Get tomorrow's brief in your inbox
Today: PreVeil announced a free virtual CMMC summit (Oct 28) featuring the SP 800-171 author, C3PAO directors, and contractor case studies, a Reddit practitioner reported spending two years and substantial budget on NIST 800-171 compliance after discovering an MSP had performed an unverified self-assessment, and a Level 3 inquiry surfaced despite no active pathway existing under the current suspension.
PreVeil CMMC Security Summit scheduled for Oct 28 (virtual, free)
PreVeil Blog
PreVeil is hosting a 14-session, 3-track virtual summit on Oct 28 with Ron Ross (SP 800-171 author), C3PAO assessment directors, defense compliance attorneys, and DIB CEOs who have completed certifications. The agenda covers current requirements during the suspension, third-party assessment expectations if/when they resume, and competitive positioning in the defense market. This is a practitioner-grade event, not vendor fluff. Register to benchmark your program against companies that have already navigated the process and hear directly from the people who wrote and enforce the standard. Useful for compliance managers briefing leadership on what the suspension does and does not change.
On Oct 2, a Reddit user reported a two-year, high-cost NIST 800-171 effort derailed by MSP failure
Reddit r/CMMC
A small DIB contractor hired to coordinate NIST 800-171 compliance discovered their MSP had performed the self-assessment without verification, leaving the program in disarray. After months of cleanup, the company successfully scoped down to a CUI enclave (avoiding enterprise-wide compliance cost). This is a recurring pattern: MSPs treating the 800-171 self-assessment as a checklist exercise rather than a documented, verifiable posture. During the CMMC suspension, self-attestation under DFARS 252.204-7012 is the only game in town, and the False Claims Act makes attestation fraud actionable. If your MSP completed your assessment, audit the evidence yourself. Request documentation for each control, validate technical configurations, and confirm the SSP matches reality. The FCA does not care who filled out the form; the contractor who signs it owns the risk.
On Oct 3, a Level 3 question appeared despite no active certification pathway
Reddit r/CMMC
A practitioner asked for guidance on starting or passing a Level 3 (CMMC) assessment. Under the July 2026 suspension, no Level 3 pathway exists. The CMMC rule defined Level 3 as NIST SP 800-172 (enhanced security for high-value programs), assessed by a government-led team, but DoD has not operationalized it and the Reform Task Force review froze third-party assessments entirely. If a contract requires Level 3, the requirement is almost certainly erroneous or a placeholder from outdated solicitation language. Contact the contracting officer immediately to clarify. If the program genuinely handles CUI requiring 800-172 protections, you will need government assessment coordination, not a C3PAO. Do not invest in Level 3 readiness without a signed contract clause and a government assessment plan in hand. Otherwise, focus resources on Level 2 (Self) under 800-171 and watch the Reform Task Force for policy changes.