CMMC Brief

Today: No signed policy or enforcement news landed in this batch. The actionable items are practitioner questions on scoping CUI work to outside CAD vendors, whether FIPS and NDAA apply to physical access control, and what FIPS mode breaks on Windows, plus a federal PQC migration deadline at the end of October that is not yet a DIB requirement.

Policy & Rulemaking

• Federal PQC migration plans due end of October (OMB memo, agencies only). Agencies owe post-quantum cryptography (PQC) migration plans to OMB and the Office of the National Cyber Director by the end of October. OMB's June guidance sets phase one (2026-2027) as inventory, strategy, and training, and phase two (2027-2028) as pilots and early migrations of prioritized systems. DoD's PQC director cited a 2030 deadline. This binds agencies, not contractors, and it does not change DFARS 252.204-7012 or NIST SP 800-171 requirements. Federal News Network
• Act: Start a cryptographic inventory now (where FIPS-validated modules, certificates, and key management sit in your CUI environment). Expect primes and agencies to push PQC-readiness questions into flow-downs over time. Do not add PQC to your SSP as a requirement; treat it as planning.
• Gap: The article shows agencies are behind on inventories and that PKI must handle PQC with smart identity cards. Smartcard and PKI-based authentication in your enclave should be on that inventory.

Practitioner Pulse

All items below are practitioner opinion from r/CMMC, not authoritative guidance. Verify against your contract and assessor.

• Outsourcing CAD work on CUI drawings. A small machine shop with its first defense subcontract has CUI-marked drawings with export control notices and needs outside drafting help. They note that AS9100, CMMC, and ITAR registration are different credentials answering different questions. r/CMMC

• Act: AS9100 is a quality standard and says nothing about CUI handling. Before sharing files, check your contract for DFARS 252.204-7012 flow-down and any export control clauses. Confirm the vendor's NIST 800-171 status (SPRS score or CMMC status), whether they can handle CUI in an environment that meets 7012, and, for export-controlled data, that staff are eligible (ITAR registration alone does not prove that). Get flow-down language in the subcontract. A vendor that cannot show this should not receive the files.

• FIPS and NDAA for door access control on a CUI room. The poster asks whether FIPS and NDAA compliance are CMMC Level 2 requirements for badge and smartcard access systems, comparing Mercury (both) and Ubiquiti (NDAA only). They also note NDAA Section 889 targets telecom and video surveillance equipment. r/CMMC

• Act: Separate the two questions. FIPS-validated cryptography in 800-171 applies where you use cryptography to protect CUI confidentiality, which is mainly your information systems. Physical access control is assessed under the physical protection controls, which require managed access, not FIPS-validated hardware. Section 889 is a separate procurement prohibition tied to named vendors, so check your hardware against it regardless of CMMC. Document your reasoning in the SSP so an assessor sees a deliberate scoping decision.

• What breaks when Windows FIPS mode is enabled. A poster asks what actually fails on Windows 11 workstations and Server 2025 with FIPS mode on, and whether the warnings are overstated. r/CMMC

• Act: Do not roll out enterprise-wide untested. Pilot on a representative group, test line-of-business apps, VPN clients, legacy file shares, and any tool using non-approved algorithms. Record exceptions and the compensating approach in the SSP. If you rely on FIPS-validated modules for CUI in transit and at rest, be able to show the validation and the configuration.

• Whole-company scope for a Level 2 assessment. An AE firm (about 200 people, roughly 50% DoD revenue, over 75% of staff touching DoD projects yearly) put the whole company in scope and is a month from its assessment. The poster says restrictions on staff who rarely touch CUI are hurting productivity. r/CMMC

• Act: Re-scoping a month out is risky. If CUI access is genuinely limited, an enclave is the usual way to cut the burden, but it needs real boundary controls and a documented asset inventory and network diagram. Changing scope this late will likely force SSP and evidence rework, so talk to your assessor before you change anything. For future cycles, decide scope by where CUI actually flows, not by headcount touching DoD work.
• Suspension context: Under the current suspension of the third-party (C3PAO) phase-in, a Level 2 (C3PAO) assessment is voluntary. Confirm with your assessment organization how a scheduled assessment is being handled and whether it carries contractual weight with your primes.

Skipped sections: Enforcement & False Claims, Cyber AB & Ecosystem, NIST & Standards, and Contracting Impact had no relevant articles today.