Get tomorrow's brief in your inbox
Today: Practitioners are questioning whether reported cloud-service authorization changes justify using AI tools with sensitive defense information, while a manufacturing software user reports on-premises patching problems. Verify service authorization and contract applicability before changing data permissions, and check patch reliability rather than assuming on-premises hosting resolves compliance concerns.
AI services and CUI: verify before enabling use. A Reddit poster reports that Perplexity Enterprise appeared in the Federal Risk and Authorization Management Program (FedRAMP) marketplace as "20x Class C (Moderate)" after previously appearing as Class B, and asks whether it can handle CUI (Controlled Unclassified Information); this is a practitioner report, not an established authorization or contract determination. The poster also describes Cursor as a Class A pilot, but neither reported designation alone establishes suitability for a contractor's intended use under CMMC (Cybersecurity Maturity Model Certification) or applicable Defense Federal Acquisition Regulation Supplement (DFARS) clauses. Before permitting CUI, verify the current marketplace entry, the exact service and authorization boundary, and the operative contract requirements with your security and contracts teams; do not treat this discussion as permission to upload sensitive information. Source
Manufacturing ERP: investigate patch failures before reconsidering hosting. A ProShop enterprise resource planning (ERP) user reports moving to on-premises hosting because of CMMC concerns and experiencing failed patches and other operational issues; the poster suspects the vendor-provided installation image may contribute but explicitly allows that the problems could be specific to their environment. Status: individual practitioner experience, not a verified product-wide defect or policy change; the post also does not establish the current authorization or suitability of the cloud offering. If you operate ProShop, review patch results and unresolved failures with the vendor, document affected systems and remediation ownership, and verify the security and contractual implications of either hosting model before migrating. Source
Readiness depends on implementation, not tool ownership. In a Nov. 1 practitioner post, held over for this edition, an author describes encountering organizations that equate owning security tools with CMMC Level 2 readiness and argues that configuration, implementation, and maintenance matter more than the inventory alone. Status: practitioner observation, not a new assessment requirement; the author specifically identifies multifactor authentication, endpoint protection, backups, and security policies as examples where possession does not establish effective implementation. Use that distinction as a readiness check: compare documented practices in the SSP (System Security Plan) with actual configurations and operating evidence, test whether controls work as described, and assign owners to identified gaps rather than relying on purchase records or policy documents alone. Source