Get tomorrow's brief in your inbox
Today: Former DoD CMMC executives published a pointed defense of the program during the Phase 2 suspension, warning that contractors are openly abandoning compliance efforts while adversaries continue targeting the defense supply chain. Separately, a DHS inspector general report found CISA lacks enforcement authority over its own binding operational directives, with 86% of agencies missing cloud security deadlines, a finding that underscores why DoD built CMMC with its own verification mechanism rather than relying on voluntary compliance.
Former CMMC Leaders Publish Defense of Program During Suspension Stacy Bostjanick (former DoD CMMC executive) and Tara Lemieux (Army veteran, SIGINT officer) published a commentary arguing the CMMC program must continue despite the Phase 2 suspension. Their core points: (1) contractors are publicly stating on Reddit they are "not spending another penny" on compliance since the C3PAO phase-in was paused, projecting to adversaries that the DIB is standing down; (2) government and industry have collectively invested millions, with small businesses budgeting $20,000-$50,000 annually; (3) DoD inspector general and cyber readiness reports confirm that without a validation component, many companies ignore existing DFARS 252.204-7012 requirements. Status: opinion/advocacy, not policy action. The CMMC rule (32 CFR 170) remains in force; the C3PAO assessment phase-in remains suspended pending Reform Task Force review; self-assessment under DFARS 7012 and NIST SP 800-171 is still mandatory. - Federal News Network - Action: No new requirements, but this signals continued political support for CMMC from former program leadership. If your organization paused compliance work, reconsider: self-attestation is still enforceable under the False Claims Act (FCA), and the rule was not repealed. Maintain your SSP (System Security Plan) and POA&M (Plan of Action and Milestones) current.
IG Report: 86% of Agencies Missed CISA Cloud Security Deadlines; CISA Cannot Enforce Its Own Directives A DHS inspector general audit found that 86% of federal civilian agencies failed to implement CISA's SCuBA (Secure Cloud Business Applications) secure configuration baselines by the June 2025 deadline. The report's key finding: "CISA lacks the authority necessary to require full and timely implementation of Binding Operational Directives." Former CISA officials noted there are effectively no consequences for non-compliance. Status: published IG report (not rulemaking), but directly relevant to DIB compliance strategy. - Federal News Network - Action: This report illustrates exactly why DoD built CMMC with contract-enforceable verification rather than relying on voluntary directive compliance. For DIB contractors: (1) if your organization uses Microsoft 365 or other cloud services to process CUI (Controlled Unclassified Information), review CISA's SCuBA baselines as a supplementary reference for your NIST 800-171 cloud controls; (2) expect primes to cite findings like this when tightening flow-down language around cloud security configurations, even during the C3PAO suspension.
Former Soldier Sentenced to 70 Months for Telecom Hacking and Extortion Cameron John Wagenius, 22, a former Army soldier, was sentenced to 70 months in prison and $294,978 in restitution for conspiring to hack telecommunications databases, access sensitive records, and extort companies by threatening to release stolen data. While not a False Claims Act case, this sentencing reinforces that DOJ is actively prosecuting insider threats who compromise sensitive communications infrastructure. - DOJ Press Release - Action: DIB contractors should review insider threat programs and access controls, particularly for personnel with privileged access to communications systems. NIST 800-171 control 3.1.2 (limit system access to authorized transactions and functions) and the personnel security family apply directly. Document your insider threat program in your SSP.
Contractors Openly Abandoning Compliance During Suspension The Bostjanick/Lemieux commentary specifically calls out that contractors are posting on social media (including r/CMMC) that they are halting all CMMC compliance spending. This tracks with a trend visible in practitioner forums since the July 2026 suspension announcement. Opinion: this is a dangerous miscalculation. The suspension paused C3PAO assessments, not the underlying requirements. DFARS 252.204-7012 is in every relevant contract today. NIST 800-171 self-assessment scores must still be reported in SPRS (Supplier Performance Risk System). A contractor who stops maintaining controls and later self-attests compliance is making a false statement subject to FCA enforcement, which DOJ's Civil Cyber-Fraud Initiative has already used to extract multimillion-dollar settlements. - Action: Do not confuse a pause in third-party assessments with a pause in requirements. Continue maintaining controls, updating your SSP, and reporting accurate SPRS scores. The FCA is the active enforcement mechanism during the suspension, and qui tam (whistleblower) relators are watching.
Thin day for CMMC-specific news. The 28 collected articles were dominated by unrelated DOJ criminal cases (drug trafficking, firearms, immigration). The Bostjanick/Lemieux commentary and the CISA enforcement-authority finding are the substantive items. No new rulemaking, no new FCA settlements, and no Cyber AB announcements today.