Get tomorrow's brief in your inbox
Today: NIST post-quantum cryptography standards continue driving federal migration timelines that will flow into DFARS and CUI protection requirements, the CIRCIA final rule approaches with harmonization promises relevant to DIB dual-reporting burdens, and PilieroMazza published practical guidance on FOCI documentation that cleared contractors should review now.
CIRCIA final rule expected this fall, with harmonization focus. National Cyber Director Sean Cairncross confirmed the Office of the National Cyber Director has been working with CISA to ensure the Cyber Incident Reporting for Critical Infrastructure Act final rule fits existing reporting requirements. CISA's Unified Agenda targets issuance as soon as this month. Covered entities will face 72-hour incident reporting and 24-hour ransomware payment reporting to CISA. A July GAO report found 70% of 117 existing incident reporting regulations overlap. For DIB contractors already reporting under DFARS 252.204-7012 (72-hour reporting to DC3), the key question is whether CIRCIA creates a parallel obligation or a safe harbor. Cairncross signaled interest in "clearing brush" around law enforcement engagement and liability concerns. Action: Track the final rule release. Review whether your organization falls under CIRCIA's critical infrastructure definition in addition to DFARS 7012. If you report to DC3 today, prepare for possible dual-reporting until harmonization rules clarify. Status: Proposed rule (final rule imminent). Source
Post-quantum cryptography migration is now an execution issue, not a planning issue. Federal agencies are moving from planning to migrating systems to NIST's post-quantum encryption standards (finalized August 2024). Two June executive orders pushed quantum innovation alongside defense against quantum cryptographic attacks, and OMB followed with a migration-focused memo. For DIB contractors: NIST 800-171 requires FIPS-validated cryptography for CUI protection. When NIST updates FIPS standards to mandate post-quantum algorithms, your SSP's cryptographic inventory will need updating. Primes handling classified or high-value CUI should already be cataloging where vulnerable cryptography sits. Action: Begin a cryptographic inventory now. Identify systems protecting CUI that rely on RSA, ECC, or Diffie-Hellman key exchange. No DFARS clause mandates post-quantum migration today, but the trajectory is clear, and primes will likely flow this down before formal rulemaking catches up. Status: NIST standards finalized; federal migration directives in force; no DFARS-specific mandate yet. Source
No cyber-related False Claims Act cases, DOJ Civil Cyber-Fraud Initiative actions, or cyber enforcement activity appeared in today's feed. The DOJ press releases were dominated by drug trafficking, firearms, CSAM, and fraud cases unrelated to the defense industrial base or cybersecurity attestation.
Standing reminder: During the Phase 2 C3PAO suspension, self-assessment under NIST 800-171 plus DFARS 252.204-7012 remains the enforceable baseline. The False Claims Act is the primary enforcement mechanism for contractors who submit inaccurate SPRS scores or misrepresent their compliance posture. The absence of new cases today does not reduce attestation risk; DOJ's Civil Cyber-Fraud Initiative remains active and has secured settlements this year. If your SPRS score does not match your actual implementation, fix the gap or correct the score.
No Cyber AB statements, C3PAO market developments, or assessor ecosystem news today. The Phase 2 suspension remains in effect pending the Reform Task Force review, with no new timeline signals.
Covered under Policy & Rulemaking (post-quantum cryptography). No standalone NIST 800-171/172 revision activity today.
Counter-drone IDIQ awards signal active DIB procurement. The Pentagon's Joint Interagency Task Force 401 and the Army awarded $4.15 billion in IDIQ contracts across 10 companies for counter-drone sensors, effectors, and C2 systems, part of a vehicle expected to reach $7 billion by end of October. Only $50 million is obligated so far; the rest depends on FY2027 congressional funding. Officials emphasized multi-vendor flexibility and rapid delivery (sub-30 days). This is not CMMC-specific, but these contracts will carry DFARS 252.204-7012 and likely CMMC Level 2 (Self) requirements. Companies entering the counter-UAS supply chain should confirm their NIST 800-171 self-assessment and SPRS score are current. Source
FOCI documentation guide for cleared contractors. PilieroMazza published Part 3 of its series on the shifting Foreign Ownership, Control, or Influence landscape. The piece walks through the SF 328 ("Certificate Pertaining to Foreign Interests"), change condition packages required after ownership transactions, and DCSA's risk-based FOCI determination process. Key takeaway: an affirmative answer on any SF 328 question triggers DCSA review, and companies must notify DCSA at the commencement of negotiations with a foreign acquirer, not after closing. Action: If your company has foreign investors, is considering M&A involving foreign parties, or has had ownership changes since its last FCL determination, review PilieroMazza's walkthrough and confirm your SF 328 is current in NISS. FOCI obligations exist independently of CMMC but intersect directly with facility clearance eligibility, which gates access to classified work. Status: Existing regulatory requirement (proposed rule would expand obligations). Source
No notable r/CMMC threads or practitioner discussion surfaced in today's feed.
Bottom line for today: A quiet day on the CMMC-specific front. Use the downtime productively: start your cryptographic inventory for post-quantum readiness, verify your SPRS score accuracy, and if you hold a facility clearance, confirm your SF 328 is current.