Get tomorrow's brief in your inbox
Today: No new CMMC policy actions or cyber-related False Claims Act cases dropped today. Practitioners are wrestling with practical questions: finding CMMC-certified subcontractors for CUI-adjacent trades, choosing GCC High vs. commercial Microsoft 365 for ITAR/CUI workloads, and digesting last week's town hall. A Pentagon data breach disclosed July 16, days after the Phase 2 assessment pause, is drawing pointed commentary.
No new Federal Register notices, DoD memos, or Reform Task Force developments today. The status quo holds: 32 CFR 170 and DFARS 252.204-7021 remain in effect, the Phase 2 C3PAO assessment phase-in is suspended pending task force review, and Level 1/Level 2 self-assessment is the only active certification pathway. DFARS 252.204-7012 (safeguarding covered defense information) and NIST SP 800-171 self-assessment obligations are unchanged.
Action: No new compliance action required. Continue maintaining your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) against NIST SP 800-171 Rev 2. Monitor the Federal Register and Reform Task Force announcements for any reinstatement timeline.
No cyber-related False Claims Act (FCA) cases today. The DOJ press releases were dominated by drug trafficking, firearms, and general fraud matters unrelated to defense contracting.
One healthcare FCA settlement is worth noting for the mechanism, not the subject matter: Signal Diagnostics agreed to pay $20.5M for knowingly retaining HRSA overpayments after an internal audit identified the problem (DOJ press release). The case illustrates a pattern DIB contractors should internalize: Signal discovered the problem through its own audit, then sat on the repayment obligation. DOJ treated the delay itself as a knowing FCA violation.
Action: If your internal assessments or SPRS (Supplier Performance Risk System) score reviews reveal gaps between your self-attested compliance posture and reality, document and remediate promptly. The FCA clock starts when you know, not when DOJ asks. During the Phase 2 suspension, self-attestation is the primary enforcement surface, and "we found it but didn't fix it" is the exact fact pattern DOJ pursues.
CISA, DoD, DOE, FBI, and State Department joint guidance on adapting zero trust principles to operational technology (OT) environments is getting renewed attention after coordinated cyberattacks hit 30+ community water systems in Minnesota this summer (Federal News Network). The guidance emphasizes that OT zero trust cannot be a copy-paste from enterprise IT; it requires passive asset discovery, network segmentation, and controls that respect availability and safety constraints.
Action: DIB manufacturers and facility operators with OT environments (HVAC, building automation, SCADA, industrial controls) should review this guidance against their NIST 800-171 implementation. CUI protection requirements apply to the information systems where CUI is processed, stored, or transmitted, and if OT networks touch those systems, they are in scope. Expect primes to begin folding OT-specific security expectations into flow-down language. A Fortinet survey found only 14% of OT professionals have full visibility of OT systems in their security operations, so asset inventory is the logical first step.
The Autonomous Warfare Command ("AutoWarCom") announcement (DefenseScoop) and the Navy's $1.2B production award for 30 medium unmanned surface vessels (DefenseScoop) signal accelerating procurement in autonomous systems. These programs will generate new contract vehicles and subcontracting opportunities across the DIB.
Action: Companies positioning for autonomous systems, robotics, or AI-adjacent defense work should watch for solicitations flowing from AutoWarCom and the Navy's Robotic and Autonomous Systems Warfighting Development Center. CMMC requirements will attach to any contract involving CUI. Even during the Phase 2 suspension, primes can and do flow down CMMC Level 2 self-assessment requirements contractually. Get your self-assessment current before pursuing these opportunities.
Finding CMMC-certified subcontractors: A general contractor posted on r/CMMC asking where to find Level 2 certified plumbers, electricians, and utility locators, noting that utility location maps are CUI and cannot be shared with non-compliant subs during bid walks. This is a real problem with no clean answer yet. There is no public database of CMMC-certified contractors (the Cyber AB's marketplace lists C3PAOs and RPOs, not certified contractors). During the suspension, "certified" effectively means "has completed a Level 2 self-assessment with a current SPRS score." Opinion: this is going to become a significant friction point in construction and facilities contracts as CUI scoping expands into trades that have never thought about cybersecurity compliance.
GCC High and ERP confusion: An aerospace manufacturer asked about migrating to Microsoft 365 GCC High for ITAR compliance and whether cloud ERPs like Dynamics or NetSuite meet government security requirements. This is a common point of confusion. GCC High is required for ITAR; commercial M365 does not meet ITAR requirements regardless of configuration. For CUI without ITAR, GCC (not GCC High) may suffice, but the distinction matters for FedRAMP Moderate authorization. Cloud ERPs need individual evaluation against NIST 800-171 controls; not all meet the bar.
Pentagon data breach timing: A r/CMMC post noted that the Pentagon confirmed a data breach discovered July 16, three days after announcing the CMMC assessment pause. The irony is not lost on the practitioner community. Opinion: this reinforces the argument that cybersecurity requirements, including third-party assessment, exist for a reason, and the suspension creates real risk that will eventually need to be addressed.
Town hall recap: A practitioner asked for notes from this week's town hall. No summary was available in the thread at collection time. If you attended, the community would benefit from a writeup.