CMMC Brief

Today: No signed policy, enforcement action, or Cyber AB statement landed in today's feed. The signal is practitioner friction on Level 2 prep, SPRS entry for foreign sites, and MFA design under NIST 800-171, plus congressional AI bills that could reach DIB contractors later. Nothing here changes what is in force: DFARS 252.204-7012 and NIST 800-171 self-assessments still apply, and the False Claims Act remains the main lever on self-attestation.

Policy & Rulemaking

• Congressional AI proposals (legislation, not law): Rep. Bennie Thompson and Rep. Troy Carter reintroduced a bill requiring CISA to set up an AI security task force. Sen. Maria Cantwell released a framework with NIST setting standards for frontier AI models, including independent audits before release. A bipartisan Peters-Lankford Senate bill would require agencies to disclose AI use and give people a human-review redress process. A separate administration "Super Intelligence" task force was reportedly slated to meet Thursday. Federal News Network
• Status: All of it is proposed. None is a requirement for contractors.
• Act? No compliance action now. Watch for NIST AI standards and agency disclosure rules, since primes tend to fold new federal guidance into flow-down language. If you use AI tools on systems that handle CUI (Controlled Unclassified Information), make sure your SSP (System Security Plan) boundary and data-flow descriptions already cover them.

Contracting Impact

• SPRS (Supplier Performance Risk System) entries for foreign sites: A manufacturer with US HQ and foreign sites that hold NCAGE codes but no CAGE codes asks whether it can post those sites' scores in SPRS. The thread is a question, not an answer. r/CMMC
• Act? Yes, if you are in this position. Do not guess. Confirm with your contracting officer or the SPRS help desk whether a foreign site's score must be posted under its own code or rolled into the parent CAGE. Scope the assessment to the systems that actually process CUI, and document the boundary decision in the SSP. A wrong or inflated SPRS score is an attestation risk under the False Claims Act, so get the answer in writing.

Practitioner Pulse

Opinion and anecdote below; none of it is authoritative guidance.

• Requirement mapping tools: A practitioner asks whether peers use checklists to map each requirement to NIST 800-171 or an SSP/GRC (governance, risk, compliance) platform. The post has no body or replies in the feed. r/CMMC

• Act? Whatever tool you pick, it must map to all 110 NIST 800-171 requirements and the 320 assessment objectives in NIST SP 800-171A. A spreadsheet works if it is maintained. A platform helps with evidence tracking and POA&M (Plan of Action and Milestones) ownership. Pick based on who will keep it current.

• Inconsistent Level 2 reviews: A user going through Level 2 says reviews they have read seem riddled with errors and inconsistencies, and asks whether anyone has actually reached Level 2. r/CMMC

• Act? Treat this as unverified sentiment. During the Phase 2 suspension, only Level 1 (Self) and Level 2 (Self) designations are allowed, so a third-party Level 2 (C3PAO) result is not currently available through the normal pipeline. Do not rely on anecdotal reviews of assessors or vendors. Check any vendor's claims against the Cyber AB marketplace and ask for references.

• MFA with Windows UAC elevation: A user running Imprivata Enterprise Access Management for MFA on privileged and non-privileged network accounts has disabled UAC elevations through Group Policy. They want admins to elevate from a standard account while keeping MFA enforced. r/CMMC

• Act? This maps to the NIST 800-171 multifactor authentication requirement (3.5.3) and privileged-account controls. Disabling elevation avoids the problem but may block legitimate admin work. Test whether your MFA product supports elevation prompts, and document whichever design you choose, including the compensating logic, in the SSP.

• On-prem and air-gapped IAM feedback request: A vendor is soliciting feedback on a Windows-native, self-hosted identity and access management product with no cloud dependencies, supporting FIDO2/WebAuthn, PIV/certificates, TOTP, and Kerberos. r/CMMC

• Act? This is vendor promotion, not analysis. If you run disconnected enclaves, it shows the demand for non-cloud identity options. Any product still has to be evaluated against your own SSP and assessment evidence needs.

• Untitled "CMMC issues" thread: The post has no readable content in the feed, so there is nothing to act on. r/CMMC