Get tomorrow's brief in your inbox
Today: No policy developments, enforcement actions, or ecosystem announcements. Reddit commentary surfaces vendor certification confusion, Katie Arrington's criticism of the CMMC pause, and reaction to reported F-35 parts diversion.
CAD vendor certification requirements for CUI handling. A 30-person machine shop planning to outsource 200 CUI-marked drawings asked r/CMMC which vendor certifications matter. ISO 9001, AS9100, ITAR registration, and CMMC all address different risks. For CUI work, CMMC Level 2 (currently Self during the suspension) or evidence the vendor is meeting NIST 800-171 controls is the compliance baseline; AS9100 and ISO 9001 are quality frameworks, not cybersecurity standards. Beyond the certificate, ask how files are transferred (encrypted channels), where they are stored (FedRAMP Moderate cloud or 800-171-compliant enclave), and who has access (need-to-know enforcement, background checks for foreign nationals). If the vendor cannot demonstrate 800-171 controls or provide a current SPRS score, the CUI should not leave your environment. Source
Katie Arrington calls CMMC pause "negligent" in podcast appearance. Former DoW CIO Katie Arrington, credited as the primary architect of the CMMC program, described the July 2026 third-party assessment suspension as negligent and compared reliance on self-assessments to ignoring cancer. The remarks, posted to r/CMMC, represent the most direct public criticism from Arrington since the Reform Task Force announcement. During the suspension, only Level 1 (Self) and Level 2 (Self) pathways are allowed; the CMMC rule (32 CFR 170) and DFARS 252.204-7021 remain on the books, DFARS 252.204-7012 self-assessments are still mandatory, and primes can still flow down certification requirements contractually. The Reform Task Force has not published a timeline for recommendations. Source
F-35 parts reportedly diverted to China via Hong Kong. A Reddit post linking to reports of F-35 components diverted to Hong Kong and allegedly taken into Chinese possession drew the comment "CMMC would have prevented this." The specifics of the diversion (export controls vs supply-chain compromise vs procurement fraud) are not detailed in the thread. CUI and export-controlled technical data protections under NIST 800-171 and ITAR apply to contractors handling controlled information; physical supply-chain integrity (parts provenance, custody, and final destination) is governed by separate DFARS clauses, customs enforcement, and export licensing. If CUI-marked technical data enabled the diversion, 800-171 failures could support a False Claims Act case; if the issue was procurement fraud or export violations, criminal statutes apply. Source