Get tomorrow's brief in your inbox
Today: A rehearing brief in Anthropic's Pentagon dispute is a reason to review AI supplier dependencies and the orders that apply to your contract. The FBI's October 13 warning and related Justice Department actions support a fresh check of remote-hire identity and access controls; practitioner posts raise separate questions about assessment follow-through and evidence organization.
Anthropic dispute: check the specific procurement action and later orders. Status: court decision and rehearing advocacy, not a new CMMC rule. In its September 25 decision in No. 26-1049, consolidated with 26-1162, the D.C. Circuit denied Anthropic's petitions challenging the Department's supply-chain exclusion of Claude under the Federal Acquisition Supply Chain Security Act. A former-officials brief dated October 20 urges rehearing and argues that the designation was pretextual; those arguments are not a new court finding or order lifting restrictions. Inventory direct purchases and supplier integrations, then have procurement and counsel check the actual procurement action, subsequent orders, and applicable contract language before changing arrangements or assuming a company-wide commercial ban. D.C. Circuit opinion | October 20 rehearing amicus brief
Remote IT-worker schemes: review identity and access throughout employment. Status: FBI threat guidance and criminal allegations, not a new contract clause. The Justice Department's October 13 announcement describes an alleged 2019-2025 scheme affecting more than 70 U.S. employers and generating approximately $3 million; related coordinated actions included approximately 187 computer-device seizures in Texas. The FBI's same-day warning identifies targeting of cleared defense contractors and companies involved in government contracts, and recommends evaluating multiple behaviors together because individual indicators can overlap with legitimate remote work. Have HR and security review identity checks, device custody, remote-access arrangements, and access removal during offboarding; remote-desktop use alone is not proof of wrongdoing. The charged defendants are presumed innocent. Justice Department announcement | FBI's identity-in-depth guidance
One assessment account does not establish a Revision 3 transition requirement. Status: unverified practitioner account, not official assessment guidance. A Reddit contributor reports completing a large manufacturer's Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment through a C3PAO (Certified Third-Party Assessment Organization), scoring the full 110, and then starting Revision 3 work. That account is not independent evidence of certification or a mandatory transition; before changing your assessment baseline, verify the applicable National Institute of Standards and Technology Special Publication (NIST SP) 800-171 revision against official requirements and your contract.
SSP length: test usability and traceability. Status: practitioner question, not a documentation mandate. A Reddit thread asks how many pages an SSP (System Security Plan) should contain and whether screenshots belong inside it or in a linked folder. The question establishes no accepted page count or storage convention. As an internal review, have someone other than the author trace selected implementation descriptions to supporting evidence, confirm that links and permissions work, and verify applicable documentation expectations before reorganizing solely to match another contractor's format.