CMMC Brief

Today: Federal News Network published analysis on the False Claims Act trap in CMMC self-attestation, Covington flagged proposed NDAA data-rights legislation that could reshape contractor IP protections, and an Armenian RYUK ransomware operator was sentenced to federal prison in a case that underscores DOJ cyber enforcement priorities.

Policy & Rulemaking

Proposed NDAA "Right to Repair" Provisions Would Default Contractor Technical Data to Government Purpose Rights

Congress is advancing FY2027 NDAA provisions that would make Government Purpose Rights the default for technical data, computer software, and documentation delivered under DoW contracts. Contractors wanting more restrictive rights would need to prove their case by "clear and convincing evidence," a significant burden shift. This goes well beyond equipment repair access; it broadly affects rights to contractors' internally funded technology. (Covington)

• Status: Proposed legislation (NDAA FY2027 consideration), not yet enacted.
• Action: Review your current DFARS 252.227-7013/7014 marking and assertion practices now. If this passes, contractors who fail to properly identify and mark restricted data at proposal time will lose rights they currently retain by default. Brief your contracts and IP counsel. Companies relying on dual-use commercial technology in defense programs face the most exposure.

SBA Extends Comment Period on Small Business Size Standards to November 20

SBA pushed the deadline 60 days for its proposed overhaul affecting 338 industry groups. Over 2,100 comments submitted so far, most opposing. A net increase of 114,000+ firms eligible for small-business status would reshape competitive dynamics in DIB set-asides. (Covington)

• Status: Proposed rule, comment period open through November 20, 2026.
• Action: If your NAICS code is affected, submit comments before the new deadline. Small DIB primes and subs should model whether the revised thresholds change their size status or competitive positioning for set-aside contracts.

Enforcement & False Claims

Federal News Network: The Hidden FCA Trap in CMMC Self-Attestation

With the Phase 2 C3PAO assessment pathway suspended, self-attestation under CMMC Level 1 and Level 2 (Self) is the only active compliance path. Federal News Network published analysis on how the False Claims Act creates legal exposure for contractors who self-attest to NIST 800-171 compliance without adequate documentation. During the suspension, DOJ's Civil Cyber-Fraud Initiative remains the enforcement center of gravity, not third-party assessors. (Federal News Network)

• Action: If you have submitted or plan to submit a CMMC Level 2 self-assessment score to SPRS, ensure your SSP accurately reflects implemented controls, not aspirational ones. POA&M items must be genuine remediation plans with timelines, not placeholders. An inflated SPRS score is a False Claims Act liability. Brief your CISO and legal counsel on attestation risk.

RYUK Ransomware Operator Sentenced to Federal Prison

An Armenian national extradited from Ukraine was sentenced for his role in RYUK ransomware attacks targeting U.S. companies, including firms in Oregon. (DOJ)

• DIB relevance: RYUK and its successors have historically targeted defense supply chain companies. This sentencing signals continued DOJ willingness to pursue international ransomware operators. For DIB contractors, this is a reminder that your incident response plan and NIST 800-171 control family IR (Incident Response) are not optional checkboxes. If ransomware hits and your 800-171 controls were not actually implemented as attested, the FCA exposure compounds the operational damage.

Contracting Impact

Data Rights Legislation Bears Watching for Subcontractors

The proposed NDAA data-rights changes (see Policy & Rulemaking above) would flow through prime contracts to subcontractors. If enacted, primes will likely push compliance burden downstream. Subcontractors who develop technology with mixed funding or incorporate COTS components into defense deliverables should start documenting funding sources and IP assertions more rigorously now, regardless of whether the legislation passes. The trend toward expanding government data rights is clear.

• Action: Audit your current technical data deliverables list and rights assertions on active contracts. Ensure your proposal process captures funding-source documentation for all deliverables. This protects you under current DFARS and positions you if the rules shift.

Practitioner Pulse

Thin Collection Day, but the Signal Is Clear

Today's feed pull returned 32 articles, but only 4 had direct CMMC/DIB relevance. The DOJ firehose delivered its usual volume of criminal cases (drug trafficking, firearms, fraud) with no new Civil Cyber-Fraud settlements. No new r/CMMC threads scored above the relevance threshold.

The absence of new C3PAO or Reform Task Force developments is itself the story: the suspension holds, self-assessment remains the only pathway, and FCA enforcement remains the lever. Contractors waiting for clarity on when (or whether) C3PAO assessments resume should not treat the pause as a compliance holiday. The controls in NIST 800-171 Rev 2 are still contractually required under DFARS 252.204-7012, and every self-assessment score in SPRS is a representation the government can test under the False Claims Act.

• Action: Use the quiet period to close POA&M items, validate your SPRS score against actual implementation, and ensure your SSP is audit-ready. When the suspension lifts, whether that means C3PAO assessments resume or a revised framework emerges, contractors with genuine compliance will be positioned to move. Those who treated self-attestation as a paper exercise will not.