Today: Reported CMMC task force recommendations offer reform options, not an established change to contractors' obligations. Verify operative requirements before changing assessment plans, and challenge claims that a bastion host alone keeps user endpoints outside the assessment boundary.
Policy & Rulemaking
- CMMC reform options remain recommendations. Status: RFI (request for information) findings and task force review, not an operative policy change. Federal News Network reports that a Defense Department task force summary separates potential Cybersecurity Maturity Model Certification (CMMC) improvements into actions possible without rulemaking, more difficult or longer-term changes, and matters outside the department chief information officer's authority; options include clearer assessment interpretation, more consistent CUI (Controlled Unclassified Information) marking, and adoption of National Institute of Standards and Technology Special Publication 800-171 Revision 3. The reported recommendations include a narrower Phase 2 restart over a 90-day period, assessor guidance and availability statistics, and extending POA&M (plan of action and milestones) eligibility to 270 days, which the task force identifies as requiring rulemaking; additional actions are organized over six-to-12-month and year-plus horizons, not established contractor deadlines. Act: Brief leadership on these as planning scenarios, not permission to delay compliance, switch revisions, or extend remediation schedules; before changing your SSP (system security plan), assessment booking, or POA&M, verify the operative official requirements and applicable contract clauses, and ask prospective assessors how they resolve interpretation differences. Source: Federal News Network
Practitioner Pulse
- Bastion-host scoping claims deserve an evidence check. Status: practitioner question, not official guidance. An r/CMMC poster asks whether others' consultants claim that bastion hosts prevent CUI from reaching user endpoints and therefore keep those endpoints outside scope; the post does not establish that this architecture achieves that result or that an assessor accepts the boundary. Act: Before excluding endpoints, ask the consultant to document the proposed data flows, endpoint interactions, technical restrictions, and supporting assessment criteria; review those assumptions against the applicable official scoping guidance and contract requirements, then document the justified boundary in the SSP rather than treating the presence of a bastion host as sufficient evidence. Source: r/CMMC