CMMC Brief

Today: U.S. Special Operations Command is seeking industry input on a shared technology platform, with RFI responses due Nov. 5. Separately, a practitioner discussion highlights a small-company assessment question: how to demonstrate separation of duties when one person handles IT administration.

Contracting Impact

• SOCOM platform opportunity: respond to market research, not a final requirement. Status: RFI (request for information) and draft performance work statement, not a final solicitation or rule. U.S. Special Operations Command (SOCOM) is exploring an integrated contracting vehicle for a common platform-as-a-service environment near MacDill Air Force Base, Florida, covering integration facilities, cloud-native engineering, network connectivity, hardware/software support, and cybersecurity; DefenseScoop reports that responses are due Nov. 5. Prospective bidders and supporting service providers should review the official notice, confirm submission instructions and timing, and map their capabilities to the draft scope before responding.

• Cybersecurity evidence is part of the contemplated scope. Status: draft acquisition requirements under market research. The draft calls for end-to-end RMF (Risk Management Framework) support to achieve and maintain an ATO (authority to operate), including control implementation and assessment, supporting evidence, continuous monitoring, and risk analysis. Providers should identify which services and evidence they can deliver, then verify the eventual solicitation and applicable contract clauses before committing to compliance obligations; the report does not establish a CMMC (Cybersecurity Maturity Model Certification) level or flow-down requirement for this opportunity. Source

Practitioner Pulse

• One-person IT: document who approves, who executes, and who reviews. Status: practitioner question, not official guidance or an assessment determination. An r/CMMC participant asks whether management approval of personnel changes and Change Control Board approval of high-risk changes sufficiently demonstrate separation of duties under AC.L2-3.1.4, while noting that nobody reviews every administrative action. Small contractors facing the same issue should map approval, execution, and review responsibilities in their SSP (System Security Plan), retain evidence of the controls actually performed, and verify the applicable assessment criteria before treating existing approvals as sufficient; the post does not establish that these arrangements pass or fail.