October 16, 2026: Keep cybersecurity safeguards and evidence work moving during the CMMC Phase II suspension. Review supplier-data requests with contracts and security personnel, and verify backup data flows before moving controlled information.
Policy & Rulemaking
-
CMMC suspension: distinguish the July announcement from today's briefing. The department's CMMC policy page confirms the July 13, 2026 suspension of Phase II and says Phase I self-assessment requirements remain in place. [1] Reconcile contract requirements, the System Security Plan, supporting evidence, and assessment submissions before signing an affirmation. Obtain written clarification where a prime contractor's certification language conflicts with the available assessment pathway.
-
Supplier data requests need a documented authority and handling plan. Before releasing pricing records, have contracts, finance, and security personnel identify the requested records, recipients, contractual authority, and approved transmission method. Treat this as a review action; no new CMMC requirement is established here. Ask for the operative memorandum and contract language before changing disclosure procedures.
- Inventory the systems and subcontractors holding the requested records. Determine whether each record needs controlled handling from its actual designation and contractual basis; avoid expanding an enclave solely because information is commercially sensitive.
- Keep access controls, logging, and approved transfer methods in the disclosure workflow. Record what was provided and who authorized release.
Contracting Impact
- Verify the actual deviation before changing reporting or representations. DARS Tracking Number 2026-O0006 identifies an official FAR overhaul memorandum concerning DFARS Part 230, Cost Accounting Standards. [2] Do not use that identifier as proof of a Russian fossil-fuel restriction. Have acquisition counsel retrieve the exact operative revision and attachments for any requested change, then compare them with the solicitation or contract.
- For undefinitized contract actions, obtain the contracting officer's written reporting instructions before stopping a submission. An article summary cannot establish which requirements changed for a particular contract.
- Assign procurement representations and cybersecurity affirmations to accountable owners. Retain the underlying evidence and resolve unsupported answers before submission.
Practitioner Pulse
- Cloud backups: verify the specific service and data path. Before transferring Controlled Unclassified Information or export-controlled technical data, request written answers about storage and replication locations, administrative and support access, subcontractors, encryption-key custody, and restoration workflows. The FedRAMP Marketplace is a primary resource for checking a particular cloud offering's listed status. [3] Do not treat a forum's vendor label as evidence of authorization or export compliance.
- Map production data into backups, logs, support systems, and restored environments. Reflect the provider's responsibilities and actual architecture in the System Security Plan.
-
Obtain compliance and export-control review before moving production data. Use approved test data while access and residency questions remain unresolved. A remediation plan does not authorize an otherwise prohibited transfer.
-
Broad security slogans do not define assessment scope. Ask advisors to identify the applicable requirement and authoritative scoping basis behind any proposed expansion. Maintain an asset inventory, information-flow diagram, and documented boundary rationale. NIST SP 800-171 describes protection of Controlled Unclassified Information in nonfederal systems; the applicable contract and assessment basis must still be established. [4]
- Track broader enterprise improvements alongside contractual assessment work. Keep purchasing decisions tied to a confirmed requirement, an identified risk, and evidence of the present implementation.
Sources
[1] DoD CIO CMMC policy, July 13, 2026 suspension
[2] Official DARS 2026-O0006 memorandum, signed December 18, 2025
[3] FedRAMP Marketplace
[4] NIST SP 800-171 Revision 3