Get tomorrow's brief in your inbox
Today: The DoW CMMC Reform Task Force submitted its report to the CIO on September 11 (not yet public), DoW issued a broad acquisition reform memo targeting CAS coverage and compliance burdens, and practitioners continue navigating derived CUI workflows under the Phase 2 suspension.
CMMC Reform Task Force submitted its report; recommendations not yet public. The Task Force convened in early September to review the 1,100+ RFI comments generated after the July Phase 2 suspension. The report was due to DoW CIO Kirsten Davies on September 11, 2026, but has not been released. At the Billington Cybersecurity Summit on September 9, Davies said more than half the comments supported the suspension, assessor concerns focused on how DoW will verify compliance without third-party C3PAOs, and DoW is reviewing both possible roll-backs (e.g., limiting third-party assessments) and potential expansions (e.g., operational technology security). The Task Force's recommendations will be the first clear signal of how DoW balances reducing compliance burdens against closing security gaps. Source: Covington Inside Government Contracts
What to do: Monitor for the Task Force report release. If your compliance roadmap assumes Phase 2 third-party assessments will resume on a specific timeline, revise it to reflect uncertainty. Self-assessment (CMMC Level 2 Self, DFARS 252.204-7012, NIST SP 800-171 Rev. 2) remains the requirement until further notice. DoW has emphasized continued enforcement through self-assessments and selected DoW-led assessments during the suspension.
DoW issued a broad acquisition reform memo targeting CAS coverage, pricing, and administrative burden. Deputy Secretary of War Stephen Feinberg issued a memorandum on September 14, 2026, directing DoW to shift away from the Cost Accounting Standards (CAS) and increase reliance on Generally Accepted Accounting Principles (GAAP). The memo directs DoW to submit proposals to the CAS Board within 60 days to make CAS exemption the default and confine remaining CAS coverage to "sole-source, cost-based development or incentive-fee procurement." The memo also directs a "class exemption" request so CAS applies only to "cost-based development contracts of major scale awarded without adequate price competition," with coverage attaching to the contract and relevant indirect-cost pools, not to the entity or segment. Additional reforms include accelerating OTA use, limiting audits, streamlining business system reviews, and increasing commercial contracting. Source: Covington Inside Government Contracts
What to do: If your business is currently CAS-covered, watch for the CAS Board's response to DoW's proposal. The proposed changes would require significant revisions to both CAS regulations and the FAR, and the CAS Board has authority to issue class-wide waivers but the proposal may conflict with the CAS statute's intent (CAS currently applies to "all" contracts above $35 million, subject to exemptions). If implemented, this would represent a major shift in cost accounting requirements for defense contractors. For CMMC-related compliance, this does not change your cybersecurity obligations, but it signals DoW's broader appetite for reducing government-unique requirements and increasing reliance on commercial practices.
Derived CUI workflow question: Do small parts extracted from Statement D blueprints require CUI handling? A r/CMMC user asked whether derived drawings created from Air Force, Navy, and DLA blueprints marked with Statement D (export-controlled, treated as CTI/CUI) must be handled as CUI when only a small portion of the original drawing is used to manufacture a component. The original blueprints are not formally marked as CUI but carry export warning statements (Statement D), which triggers CUI handling. The derived drawing will move around the shop floor as a physical print. Source: Reddit r/CMMC
What to do: If your manufacturing workflow involves extracting portions of government-furnished data to create shop-floor work instructions or component drawings, treat derived documents as CUI if the source data is CUI or export-controlled (Statement D, ITAR, EAR). DFARS 252.204-7012 paragraph (b) requires contractors to "provide adequate security" for covered defense information, and paragraph (m) addresses CUI flow-down to subcontractors. Even if the derived drawing contains only a small subset of the original data, it is still derived from CUI and must be handled accordingly (marking, encryption at rest and in transit, access controls, incident reporting). Document your CUI derivation and marking procedures in your System Security Plan (SSP). If you are uncertain whether specific technical data qualifies as CUI, consult the contracting officer or the government program office; do not assume unmarked data is uncontrolled if it carries export restrictions.