check FCI environments during Level 2 assessments?
A practitioner asked whether C3PAO assessors examine Federal Contract Information (FCI) environments if the organization declares all Controlled Unclassified Information (CUI) is in a separate enclave. This reflects ongoing confusion about FCI vs. CUI scoping boundaries. The CMMC Assessment Guide scopes Level 2 assessments to the CUI environment, not FCI systems, but assessors may still review boundary controls and network diagrams to validate enclave separation. If your SSP relies on a strict CUI enclave, document FCI/CUI segregation clearly and be prepared to walk the assessor through the boundary. Do not assume FCI systems are invisible to the assessment. Reddit thread
CCP exam passed, practitioner seeks CCA prep recommendations
A Certified CMMC Professional (CCP) candidate passed the exam after 6 weeks of study focused on the CMMC Assessment Guide, Level 1 vs. Level 2 domain differentiation, FAR/DFARS clauses, the Cyber AB ecosystem, NARA, CAP, scoping, and COPC. They are now looking for Certified CMMC Assessor (CCA) prep guidance. If you are managing assessors or considering CCA certification, note the exam focus areas and expect the CCA track to go deeper on assessment methodology and evidence validation. The Cyber AB has not announced changes to the CCA program during the Phase 2 suspension, so the certification pathway remains active. Reddit thread