Get tomorrow's brief in your inbox
Today: Military movers are challenging proposed CMMC Level 2 requirements, but the proposal is not an established contract obligation. Verify operative contract language before changing assessment plans, and begin cryptography inventories in response to reported federal post-quantum migration timelines without treating agency deadlines as universal contractor mandates.
CMMC reform options remain under review, not adopted requirements. Status: task force review, as described by practitioner commentary. Summit 7 reports a July 13 suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase 2 rollout and, citing Federal News Network reporting, describes options including clearer Controlled Unclassified Information (CUI) markings, a move to National Institute of Standards and Technology (NIST) SP 800-171 Revision 3, more consistent assessments, and longer Plan of Action and Milestones (POA&M) windows. Its account also mentions a possible narrower restart within 90 days, explicitly describing these options as unadopted; do not treat that interval as a compliance deadline or change your control baseline, remediation commitments, or assessment pathway without verifying the operative departmental document and applicable contract clause.
Military movers dispute proposed Level 2 requirements. Status: proposed program rules. Federal News Network reports that the Defense Personal Property Activity accepted comments through October 26 on proposals that include CMMC Level 2 requirements; Movers for America argues that compliance costs and the industry's independent-contractor structure make implementation difficult, and its survey found nearly half of respondents might reduce their defense business if those requirements apply. Moving contractors and their advisors should monitor the final language, identify which systems and subcontractor relationships support military moves, and verify the proposed scope against actual information handling and contract terms rather than assuming either that every driver needs certification or that personal information alone settles CMMC applicability.
AI acquisition guidance may affect solicitation and contract language. Status: departmental memorandum dated October 20, reported by legal counsel. PilieroMazza reports that the memorandum implements "Truth-seeking" and "Ideological Neutrality" principles through adaptable templates and standardized language for acquisition personnel, supporting Executive Order 14319 and Office of Management and Budget Memorandum M-26-04. Contractors supplying artificial intelligence should have proposal and legal teams inspect relevant solicitations, representations, deliverables, and acceptance provisions, then verify the operative memorandum and incorporated terms before committing to compliance; this is an acquisition development, not evidence of a changed CMMC assessment requirement.
Commercial-acquisition deviation calls for a targeted contract review. Status: departmental class deviation dated October 22, reported as effective immediately. PilieroMazza describes changes to Federal Acquisition Regulation (FAR) Part 12 and Defense Federal Acquisition Regulation Supplement (DFARS) Part 212, including access to determination memoranda upon request, revised commercial-product and commercial-service determinations, specified non-developmental-item awards exceeding $100,000,000 without a written determination, and an exception to advance-payment security requirements under 10 U.S.C. 3803 for consumption-based solutions. Acquisition teams handling those transactions should verify the deviation's exact conditions and request relevant determination documentation where useful; do not interpret the advance-payment security exception as relief from cybersecurity obligations.
Continued assessment spending is a business decision, not proof of a universal mandate. Status: vendor analysis and recommendation. Summit 7 argues for continuing Level 2 assessments through a C3PAO (Certified Third-Party Assessment Organization), reports easier scheduling, and says Boeing, L3Harris, Elbit Systems of America, Leonardo DRS, RTX, and HII have told suppliers cybersecurity obligations continue, with many encouraging certification. Ask each relevant prime for its actual supplier requirement and timing, then compare assessment readiness, customer demand, and budget before booking; encouragement, a commercial advantage, and an incorporated contract requirement are different grounds for action.
Keep implementation costs and attestation evidence separate from assessment marketing. Status: practitioner commentary, not an enforcement finding. Summit 7 cites a departmental summary putting average assessment costs around $47,000, while reporting that implementing and maintaining NIST SP 800-171 was respondents' largest cost driver; it also argues that independent assessment reduces False Claims Act exposure associated with Supplier Performance Risk System (SPRS) affirmations. Treat the cost figure as a reported average rather than a quote, budget separately for implementation and assessment, and reconcile scoring and affirmation evidence with actual control operation before submission; an independent assessment should not be treated as a legal safe harbor.