Today: A reported CMMC task force review outlines reform options, including a narrower Phase 2 restart and longer remediation periods, but these recommendations are not operative requirements. Contractors should verify applicable contract clauses before changing compliance plans and distinguish reform commentary from approved assessment guidance.
Policy & Rulemaking
- CMMC reform options remain task force recommendations. Federal News Network reports that an early-September task force summary of responses to July's RFI (request for information) identifies potential changes to CMMC (Cybersecurity Maturity Model Certification), including clearer implementation guidance, more consistent CUI (Controlled Unclassified Information) marking, and adoption of NIST (National Institute of Standards and Technology) SP 800-171 Revision 3. The reported recommendations include a narrower Phase 2 restart over a proposed 90-day period, publication of assessor availability statistics, and expansion of POA&M (plan of action and milestones) eligibility to 270 days, which the task force recognizes would require rulemaking; these are proposed actions, not established implementation dates or permissions. Act: Brief leadership on the review, but verify the operative official documents and applicable contract clauses before changing assessment scheduling, remediation commitments, or the revision referenced in your SSP (system security plan).
Enforcement & False Claims
- Criminal guilty plea concerns procurement fraud, not cybersecurity attestation. The Justice Department reports that former Army civilian official Carlos Duque pleaded guilty to conspiracy, bribery, and major fraud involving a technology innovation lab in the Pacific; according to the plea agreement and charging information, the January 2021-October 2022 scheme involved an agreement for approximately $1.25 million in bribes over five years, approximately $55,000 actually received, and more than $3 million in Army payments to the contractors' company. DOJ says Duque directed prime contractors toward the company and facilitated inflated costs incorporating bribe payments; the reported maximum penalties include five years and a $250,000 fine for conspiracy, and 15 years plus a fine of up to $250,000 or three times the bribe's monetary equivalent, whichever is greater, for bribery. Act: Review controls over directed subcontract awards, conflicts of interest, and cost justification, but do not treat this criminal procurement case as evidence of changed CMMC attestation enforcement or assessment requirements.
Practitioner Pulse
-
Reform commentary advocates alternatives, not approved compliance pathways. A Federal News Network commentary recommends integrating CMMC into DFARS (Defense Federal Acquisition Regulation Supplement) clauses, accepting outcome-based technology equivalency, using continuous risk-based reassessment, and accepting FIPS (Federal Information Processing Standards)-compliant cryptography where appropriate. These are the commentator's recommendations, not evidence of an operative clause change, accepted alternative architecture, or revised cryptographic requirement. Act: Use the arguments to document specific implementation burdens and questions for advisers, but verify applicable requirements before replacing virtual desktop infrastructure, changing cryptographic implementations, or revising assessment plans.
-
One practitioner reports implementation fatigue, a staffing signal rather than a market-wide finding. In an r/CMMC post, a person implementing CMMC for a prime contractor describes being exhausted after roughly six hours of compliance work and asks peers how they manage stress. This is an individual account, not evidence of typical implementation capacity or a policy development. Act: Managers should check workload and single-person dependencies, divide documentation and evidence collection among accountable owners, and make unresolved decisions visible to leadership rather than relying on sustained overtime.