Get tomorrow's brief in your inbox
Today: A practitioner webinar confirmed that 89% of polled DIB organizations are pressing ahead with CMMC compliance despite the Phase 2 suspension, with primes still requiring readiness evidence. Two Reddit threads highlight ongoing confusion around FIPS-validated cryptography during live assessments. An MSP reports completing a voluntary Level 2 C3PAO certification, demonstrating the assessment pipeline is still functioning for those who choose to use it.
No new signed policy or rulemaking actions today. The status quo remains:
One article (Federal News Network commentary on military AI) characterizes the Phase 2 suspension as DoD "lowering barriers for non-traditional tech businesses." That is opinion, not policy. The suspension is a temporary freeze pending review, not a permanent lowering of requirements. Do not plan around a permanent reduction in assessment rigor.
Action: No new action required. Continue monitoring the Reform Task Force for its report timeline.
No new cyber-related False Claims Act (FCA) cases this cycle. The DOJ press release in today's feed (Carnation, WA COVID fraud sentencing) is unrelated to CMMC or DIB cybersecurity.
Standing reminder: With C3PAO assessments suspended, self-attestation is the primary compliance mechanism, and the DOJ Civil Cyber-Fraud Initiative is the primary enforcement lever. Every SPRS score submission and Level 2 self-attestation is a representation to the government. False or reckless scores expose organizations to FCA liability, including qui tam (whistleblower) actions.
Action: Validate that your SPRS score is defensible and that your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) accurately reflect your current implementation status. If your score was submitted months ago and your environment has changed, update it.
MSP completes voluntary Level 2 C3PAO certification. A Registered Provider Organization (RPO) and MSP posted on r/CMMC that it passed its Level 2 certification assessment on the first attempt. The team acknowledged that MSP certification is "completely optional" but pursued it to demonstrate credibility to clients. (Reddit r/CMMC)
This confirms that C3PAO (Certified Third-Party Assessment Organization) assessments are still being conducted for organizations that voluntarily pursue them. The suspension blocks DoD from requiring C3PAO certification in contracts; it does not block organizations from obtaining one.
Action: If you are an MSP or consultant serving DIB clients, voluntary certification is a competitive differentiator. Weigh the cost against client expectations and your pipeline. If you are a subcontractor, ask your prime whether they view voluntary certification favorably in bid scoring. The DoD CIO's remarks at BlackHat (referenced in the Summit 7 article) indicated the department intends to adjust bid scoring to prioritize certified organizations even during the suspension.
FIPS validation confusion surfaces in two live assessment scenarios. Two r/CMMC threads this week deal with FIPS (Federal Information Processing Standards) validated cryptography requirements:
FIPS across frameworks (CMMC, CJIS, FedRAMP). A poster notes that CMMC requires FIPS-validated cryptographic modules but allows "Enduring Exceptions" in limited cases. The thread highlights that CMMC's FIPS posture is strict relative to some other frameworks but does include defined exception paths. (Reddit r/CMMC)
FIPS and RMM tools (Control 3.1.13). An organization undergoing a live assessment flagged that NinjaOne's commercial version is not FIPS-validated, creating tension with NIST 800-171 control 3.1.13 (remote access). The assessment guide language is described as "contradicting," stating FIPS-validated modules are not required to meet the control's intent but should be used. (Reddit r/CMMC)
Action: If you use remote management or remote access tools, verify whether they use FIPS-validated cryptographic modules. If they do not, document this in your SSP with a clear rationale. For 3.1.13 specifically, the assessment methodology distinguishes between the control objective (encrypting remote sessions) and the FIPS validation of the module performing that encryption. An Enduring Exception or documented compensating measure may apply, but you should be prepared to defend it during any assessment, whether self or third-party. Check the CMMC Assessment Guide's discussion of 3.1.13 carefully and consult your assessor or advisor before the assessment, not during it.
Primes are still flowing down compliance expectations. The Summit 7/FutureFeed webinar reported that more than half of polled respondents said their prime contractors are still requiring CMMC preparation during the suspension. This aligns with the structural reality: primes carry risk for their supply chains and can impose requirements contractually regardless of what DoD mandates at the solicitation level. (Summit 7 Blog)
Key data points from the webinar poll: - 89% of respondents are still moving forward with CMMC compliance - 64% are "very confident" in their current compliance posture - 59% still want clarity on what actually changed
The webinar also noted that implementation costs far outweigh assessment costs. Delaying implementation to "wait out" the suspension does not save money; it increases risk and pushes work into a compressed timeline when certification requirements resume.
Action: If you are a subcontractor, contact your prime now and ask three questions: (1) What CMMC level applies to your subcontract? (2) Do they expect third-party certification or self-attestation? (3) What is their timeline for compliance evidence? Document the answers. If your prime is silent, default to DFARS 7012 compliance and a defensible SPRS score.
"Should I keep going?" is settled; "How do I handle FIPS?" is not. The dominant practitioner sentiment this week is clear resolve to continue compliance work, with confusion concentrated on specific technical controls rather than strategic direction.
The FutureFeed webinar (Summit 7) reinforced that prior compliance work is not wasted. Organizations aligned to NIST 800-171 Rev 2 will have a head start on Rev 3, which increases the number of assessment objectives and introduces Organization-Defined Parameters (ODPs). The upcoming FAR CUI Rule will further expand CUI protection requirements beyond DoD contracts. (Summit 7 Blog)
The FIPS threads on r/CMMC reflect a recurring pain point: practitioners encounter ambiguous assessment guide language during live assessments and scramble for interpretations. This is a documentation problem. If your SSP does not explicitly address how each cryptographic boundary is handled, including which modules are FIPS-validated and which are covered by exceptions, you are setting yourself up for assessment friction.
Action: Review your SSP's cryptographic inventory now. For every tool that touches CUI in transit or at rest, document whether its cryptographic module is FIPS 140-2/140-3 validated (with certificate number) or whether an Enduring Exception applies. Do this before your next assessment, not during it.