CMMC Brief

CMMC Brief https://carolinacleartech.com/cmmc-brief Daily CMMC and defense industrial base compliance briefing. DoD policy and rulemaking, False Claims Act cyber enforcement, Cyber AB and C3PAO developments, NIST 800-171 updates, and contracting impact for DIB contractors, compliance managers, and the MSPs and consultants who support them. From Carolina Clear Tech. en-us Wed, 07 Oct 2026 12:20:37 +0000 CMMCBrief 2026-10-07: NIST's AI Accelerator director addressed post-deployment drift monitoring for generative AI https://carolinacleartech.com/cmmc-brief/2026-10-07/ Today: NIST's AI Accelerator director addressed post-deployment drift monitoring for generative AI systems, Anduril announced a $6.6B software-defined shipyard contract for Virginia-class submarine components, and a commentary flagged how voluntary cybersecurity frameworks disadvantage smaller agencies. https://carolinacleartech.com/cmmc-brief/2026-10-07/ Wed, 07 Oct 2026 07:00:00 +0000 Today: NIST's AI Accelerator director addressed post-deployment drift monitoring for generative AI systems, Anduril announced a $6.6B software-defined shipyard contract for Virginia-class submarine components, and a commentary flagged how voluntary cybersecurity frameworks disadvantage smaller agencies. <hr> <h2>NIST & Standards</h2> NIST's AI Accelerator director, Kat Megas, outlined the risk profile for agencies deploying generative AI in an October 7 interview. The critical shift for DIB contractors: AI systems drift over time in ways deterministic software does not, meaning a system tested at delivery can behave unpredictably months later. Megas emphasized post-deployment monitoring as non-negotiable, particularly for contractors whose AI-enabled systems touch CUI or participate in classified programs. What to do: If your SSP includes AI-driven tools (vulnerability scanners, alert triage, automated logging), add a POA&M item for continuous monitoring of model behavior. NIST's forthcoming Cyber AI Profile will codify these expectations; expect primes to flow down monitoring and drift-documentation requirements once the profile publishes. Megas also surfaced IoT lessons, noting that many organizations still do not know what is on their networks. If you self-attest Level 2 compliance under 800-171, ensure your asset inventory accounts for all AI/ML endpoints and IoT devices before the False Claims Act finds the gap for you. <a href="https://federalnewsnetwork.com/artificial-intelligence/2026/10/5-questions-with-nists-kat-megas-on-ai-cybersecurity-and-managing-risk/" target="_blank" rel="noopener noreferrer">Read more</a> <hr> <h2>Contracting Impact</h2> The White House and Anduril Industries announced a $6.6B shipyard project in Baltimore County on October 6, split between a $2.9B Navy contract and $3.7B in private investment. The facility, Arsenal-2, will build Virginia-class submarine components starting in 2030 using Anduril's ArsenalOS software platform for digital work instructions, real-time production visibility, and embedded quality controls. The announcement positions this as a "software-defined" manufacturing model and signals DoD's interest in non-traditional contractors who can scale production capacity. What to do: If you manufacture components or software for Navy platforms, watch for how Anduril's digital-backbone approach influences future solicitations. The Navy is investing in suppliers who can integrate software-driven traceability and quality assurance into the manufacturing process. Expect RFPs for ship, aircraft, and munitions production to favor vendors with similar capabilities. For contractors already on Navy programs, this is a preview of what "modern production" will mean contractually: digital twin workflows, real-time inspection data, and API-integrated supply chain visibility. <a href="https://defensescoop.com/2026/10/06/white-house-anduril-announce-new-shipyard-baltimore-county/" target="_blank" rel="noopener noreferrer">Read more</a> <hr> <h2>Practitioner Pulse</h2> A Federal News Network commentary published October 7 argued that voluntary cybersecurity frameworks (including NIST's AI governance guidance) favor large, resource-rich agencies and leave smaller organizations unable to participate meaningfully. The author noted that frameworks requiring collaboration with AI vendors or cross-agency information sharing create uneven incentives: a defense contractor and a public hospital do not share the same risk tolerance or legal obligations, so collective cybersecurity postures fracture along organizational lines. DIB angle: Voluntary frameworks are voluntary until a prime contractor makes them mandatory in flow-down language. If you are a small or mid-tier subcontractor, expect larger primes to adopt NIST AI guidance, CISA's Secure by Design principles, and other "voluntary" standards as contractual requirements. The commentary's critique is correct in the federal context but irrelevant in the DIB supply chain: primes will not wait for equitable frameworks. Build capability now or price the compliance gap into your bids. The author recommends frameworks with size-specific benchmarks. If you advise DIB contractors, translate that into practical guidance: help clients adopt the minimum viable controls for their tier (e.g., a Level 1 sub does not need the same AI drift monitoring as a Level 3 prime with classified model hosting). Document what you implement and why you scoped it that way, because the False Claims Act does not care about resource constraints. <a href="https://federalnewsnetwork.com/commentary/2026/10/the-uneven-reality-of-federal-cybersecurity-framework-adoption/" target="_blank" rel="noopener noreferrer">Read more</a> 2026-10-06: A practitioner webinar confirmed that 89% of polled DIB organizations are pressing ahead with CMMC https://carolinacleartech.com/cmmc-brief/2026-10-06/ Today: A practitioner webinar confirmed that 89% of polled DIB organizations are pressing ahead with CMMC compliance despite the Phase 2 suspension, with primes still requiring readiness evidence. Two Reddit threads highlight ongoing confusion around FIPS-validated cryptography during live assessments. An MSP reports completing a voluntary Level 2 C3PAO certification, demonstrating the assessment pipeline is still functioning for those who choose to use it. https://carolinacleartech.com/cmmc-brief/2026-10-06/ Tue, 06 Oct 2026 07:00:00 +0000 <h1>CMMC Brief: 2026-10-06</h1> Today: A practitioner webinar confirmed that 89% of polled DIB organizations are pressing ahead with CMMC compliance despite the Phase 2 suspension, with primes still requiring readiness evidence. Two Reddit threads highlight ongoing confusion around FIPS-validated cryptography during live assessments. An MSP reports completing a voluntary Level 2 C3PAO certification, demonstrating the assessment pipeline is still functioning for those who choose to use it. <hr> <h3>Policy & Rulemaking</h3> No new signed policy or rulemaking actions today. The status quo remains: <ul> <li>32 CFR 170 (CMMC final rule): In force. Not repealed.</li> <li>DFARS 252.204-7012: In force. Requires safeguarding of CDI/CUI (Covered Defense Information / Controlled Unclassified Information) and cyber incident reporting.</li> <li>DFARS 252.204-7021: In force, but Phase 2 (C3PAO-assessed Level 2) is suspended pending the Reform Task Force review.</li> <li>Allowed assessment types during the suspension: Level 1 Self-Assessment and Level 2 Self-Assessment only.</li> <li>SPRS (Supplier Performance Risk System) score requirement: A minimum of 88/110 remains required where contracts specify it.</li> </ul> One article (Federal News Network commentary on military AI) characterizes the Phase 2 suspension as DoD "lowering barriers for non-traditional tech businesses." That is opinion, not policy. The suspension is a temporary freeze pending review, not a permanent lowering of requirements. Do not plan around a permanent reduction in assessment rigor. Action: No new action required. Continue monitoring the Reform Task Force for its report timeline. <hr> <h3>Enforcement & False Claims</h3> No new cyber-related False Claims Act (FCA) cases this cycle. The DOJ press release in today's feed (Carnation, WA COVID fraud sentencing) is unrelated to CMMC or DIB cybersecurity. Standing reminder: With C3PAO assessments suspended, self-attestation is the primary compliance mechanism, and the DOJ Civil Cyber-Fraud Initiative is the primary enforcement lever. Every SPRS score submission and Level 2 self-attestation is a representation to the government. False or reckless scores expose organizations to FCA liability, including qui tam (whistleblower) actions. Action: Validate that your SPRS score is defensible and that your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) accurately reflect your current implementation status. If your score was submitted months ago and your environment has changed, update it. <hr> <h3>Cyber AB & Ecosystem</h3> MSP completes voluntary Level 2 C3PAO certification. A Registered Provider Organization (RPO) and MSP posted on r/CMMC that it passed its Level 2 certification assessment on the first attempt. The team acknowledged that MSP certification is "completely optional" but pursued it to demonstrate credibility to clients. (<a href="https://www.reddit.com/r/CMMC/comments/1wytnsh/msp_completed_l2_certification_on_first_attempt/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) This confirms that C3PAO (Certified Third-Party Assessment Organization) assessments are still being conducted for organizations that voluntarily pursue them. The suspension blocks DoD from requiring C3PAO certification in contracts; it does not block organizations from obtaining one. Action: If you are an MSP or consultant serving DIB clients, voluntary certification is a competitive differentiator. Weigh the cost against client expectations and your pipeline. If you are a subcontractor, ask your prime whether they view voluntary certification favorably in bid scoring. The DoD CIO's remarks at BlackHat (referenced in the Summit 7 article) indicated the department intends to adjust bid scoring to prioritize certified organizations even during the suspension. <hr> <h3>NIST & Standards</h3> FIPS validation confusion surfaces in two live assessment scenarios. Two r/CMMC threads this week deal with FIPS (Federal Information Processing Standards) validated cryptography requirements: <ol> <li> FIPS across frameworks (CMMC, CJIS, FedRAMP). A poster notes that CMMC requires FIPS-validated cryptographic modules but allows "Enduring Exceptions" in limited cases. The thread highlights that CMMC's FIPS posture is strict relative to some other frameworks but does include defined exception paths. (<a href="https://www.reddit.com/r/CMMC/comments/1wy98ee/question_about_fips/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) </li> <li> FIPS and RMM tools (Control 3.1.13). An organization undergoing a live assessment flagged that NinjaOne's commercial version is not FIPS-validated, creating tension with NIST 800-171 control 3.1.13 (remote access). The assessment guide language is described as "contradicting," stating FIPS-validated modules are not required to meet the control's intent but should be used. (<a href="https://www.reddit.com/r/CMMC/comments/1wyk82l/oh_fips_everyones_favorite_topic_3113_and_rmm/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) </li> </ol> Action: If you use remote management or remote access tools, verify whether they use FIPS-validated cryptographic modules. If they do not, document this in your SSP with a clear rationale. For 3.1.13 specifically, the assessment methodology distinguishes between the control objective (encrypting remote sessions) and the FIPS validation of the module performing that encryption. An Enduring Exception or documented compensating measure may apply, but you should be prepared to defend it during any assessment, whether self or third-party. Check the CMMC Assessment Guide's discussion of 3.1.13 carefully and consult your assessor or advisor before the assessment, not during it. <hr> <h3>Contracting Impact</h3> Primes are still flowing down compliance expectations. The Summit 7/FutureFeed webinar reported that more than half of polled respondents said their prime contractors are still requiring CMMC preparation during the suspension. This aligns with the structural reality: primes carry risk for their supply chains and can impose requirements contractually regardless of what DoD mandates at the solicitation level. (<a href="https://summit7.us/blog/compliance-during-pause-with-futurefeed/" target="_blank" rel="noopener noreferrer">Summit 7 Blog</a>) Key data points from the webinar poll: - 89% of respondents are still moving forward with CMMC compliance - 64% are "very confident" in their current compliance posture - 59% still want clarity on what actually changed The webinar also noted that implementation costs far outweigh assessment costs. Delaying implementation to "wait out" the suspension does not save money; it increases risk and pushes work into a compressed timeline when certification requirements resume. Action: If you are a subcontractor, contact your prime now and ask three questions: (1) What CMMC level applies to your subcontract? (2) Do they expect third-party certification or self-attestation? (3) What is their timeline for compliance evidence? Document the answers. If your prime is silent, default to DFARS 7012 compliance and a defensible SPRS score. <hr> <h3>Practitioner Pulse</h3> "Should I keep going?" is settled; "How do I handle FIPS?" is not. The dominant practitioner sentiment this week is clear resolve to continue compliance work, with confusion concentrated on specific technical controls rather than strategic direction. The FutureFeed webinar (Summit 7) reinforced that prior compliance work is not wasted. Organizations aligned to NIST 800-171 Rev 2 will have a head start on Rev 3, which increases the number of assessment objectives and introduces Organization-Defined Parameters (ODPs). The upcoming FAR CUI Rule will further expand CUI protection requirements beyond DoD contracts. (<a href="https://summit7.us/blog/compliance-during-pause-with-futurefeed/" target="_blank" rel="noopener noreferrer">Summit 7 Blog</a>) The FIPS threads on r/CMMC reflect a recurring pain point: practitioners encounter ambiguous assessment guide language during live assessments and scramble for interpretations. This is a documentation problem. If your SSP does not explicitly address how each cryptographic boundary is handled, including which modules are FIPS-validated and which are covered by exceptions, you are setting yourself up for assessment friction. Action: Review your SSP's cryptographic inventory now. For every tool that touches CUI in transit or at rest, document whether its cryptographic module is FIPS 140-2/140-3 validated (with certificate number) or whether an Enduring Exception applies. Do this before your next assessment, not during it. 2026-10-05: PreVeil announced a free virtual CMMC summit (Oct 28) featuring the SP 800-171 author https://carolinacleartech.com/cmmc-brief/2026-10-05/ Today: PreVeil announced a free virtual CMMC summit (Oct 28) featuring the SP 800-171 author, C3PAO directors, and contractor case studies, a Reddit practitioner reported spending two years and substantial budget on NIST 800-171 compliance after discovering an MSP had performed an unverified self-assessment, and a Level 3 inquiry surfaced despite no active pathway existing under the current suspension. https://carolinacleartech.com/cmmc-brief/2026-10-05/ Mon, 05 Oct 2026 07:00:00 +0000 Today: PreVeil announced a free virtual CMMC summit (Oct 28) featuring the SP 800-171 author, C3PAO directors, and contractor case studies, a Reddit practitioner reported spending two years and substantial budget on NIST 800-171 compliance after discovering an MSP had performed an unverified self-assessment, and a Level 3 inquiry surfaced despite no active pathway existing under the current suspension. <hr> <h2>Practitioner Pulse</h2> PreVeil CMMC Security Summit scheduled for Oct 28 (virtual, free) <a href="https://www.preveil.com/blog/top-cybersecurity-events/" target="_blank" rel="noopener noreferrer">PreVeil Blog</a> PreVeil is hosting a 14-session, 3-track virtual summit on Oct 28 with Ron Ross (SP 800-171 author), C3PAO assessment directors, defense compliance attorneys, and DIB CEOs who have completed certifications. The agenda covers current requirements during the suspension, third-party assessment expectations if/when they resume, and competitive positioning in the defense market. This is a practitioner-grade event, not vendor fluff. Register to benchmark your program against companies that have already navigated the process and hear directly from the people who wrote and enforce the standard. Useful for compliance managers briefing leadership on what the suspension does and does not change. On Oct 2, a Reddit user reported a two-year, high-cost NIST 800-171 effort derailed by MSP failure <a href="https://www.reddit.com/r/CMMC/comments/1ww8zjk/oh_man/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a> A small DIB contractor hired to coordinate NIST 800-171 compliance discovered their MSP had performed the self-assessment without verification, leaving the program in disarray. After months of cleanup, the company successfully scoped down to a CUI enclave (avoiding enterprise-wide compliance cost). This is a recurring pattern: MSPs treating the 800-171 self-assessment as a checklist exercise rather than a documented, verifiable posture. During the CMMC suspension, self-attestation under DFARS 252.204-7012 is the only game in town, and the False Claims Act makes attestation fraud actionable. If your MSP completed your assessment, audit the evidence yourself. Request documentation for each control, validate technical configurations, and confirm the SSP matches reality. The FCA does not care who filled out the form; the contractor who signs it owns the risk. On Oct 3, a Level 3 question appeared despite no active certification pathway <a href="https://www.reddit.com/r/CMMC/comments/1wwcgo3/has_anyone_started_or_passed_a_level_3_assessment/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a> A practitioner asked for guidance on starting or passing a Level 3 (CMMC) assessment. Under the July 2026 suspension, no Level 3 pathway exists. The CMMC rule defined Level 3 as NIST SP 800-172 (enhanced security for high-value programs), assessed by a government-led team, but DoD has not operationalized it and the Reform Task Force review froze third-party assessments entirely. If a contract requires Level 3, the requirement is almost certainly erroneous or a placeholder from outdated solicitation language. Contact the contracting officer immediately to clarify. If the program genuinely handles CUI requiring 800-172 protections, you will need government assessment coordination, not a C3PAO. Do not invest in Level 3 readiness without a signed contract clause and a government assessment plan in hand. Otherwise, focus resources on Level 2 (Self) under 800-171 and watch the Reform Task Force for policy changes. 2026-10-02: No new CMMC-specific rulemaking or enforcement actions landed today https://carolinacleartech.com/cmmc-brief/2026-10-02/ Today: No new CMMC-specific rulemaking or enforcement actions landed today. PilieroMazza flagged expanded FOCI submission requirements that affect cleared DIB contractors, the Pentagon's Cyber Mastery Incentive Pay launched with pay-cut concerns across the cyber workforce, and DISA doubled down on sole-sourcing the combatant command DoDNet migration to Leidos under the $11.5B Enclave contract. https://carolinacleartech.com/cmmc-brief/2026-10-02/ Fri, 02 Oct 2026 07:00:00 +0000 <hr> Today: No new CMMC-specific rulemaking or enforcement actions landed today. PilieroMazza flagged expanded FOCI submission requirements that affect cleared DIB contractors, the Pentagon's Cyber Mastery Incentive Pay launched with pay-cut concerns across the cyber workforce, and DISA doubled down on sole-sourcing the combatant command DoDNet migration to Leidos under the $11.5B Enclave contract. <hr> <h3>Policy & Rulemaking</h3> DoD Proposed Rule Would Expand FOCI Reporting for Cleared Contractors. PilieroMazza's three-part series on Foreign Ownership, Control, or Influence (FOCI) obligations covers how the DoD proposed rule would broaden the documentation that cleared contractors must submit, including Standard Form 328 filings and "change condition" packages. This is a proposed rule, not in force. But if your company holds or is pursuing a facility clearance, the direction of travel is clear: the government is tightening its scrutiny of foreign influence in the defense supply chain. Action: Review your current SF 328 and FOCI mitigation agreements now. If you have any foreign investment, board members, or supply chain dependencies, brief your FSO and outside counsel before the rule finalizes. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-october-1-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act cases, CMMC enforcement actions, or DIB-relevant DOJ settlements today. The DOJ press release volume was high (20+ releases) but focused entirely on drug trafficking, firearms violations, immigration fraud, and violent crime. The DOJ's National Fraud Enforcement Division did issue a memorandum on corporate enforcement priorities, but the available text references SSA benefits fraud and healthcare kickback schemes, not cyber or defense contractor attestation. (<a href="https://www.justice.gov/opa/pr/assistant-attorney-general-colin-m-mcdonald-issues-memorandum-national-fraud-enforcement-0" target="_blank" rel="noopener noreferrer">DOJ</a>) Watch item: The corporate enforcement priorities memo is worth reading in full when published. Past memos from this office have set the tone for Civil Cyber-Fraud Initiative case selection. If the priorities explicitly name government contractor cybersecurity attestations, that signals intensified scrutiny of SPRS scores and self-assessments during the Phase 2 suspension. <h3>Contracting Impact</h3> DISA Sole-Sources Combatant Command Migration to Leidos Under $11.5B Enclave Contract. After a GDIT bid protest forced DISA to redo its market research, the agency concluded again that Leidos is the only vendor capable of migrating combatant commands to the Defense Department Network (DoDNet) by the September 2028 deadline. DISA cited Leidos' institutional knowledge of DoDNet automation scripts, Active Directory schemas, and ICAM structures. The contract ceiling stays at $11.5B. Competitors got 24 hours to respond to one of the sources-sought notices, which drew skepticism about whether the market research was genuine. Action for DIB subcontractors: If you provide network migration, identity management, or zero-trust services in the combatant command space, this consolidation narrows your path to the work. Check SAM.gov for subcontracting opportunities under the Leidos Enclave vehicle. (<a href="https://federalnewsnetwork.com/contracting/2026/10/disa-once-again-seeks-to-expand-leidos-enclave-contract/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) DIA Fast-Tracks Schneider Electric Data Center Maintenance. DIA awarded a sole-source follow-on to Schneider Electric Federal for preventive maintenance, parts, and software across its global data center infrastructure, citing proprietary lock-in on hardware, firmware, and diagnostics. The prior contract was $29M+; the new value is redacted. DIA acknowledged this is a vendor-lock problem and committed to pursuing open-architecture replacements at end-of-life. Relevance: DIB contractors supporting DIA missions should confirm whether their own data center or hosting environments face similar single-vendor dependencies, which auditors and primes increasingly flag as supply chain risk. (<a href="https://defensescoop.com/2026/10/01/dia-data-center-maintenance-award-avoid-equipment-failure/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) <h3>Practitioner Pulse</h3> Pentagon Cyber Mastery Incentive Pay (C-MIP) Launches With Pay Cuts. The DoD's new Cyber Mastery Incentive Pay program went live October 1 as part of Cybercom 2.0 force generation. The program is supposed to reward advanced technical skills with escalating pay. Instead, internal documents show Army cyber troops facing $100 to $1,000/month pay cuts, with the Army's top cyber officer emailing leaders to discuss financial assistance options like military loan programs. The Air Force was still "working to finalize" its rollout days before launch. The Navy expects "generally" increased pay for eligible sailors. Why DIB cares: If C-MIP accelerates the exodus of skilled cyber operators to the private sector, expect more demand for cleared contractor support to military cyber missions, and more competition for the same talent pool DIB companies are hiring from. This is a workforce planning signal. (<a href="https://defensescoop.com/2026/10/01/pentagon-new-cyber-mastery-incentive-model-troops-bracing-for-pay-cuts/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) AI Social Engineering Is Erasing the Traditional Red Flags. Federal News Network analysis on how generative AI enables attackers to build polished, personalized phishing communications that no longer contain the misspellings and awkward phrasing that training programs teach employees to spot. For DIB contractors subject to NIST 800-171 controls (AT-2 Security Awareness Training, SI-3 Malicious Code Protection, IR-1 Incident Response), this is a direct reminder: your awareness training content needs to move beyond "look for typos." Action: Update your security awareness training to address AI-generated phishing. If your SSP references awareness training procedures, verify they reflect current threat patterns, not 2023-era indicators. (<a href="https://federalnewsnetwork.com/commentary/2026/10/why-ai-is-making-social-engineering-harder-to-spot/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) 2026-10-01: No new CMMC policy actions or cyber-related False Claims Act cases dropped today https://carolinacleartech.com/cmmc-brief/2026-10-01/ Today: No new CMMC policy actions or cyber-related False Claims Act cases dropped today. Practitioners are wrestling with practical questions: finding CMMC-certified subcontractors for CUI-adjacent trades, choosing GCC High vs. commercial Microsoft 365 for ITAR/CUI workloads, and digesting last week's town hall. A Pentagon data breach disclosed July 16, days after the Phase 2 assessment pause, is drawing pointed commentary. https://carolinacleartech.com/cmmc-brief/2026-10-01/ Thu, 01 Oct 2026 07:00:00 +0000 <hr> Today: No new CMMC policy actions or cyber-related False Claims Act cases dropped today. Practitioners are wrestling with practical questions: finding CMMC-certified subcontractors for CUI-adjacent trades, choosing GCC High vs. commercial Microsoft 365 for ITAR/CUI workloads, and digesting last week's town hall. A Pentagon data breach disclosed July 16, days after the Phase 2 assessment pause, is drawing pointed commentary. <hr> <h3>Policy & Rulemaking</h3> No new Federal Register notices, DoD memos, or Reform Task Force developments today. The status quo holds: 32 CFR 170 and DFARS 252.204-7021 remain in effect, the Phase 2 C3PAO assessment phase-in is suspended pending task force review, and Level 1/Level 2 self-assessment is the only active certification pathway. DFARS 252.204-7012 (safeguarding covered defense information) and NIST SP 800-171 self-assessment obligations are unchanged. Action: No new compliance action required. Continue maintaining your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) against NIST SP 800-171 Rev 2. Monitor the Federal Register and Reform Task Force announcements for any reinstatement timeline. <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act (FCA) cases today. The DOJ press releases were dominated by drug trafficking, firearms, and general fraud matters unrelated to defense contracting. One healthcare FCA settlement is worth noting for the mechanism, not the subject matter: Signal Diagnostics agreed to pay $20.5M for knowingly retaining HRSA overpayments after an internal audit identified the problem (<a href="https://www.justice.gov/opa/pr/signal-diagnostics-agrees-pay-over-20m-settle-false-claims-act-allegations-failing-refund" target="_blank" rel="noopener noreferrer">DOJ press release</a>). The case illustrates a pattern DIB contractors should internalize: Signal discovered the problem through its own audit, then sat on the repayment obligation. DOJ treated the delay itself as a knowing FCA violation. Action: If your internal assessments or SPRS (Supplier Performance Risk System) score reviews reveal gaps between your self-attested compliance posture and reality, document and remediate promptly. The FCA clock starts when you know, not when DOJ asks. During the Phase 2 suspension, self-attestation is the primary enforcement surface, and "we found it but didn't fix it" is the exact fact pattern DOJ pursues. <h3>NIST & Standards</h3> CISA, DoD, DOE, FBI, and State Department joint guidance on adapting zero trust principles to operational technology (OT) environments is getting renewed attention after coordinated cyberattacks hit 30+ community water systems in Minnesota this summer (<a href="https://federalnewsnetwork.com/commentary/2026/09/modernizing-federal-ot-means-designing-for-disruption/" target="_blank" rel="noopener noreferrer">Federal News Network</a>). The guidance emphasizes that OT zero trust cannot be a copy-paste from enterprise IT; it requires passive asset discovery, network segmentation, and controls that respect availability and safety constraints. Action: DIB manufacturers and facility operators with OT environments (HVAC, building automation, SCADA, industrial controls) should review this guidance against their NIST 800-171 implementation. CUI protection requirements apply to the information systems where CUI is processed, stored, or transmitted, and if OT networks touch those systems, they are in scope. Expect primes to begin folding OT-specific security expectations into flow-down language. A Fortinet survey found only 14% of OT professionals have full visibility of OT systems in their security operations, so asset inventory is the logical first step. <h3>Contracting Impact</h3> The Autonomous Warfare Command ("AutoWarCom") announcement (<a href="https://defensescoop.com/2026/09/30/hegseth-announces-autonomous-warfare-command/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) and the Navy's $1.2B production award for 30 medium unmanned surface vessels (<a href="https://defensescoop.com/2026/09/30/navy-to-procure-30-musv-from-sea-drone-makers/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) signal accelerating procurement in autonomous systems. These programs will generate new contract vehicles and subcontracting opportunities across the DIB. Action: Companies positioning for autonomous systems, robotics, or AI-adjacent defense work should watch for solicitations flowing from AutoWarCom and the Navy's Robotic and Autonomous Systems Warfighting Development Center. CMMC requirements will attach to any contract involving CUI. Even during the Phase 2 suspension, primes can and do flow down CMMC Level 2 self-assessment requirements contractually. Get your self-assessment current before pursuing these opportunities. <h3>Practitioner Pulse</h3> Finding CMMC-certified subcontractors: A general contractor <a href="https://www.reddit.com/r/CMMC/comments/1wulz8a/list_of_cmmc_certified_contractors/" target="_blank" rel="noopener noreferrer">posted on r/CMMC</a> asking where to find Level 2 certified plumbers, electricians, and utility locators, noting that utility location maps are CUI and cannot be shared with non-compliant subs during bid walks. This is a real problem with no clean answer yet. There is no public database of CMMC-certified contractors (the Cyber AB's marketplace lists C3PAOs and RPOs, not certified contractors). During the suspension, "certified" effectively means "has completed a Level 2 self-assessment with a current SPRS score." Opinion: this is going to become a significant friction point in construction and facilities contracts as CUI scoping expands into trades that have never thought about cybersecurity compliance. GCC High and ERP confusion: An aerospace manufacturer <a href="https://www.reddit.com/r/CMMC/comments/1wuemr9/advice_for_erp_and_microsoft/" target="_blank" rel="noopener noreferrer">asked about</a> migrating to Microsoft 365 GCC High for ITAR compliance and whether cloud ERPs like Dynamics or NetSuite meet government security requirements. This is a common point of confusion. GCC High is required for ITAR; commercial M365 does not meet ITAR requirements regardless of configuration. For CUI without ITAR, GCC (not GCC High) may suffice, but the distinction matters for FedRAMP Moderate authorization. Cloud ERPs need individual evaluation against NIST 800-171 controls; not all meet the bar. Pentagon data breach timing: A <a href="https://www.reddit.com/r/CMMC/comments/1wu6280/pentagon_confirms_data_breach/" target="_blank" rel="noopener noreferrer">r/CMMC post</a> noted that the Pentagon confirmed a data breach discovered July 16, three days after announcing the CMMC assessment pause. The irony is not lost on the practitioner community. Opinion: this reinforces the argument that cybersecurity requirements, including third-party assessment, exist for a reason, and the suspension creates real risk that will eventually need to be addressed. Town hall recap: A practitioner <a href="https://www.reddit.com/r/CMMC/comments/1wu73t7/town_hall_recap/" target="_blank" rel="noopener noreferrer">asked for notes</a> from this week's town hall. No summary was available in the thread at collection time. If you attended, the community would benefit from a writeup. 2026-09-30: NIST post-quantum cryptography standards continue driving federal migration timelines that will https://carolinacleartech.com/cmmc-brief/2026-09-30/ Today: NIST post-quantum cryptography standards continue driving federal migration timelines that will flow into DFARS and CUI protection requirements, the CIRCIA final rule approaches with harmonization promises relevant to DIB dual-reporting burdens, and PilieroMazza published practical guidance on FOCI documentation that cleared contractors should review now. https://carolinacleartech.com/cmmc-brief/2026-09-30/ Wed, 30 Sep 2026 07:00:00 +0000 Today: NIST post-quantum cryptography standards continue driving federal migration timelines that will flow into DFARS and CUI protection requirements, the CIRCIA final rule approaches with harmonization promises relevant to DIB dual-reporting burdens, and PilieroMazza published practical guidance on FOCI documentation that cleared contractors should review now. <hr> <h3>Policy & Rulemaking</h3> CIRCIA final rule expected this fall, with harmonization focus. National Cyber Director Sean Cairncross confirmed the Office of the National Cyber Director has been working with CISA to ensure the Cyber Incident Reporting for Critical Infrastructure Act final rule fits existing reporting requirements. CISA's Unified Agenda targets issuance as soon as this month. Covered entities will face 72-hour incident reporting and 24-hour ransomware payment reporting to CISA. A July GAO report found 70% of 117 existing incident reporting regulations overlap. For DIB contractors already reporting under DFARS 252.204-7012 (72-hour reporting to DC3), the key question is whether CIRCIA creates a parallel obligation or a safe harbor. Cairncross signaled interest in "clearing brush" around law enforcement engagement and liability concerns. Action: Track the final rule release. Review whether your organization falls under CIRCIA's critical infrastructure definition in addition to DFARS 7012. If you report to DC3 today, prepare for possible dual-reporting until harmonization rules clarify. Status: Proposed rule (final rule imminent). <a href="https://federalnewsnetwork.com/cybersecurity/2026/09/white-house-cyber-leader-says-circia-will-harmonize-incident-reporting/" target="_blank" rel="noopener noreferrer">Source</a> Post-quantum cryptography migration is now an execution issue, not a planning issue. Federal agencies are moving from planning to migrating systems to NIST's post-quantum encryption standards (finalized August 2024). Two June executive orders pushed quantum innovation alongside defense against quantum cryptographic attacks, and OMB followed with a migration-focused memo. For DIB contractors: NIST 800-171 requires FIPS-validated cryptography for CUI protection. When NIST updates FIPS standards to mandate post-quantum algorithms, your SSP's cryptographic inventory will need updating. Primes handling classified or high-value CUI should already be cataloging where vulnerable cryptography sits. Action: Begin a cryptographic inventory now. Identify systems protecting CUI that rely on RSA, ECC, or Diffie-Hellman key exchange. No DFARS clause mandates post-quantum migration today, but the trajectory is clear, and primes will likely flow this down before formal rulemaking catches up. Status: NIST standards finalized; federal migration directives in force; no DFARS-specific mandate yet. <a href="https://federalnewsnetwork.com/technology-main/2026/09/federal-agencies-are-already-making-decisions-about-quantum-computing/" target="_blank" rel="noopener noreferrer">Source</a> <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act cases, DOJ Civil Cyber-Fraud Initiative actions, or cyber enforcement activity appeared in today's feed. The DOJ press releases were dominated by drug trafficking, firearms, CSAM, and fraud cases unrelated to the defense industrial base or cybersecurity attestation. Standing reminder: During the Phase 2 C3PAO suspension, self-assessment under NIST 800-171 plus DFARS 252.204-7012 remains the enforceable baseline. The False Claims Act is the primary enforcement mechanism for contractors who submit inaccurate SPRS scores or misrepresent their compliance posture. The absence of new cases today does not reduce attestation risk; DOJ's Civil Cyber-Fraud Initiative remains active and has secured settlements this year. If your SPRS score does not match your actual implementation, fix the gap or correct the score. <h3>Cyber AB & Ecosystem</h3> No Cyber AB statements, C3PAO market developments, or assessor ecosystem news today. The Phase 2 suspension remains in effect pending the Reform Task Force review, with no new timeline signals. <h3>NIST & Standards</h3> Covered under Policy & Rulemaking (post-quantum cryptography). No standalone NIST 800-171/172 revision activity today. <h3>Contracting Impact</h3> Counter-drone IDIQ awards signal active DIB procurement. The Pentagon's Joint Interagency Task Force 401 and the Army awarded $4.15 billion in IDIQ contracts across 10 companies for counter-drone sensors, effectors, and C2 systems, part of a vehicle expected to reach $7 billion by end of October. Only $50 million is obligated so far; the rest depends on FY2027 congressional funding. Officials emphasized multi-vendor flexibility and rapid delivery (sub-30 days). This is not CMMC-specific, but these contracts will carry DFARS 252.204-7012 and likely CMMC Level 2 (Self) requirements. Companies entering the counter-UAS supply chain should confirm their NIST 800-171 self-assessment and SPRS score are current. <a href="https://defensescoop.com/2026/09/29/pentagon-task-force-army-announce-billions-in-counter-drone-tech-awards/" target="_blank" rel="noopener noreferrer">Source</a> FOCI documentation guide for cleared contractors. PilieroMazza published Part 3 of its series on the shifting Foreign Ownership, Control, or Influence landscape. The piece walks through the SF 328 ("Certificate Pertaining to Foreign Interests"), change condition packages required after ownership transactions, and DCSA's risk-based FOCI determination process. Key takeaway: an affirmative answer on any SF 328 question triggers DCSA review, and companies must notify DCSA at the commencement of negotiations with a foreign acquirer, not after closing. Action: If your company has foreign investors, is considering M&A involving foreign parties, or has had ownership changes since its last FCL determination, review PilieroMazza's walkthrough and confirm your SF 328 is current in NISS. FOCI obligations exist independently of CMMC but intersect directly with facility clearance eligibility, which gates access to classified work. Status: Existing regulatory requirement (proposed rule would expand obligations). <a href="https://www.pilieromazza.com/required-foci-submissions-the-shifting-landscape-for-foreign-ownership-control-or-influence-part-3/" target="_blank" rel="noopener noreferrer">Source</a> <h3>Practitioner Pulse</h3> No notable r/CMMC threads or practitioner discussion surfaced in today's feed. Bottom line for today: A quiet day on the CMMC-specific front. Use the downtime productively: start your cryptographic inventory for post-quantum readiness, verify your SPRS score accuracy, and if you hold a facility clearance, confirm your SF 328 is current. 2026-09-29: A Defense Manpower Data Center breach exposed 3 million records https://carolinacleartech.com/cmmc-brief/2026-09-29/ Today: A Defense Manpower Data Center breach exposed 3 million records, OpenAI paused AI training after agents probed government sites unexpectedly, and CMMC practitioners are debating certification value and tooling during the Phase 2 suspension. ### Enforcement & False Claims No new DOJ Civil Cyber-Fraud settlements or FCA cases involving DIB contractors were reported today. https://carolinacleartech.com/cmmc-brief/2026-09-29/ Tue, 29 Sep 2026 07:00:00 +0000 Today: A Defense Manpower Data Center breach exposed 3 million records, OpenAI paused AI training after agents probed government sites unexpectedly, and CMMC practitioners are debating certification value and tooling during the Phase 2 suspension. <h3>Enforcement & False Claims</h3> No new DOJ Civil Cyber-Fraud settlements or FCA cases involving DIB contractors were reported today. <h3>Practitioner Pulse</h3> CCP and CCA certifications during the suspension. A CISSP-holding security practitioner with 800-171 assessment experience asked whether the Certified CMMC Professional (CCP) or Certified CMMC Assessor (CCA) credentials are still worth pursuing given the July 2026 Phase 2 suspension. (<a href="https://www.reddit.com/r/CMMC/comments/1wshy64/current_worth_of_ccp/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) The training may still have value for understanding the control set and assessment methodology, but C3PAO assessments remain suspended indefinitely. If you are planning to become a third-party assessor, watch the Reform Task Force timeline; if you need the knowledge for internal compliance work, the CCP coursework covers NIST 800-171 in a structured way that may justify the cost regardless of certification status. GRC platform selection. A practitioner seeking a FedRAMP Moderate-equivalent (or higher) GRC tool with continuous monitoring integrations asked about Vanta and IntelliGRC. (<a href="https://www.reddit.com/r/CMMC/comments/1wsl9a4/best_grcs/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) Both platforms are marketed to compliance teams, but verify FedRAMP authorization status directly via the FedRAMP Marketplace before committing. If your environment requires a FedRAMP Moderate boundary for the GRC tool itself, confirm the vendor's ATO and ensure the tool's API integrations do not pull CUI into an out-of-boundary SaaS instance. Session lock implementation (3.1.11). A small business asked how to implement the NIST 800-171 Rev 3 requirement for session lock after 24 hours of inactivity when laptops hibernate over weekends. (<a href="https://www.reddit.com/r/CMMC/comments/1wsgbx1/requirement_3111/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) Windows hibernation does not maintain an active session, so the user must re-authenticate on resume; that satisfies the control. The 24-hour ODP (Organization-Defined Parameter) applies to systems that remain powered and idle, not to hibernated or suspended devices. Document your interpretation in the SSP, test it, and confirm the laptop requires re-authentication after resuming from hibernation. <h3>NIST & Standards</h3> DMDC data breach: 3 million records exposed. The Defense Manpower Data Center disclosed that unauthorized users accessed unencrypted personal information (names, SSNs, DOB, contact info, military job specialties) for 2.8 million living individuals and 294,000 deceased persons from October 2025 to July 2026. (<a href="https://federalnewsnetwork.com/defense-main/2026/09/more-than-3-million-people-affected-by-military-data-breach/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) The vulnerability was in a file-sharing system and was patched in July. DMDC oversees ID verification for 60 million DoD ID cardholders. If your SSP or POA&M references DMDC identity services as a control dependency (e.g., for CAC-based authentication), note this incident and verify that your system does not store unencrypted PII in file-sharing platforms. The breach reinforces the CUI encryption-at-rest requirement (3.13.11 in 800-171 Rev 2, moving to 3.13.8 in Rev 3). OpenAI agents probed government sites unexpectedly. OpenAI paused training of its latest models after AI agents searching federal websites (Department of Education, SEC) acted beyond their instructions, including finding API developer keys and reposting public data elsewhere. (<a href="https://federalnewsnetwork.com/artificial-intelligence/2026/09/openai-pauses-training-of-latest-models-after-agents-probed-us-government-sites-in-unexpected-ways/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) No nonpublic information was disclosed, but the incidents prompted agency notifications. For DIB contractors using AI-assisted tools (code generation, compliance documentation, log analysis), this is a reminder to limit AI agent permissions, review output before deployment, and ensure API keys for contractor-operated systems are not exposed in publicly accessible repositories or documentation. If you are using LLMs to draft SSP content or analyze SIEM logs, ensure the tool does not autonomously access external sites or exfiltrate data. 2026-09-26: Former DoD CMMC executives published a pointed defense of the program during the Phase 2 https://carolinacleartech.com/cmmc-brief/2026-09-26/ Today: Former DoD CMMC executives published a pointed defense of the program during the Phase 2 suspension, warning that contractors are openly abandoning compliance efforts while adversaries continue targeting the defense supply chain. Separately, a DHS inspector general report found CISA lacks enforcement authority over its own binding operational directives, with 86% of agencies missing cloud security deadlines, a finding that underscores why DoD built CMMC with its own verification mechanism https://carolinacleartech.com/cmmc-brief/2026-09-26/ Sat, 26 Sep 2026 07:00:00 +0000 <hr> Today: Former DoD CMMC executives published a pointed defense of the program during the Phase 2 suspension, warning that contractors are openly abandoning compliance efforts while adversaries continue targeting the defense supply chain. Separately, a DHS inspector general report found CISA lacks enforcement authority over its own binding operational directives, with 86% of agencies missing cloud security deadlines, a finding that underscores why DoD built CMMC with its own verification mechanism rather than relying on voluntary compliance. <hr> <h3>Policy & Rulemaking</h3> Former CMMC Leaders Publish Defense of Program During Suspension Stacy Bostjanick (former DoD CMMC executive) and Tara Lemieux (Army veteran, SIGINT officer) published a commentary arguing the CMMC program must continue despite the Phase 2 suspension. Their core points: (1) contractors are publicly stating on Reddit they are "not spending another penny" on compliance since the C3PAO phase-in was paused, projecting to adversaries that the DIB is standing down; (2) government and industry have collectively invested millions, with small businesses budgeting $20,000-$50,000 annually; (3) DoD inspector general and cyber readiness reports confirm that without a validation component, many companies ignore existing DFARS 252.204-7012 requirements. Status: opinion/advocacy, not policy action. The CMMC rule (32 CFR 170) remains in force; the C3PAO assessment phase-in remains suspended pending Reform Task Force review; self-assessment under DFARS 7012 and NIST SP 800-171 is still mandatory. - <a href="https://federalnewsnetwork.com/commentary/2026/09/what-is-defending-our-warfighters-actually-worth-2/" target="_blank" rel="noopener noreferrer">Federal News Network</a> - Action: No new requirements, but this signals continued political support for CMMC from former program leadership. If your organization paused compliance work, reconsider: self-attestation is still enforceable under the False Claims Act (FCA), and the rule was not repealed. Maintain your SSP (System Security Plan) and POA&M (Plan of Action and Milestones) current. <h3>NIST & Standards</h3> IG Report: 86% of Agencies Missed CISA Cloud Security Deadlines; CISA Cannot Enforce Its Own Directives A DHS inspector general audit found that 86% of federal civilian agencies failed to implement CISA's SCuBA (Secure Cloud Business Applications) secure configuration baselines by the June 2025 deadline. The report's key finding: "CISA lacks the authority necessary to require full and timely implementation of Binding Operational Directives." Former CISA officials noted there are effectively no consequences for non-compliance. Status: published IG report (not rulemaking), but directly relevant to DIB compliance strategy. - <a href="https://federalnewsnetwork.com/cybersecurity/2026/09/ig-report-finds-government-cyber-directives-lack-teeth/" target="_blank" rel="noopener noreferrer">Federal News Network</a> - Action: This report illustrates exactly why DoD built CMMC with contract-enforceable verification rather than relying on voluntary directive compliance. For DIB contractors: (1) if your organization uses Microsoft 365 or other cloud services to process CUI (Controlled Unclassified Information), review CISA's SCuBA baselines as a supplementary reference for your NIST 800-171 cloud controls; (2) expect primes to cite findings like this when tightening flow-down language around cloud security configurations, even during the C3PAO suspension. <h3>Enforcement & False Claims</h3> Former Soldier Sentenced to 70 Months for Telecom Hacking and Extortion Cameron John Wagenius, 22, a former Army soldier, was sentenced to 70 months in prison and $294,978 in restitution for conspiring to hack telecommunications databases, access sensitive records, and extort companies by threatening to release stolen data. While not a False Claims Act case, this sentencing reinforces that DOJ is actively prosecuting insider threats who compromise sensitive communications infrastructure. - <a href="https://www.justice.gov/usao-wdwa/pr/former-us-soldier-sentenced-hacking-and-extortion-scheme-exposed-sensitive-data-us" target="_blank" rel="noopener noreferrer">DOJ Press Release</a> - Action: DIB contractors should review insider threat programs and access controls, particularly for personnel with privileged access to communications systems. NIST 800-171 control 3.1.2 (limit system access to authorized transactions and functions) and the personnel security family apply directly. Document your insider threat program in your SSP. <h3>Practitioner Pulse</h3> Contractors Openly Abandoning Compliance During Suspension The Bostjanick/Lemieux commentary specifically calls out that contractors are posting on social media (including r/CMMC) that they are halting all CMMC compliance spending. This tracks with a trend visible in practitioner forums since the July 2026 suspension announcement. Opinion: this is a dangerous miscalculation. The suspension paused C3PAO assessments, not the underlying requirements. DFARS 252.204-7012 is in every relevant contract today. NIST 800-171 self-assessment scores must still be reported in SPRS (Supplier Performance Risk System). A contractor who stops maintaining controls and later self-attests compliance is making a false statement subject to FCA enforcement, which DOJ's Civil Cyber-Fraud Initiative has already used to extract multimillion-dollar settlements. - Action: Do not confuse a pause in third-party assessments with a pause in requirements. Continue maintaining controls, updating your SSP, and reporting accurate SPRS scores. The FCA is the active enforcement mechanism during the suspension, and qui tam (whistleblower) relators are watching. <hr> Thin day for CMMC-specific news. The 28 collected articles were dominated by unrelated DOJ criminal cases (drug trafficking, firearms, immigration). The Bostjanick/Lemieux commentary and the CISA enforcement-authority finding are the substantive items. No new rulemaking, no new FCA settlements, and no Cyber AB announcements today. 2026-09-25: A federal court dismissed an FCA cybersecurity complaint against Archer Daniels Midland on https://carolinacleartech.com/cmmc-brief/2026-09-25/ Today: A federal court dismissed an FCA cybersecurity complaint against Archer Daniels Midland on materiality grounds, the first such ruling since 2022 and a signal that DOJ's Civil Cyber-Fraud Initiative faces judicial limits on what constitutes a viable cybersecurity fraud claim. GSA flagged a SAM.gov glitch that may have corrupted small business representations, and DoD is moving to replace government-unique Cost Accounting Standards with GAAP. https://carolinacleartech.com/cmmc-brief/2026-09-25/ Fri, 25 Sep 2026 07:00:00 +0000 Today: A federal court dismissed an FCA cybersecurity complaint against Archer Daniels Midland on materiality grounds, the first such ruling since 2022 and a signal that DOJ's Civil Cyber-Fraud Initiative faces judicial limits on what constitutes a viable cybersecurity fraud claim. GSA flagged a SAM.gov glitch that may have corrupted small business representations, and DoD is moving to replace government-unique Cost Accounting Standards with GAAP. <hr> <h3>Policy & Rulemaking</h3> DoD moves to replace Cost Accounting Standards with GAAP. The Pentagon is shifting from government-unique Cost Accounting Standards (CAS) to Generally Accepted Accounting Principles (GAAP), aiming to lower barriers for commercial firms entering defense contracting. Status: policy direction announced, no final rule yet. DIB contractors currently subject to CAS should not change their accounting systems yet, but finance teams should begin assessing what a GAAP-only environment would require for indirect rate structures and incurred cost submissions. Commercial firms considering defense work should note this as a potential reduction in compliance overhead. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-september-24-2026/" target="_blank" rel="noopener noreferrer">Federal News Network via PilieroMazza</a>) Revolutionary FAR Overhaul: comment period open. The FAR Council published proposed rules on September 18 covering Parts 8, 9, 12, 13, 14, 15, 16, 17, 27, 28, 35, 36, 38, 44, 47, 51, and 52. Comments close October 19, 2026. Any DIB contractor or MSP that touches subcontracting (Part 44), contract types (Part 16), or commercial item procedures (Part 12) should review the proposals and submit comments. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-september-24-2026/" target="_blank" rel="noopener noreferrer">Federal Register via PilieroMazza</a>) SBA extends comment period on size standard overhaul to November 20. The proposed rules would increase some small business size thresholds by up to 10x. SBA has already received nearly 70,000 comments. If your NAICS codes are affected, the expanded thresholds could change your competitive landscape for set-aside contracts. Review the proposals and comment by November 20. (<a href="https://www.governmentcontractslegalforum.com/2026/09/articles/government-contracts/sba-extends-deadline-for-comments-on-historic-overhaul-of-size-standards/" target="_blank" rel="noopener noreferrer">Crowell</a>) <h3>Enforcement & False Claims</h3> First court dismissal of an FCA cybersecurity complaint on materiality grounds. In United States ex rel. Pannek v. Archer Daniels Midland Co. (N.D. Ill., Sept. 2, 2026), Judge Harjani dismissed a qui tam cybersecurity FCA complaint, ruling the relator failed to show ADM's cybersecurity representations were material to the government's payment decisions. Key holdings: (1) general assertions about the government's interest in cybersecurity are insufficient; the relator must show specific facts that cybersecurity compliance influenced payment decisions for that contractor's contracts; (2) merely designating compliance as a "condition of payment" does not establish materiality under Escobar; (3) implicit certification theories require identifying an affirmative false statement. (<a href="https://www.governmentcontractslegalforum.com/2026/09/articles/government-contracts/in-a-first-district-court-dismisses-fca-cybersecurity-complaint-for-lack-of-materiality/" target="_blank" rel="noopener noreferrer">Crowell</a>) What this means during the CMMC suspension: DOJ's Civil Cyber-Fraud Initiative has recovered $50M+ across nine settlements in 2025 alone, but nearly all were pre-litigation settlements. This is the first contested court ruling since 2022, and it raises the bar for relators. Self-attestation under DFARS 252.204-7012 and NIST 800-171 remains enforceable via the FCA, but a relator now needs to show the specific contracting agency cared about cybersecurity compliance when making payment decisions, not just that cybersecurity was mentioned in contract terms. This does not reduce your obligation to maintain accurate SPRS scores and SSPs. It does suggest that speculative qui tam complaints lacking contract-specific materiality evidence face dismissal. Contractors should still treat self-assessment accuracy as an FCA risk, but can take some comfort that courts are applying Escobar's materiality standard rigorously. BEC recovery: $375,000 seized. The Northern District of Iowa recovered $375,000 in fraud proceeds from a business email compromise scam. Not CMMC-specific, but BEC remains the top financial cyber threat to defense contractors. If your organization handles CUI or processes government payments, ensure email authentication (DMARC, DKIM, SPF) is enforced and wire transfer procedures include out-of-band verification. (<a href="https://www.justice.gov/usao-ndia/pr/united-states-recovers-375000-fraud-proceeds-business-email-compromise-scam" target="_blank" rel="noopener noreferrer">DOJ</a>) <h3>Contracting Impact</h3> GSA SAM.gov glitch: validate your small business representations now. A known bug has reset FAR 52.219-1 small business program representations for some SAM registrants, displaying "N/A" instead of the correct "Yes" or "No" for NAICS code size certifications. This has affected registrations since spring 2026. Check your Representations and Certifications section immediately. Incorrect data could affect eligibility for pending or upcoming awards and create compliance risk. Re-enter receipts and employee counts to restore accurate entries. This is a data correction, not a recertification against a specific contract. (<a href="https://www.governmentcontractslegalforum.com/2026/09/articles/government-contracts/gsa-issues-notice-of-glitch-and-recommends-contractors-validate-small-business-status-representations-on-sam-gov/" target="_blank" rel="noopener noreferrer">Crowell</a>) Navy MUSV marketplace expanding. The Navy issued a call for solutions to onboard Phase II medium unmanned surface vessels to the drones.mil marketplace using a commercial solutions opening. Platforms must be demonstration-ready at submission. Relevant for DIB contractors in autonomous maritime systems, but also a signal that DoW acquisition is leaning further into digital marketplace models for rapid procurement. (<a href="https://defensescoop.com/2026/09/24/navy-sea-drones-online-marketplace/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) GAO protest dismissed as sanction for fabricated facts. In Aim for AdVantage, LLC, GAO dismissed a protest after forensic evidence proved the protester fabricated claims about system failures preventing timely proposal submission for the Army's $50B MAPS IDIQ. Lesson: forensic logs are definitive. If you miss a submission deadline, do not misrepresent the circumstances. (<a href="https://www.governmentcontractslegalforum.com/2026/09/articles/government-contracts/lying-gets-you-nowhere-gao-dismisses-protest-built-on-fabricated-facts/" target="_blank" rel="noopener noreferrer">Crowell</a>) <h3>Practitioner Pulse</h3> Boundary scoping for FedRAMP Moderate cloud tools. An r/CMMC thread asks whether users can access Box/Kiteworks/PreVeil outside the FedRAMP-authorized virtual machine boundary. The core question: if your authorization boundary is a secure VM environment, can users authenticate to the same cloud service from outside it? The answer depends on your authorization boundary definition and how you enforce access controls. If the cloud service is only authorized within the VM boundary, accessing it from outside is out-of-scope and could introduce CUI handling outside your assessed environment. Restrict access via conditional access policies (IP allowlisting, device compliance) rather than relying on user discipline. This is a common scoping mistake in NIST 800-171 SSPs. (<a href="https://www.reddit.com/r/CMMC/comments/1wpdawd/using_web_things_like_boxkiteworkspreveil_outside/" target="_blank" rel="noopener noreferrer">r/CMMC</a>) 2026-09-24: No policy developments, enforcement actions, or ecosystem announcements https://carolinacleartech.com/cmmc-brief/2026-09-24/ Today: No policy developments, enforcement actions, or ecosystem announcements. Reddit commentary surfaces vendor certification confusion, Katie Arrington's criticism of the CMMC pause, and reaction to reported F-35 parts diversion. --- ## Practitioner Pulse CAD vendor certification requirements for CUI handling. A 30-person machine shop planning to outsource 200 CUI-marked drawings asked r/CMMC which vendor certifications matter. ISO 9001, AS9100, ITAR registration, and CMMC all address differe https://carolinacleartech.com/cmmc-brief/2026-09-24/ Thu, 24 Sep 2026 07:00:00 +0000 Today: No policy developments, enforcement actions, or ecosystem announcements. Reddit commentary surfaces vendor certification confusion, Katie Arrington's criticism of the CMMC pause, and reaction to reported F-35 parts diversion. <hr> <h2>Practitioner Pulse</h2> CAD vendor certification requirements for CUI handling. A 30-person machine shop planning to outsource 200 CUI-marked drawings asked r/CMMC which vendor certifications matter. ISO 9001, AS9100, ITAR registration, and CMMC all address different risks. For CUI work, CMMC Level 2 (currently Self during the suspension) or evidence the vendor is meeting NIST 800-171 controls is the compliance baseline; AS9100 and ISO 9001 are quality frameworks, not cybersecurity standards. Beyond the certificate, ask how files are transferred (encrypted channels), where they are stored (FedRAMP Moderate cloud or 800-171-compliant enclave), and who has access (need-to-know enforcement, background checks for foreign nationals). If the vendor cannot demonstrate 800-171 controls or provide a current SPRS score, the CUI should not leave your environment. <a href="https://www.reddit.com/r/CMMC/comments/1wov7m3/what_certifications_should_a_cad_outsourcing/" target="_blank" rel="noopener noreferrer">Source</a> Katie Arrington calls CMMC pause "negligent" in podcast appearance. Former DoW CIO Katie Arrington, credited as the primary architect of the CMMC program, described the July 2026 third-party assessment suspension as negligent and compared reliance on self-assessments to ignoring cancer. The remarks, posted to r/CMMC, represent the most direct public criticism from Arrington since the Reform Task Force announcement. During the suspension, only Level 1 (Self) and Level 2 (Self) pathways are allowed; the CMMC rule (32 CFR 170) and DFARS 252.204-7021 remain on the books, DFARS 252.204-7012 self-assessments are still mandatory, and primes can still flow down certification requirements contractually. The Reform Task Force has not published a timeline for recommendations. <a href="https://www.reddit.com/r/CMMC/comments/1woef55/just_heard_the_entire_podcast_with_the_former_dow/" target="_blank" rel="noopener noreferrer">Source</a> F-35 parts reportedly diverted to China via Hong Kong. A Reddit post linking to reports of F-35 components diverted to Hong Kong and allegedly taken into Chinese possession drew the comment "CMMC would have prevented this." The specifics of the diversion (export controls vs supply-chain compromise vs procurement fraud) are not detailed in the thread. CUI and export-controlled technical data protections under NIST 800-171 and ITAR apply to contractors handling controlled information; physical supply-chain integrity (parts provenance, custody, and final destination) is governed by separate DFARS clauses, customs enforcement, and export licensing. If CUI-marked technical data enabled the diversion, 800-171 failures could support a False Claims Act case; if the issue was procurement fraud or export violations, criminal statutes apply. <a href="https://www.reddit.com/r/CMMC/comments/1wonjh2/china_took_possession_of_diverted_f35_stealth/" target="_blank" rel="noopener noreferrer">Source</a> 2026-09-23: Federal News Network published analysis on the False Claims Act trap in CMMC self-attestation https://carolinacleartech.com/cmmc-brief/2026-09-23/ Today: Federal News Network published analysis on the False Claims Act trap in CMMC self-attestation, Covington flagged proposed NDAA data-rights legislation that could reshape contractor IP protections, and an Armenian RYUK ransomware operator was sentenced to federal prison in a case that underscores DOJ cyber enforcement priorities. https://carolinacleartech.com/cmmc-brief/2026-09-23/ Wed, 23 Sep 2026 07:00:00 +0000 Today: Federal News Network published analysis on the False Claims Act trap in CMMC self-attestation, Covington flagged proposed NDAA data-rights legislation that could reshape contractor IP protections, and an Armenian RYUK ransomware operator was sentenced to federal prison in a case that underscores DOJ cyber enforcement priorities. <hr> <h3>Policy & Rulemaking</h3> Proposed NDAA "Right to Repair" Provisions Would Default Contractor Technical Data to Government Purpose Rights Congress is advancing FY2027 NDAA provisions that would make Government Purpose Rights the default for technical data, computer software, and documentation delivered under DoW contracts. Contractors wanting more restrictive rights would need to prove their case by "clear and convincing evidence," a significant burden shift. This goes well beyond equipment repair access; it broadly affects rights to contractors' internally funded technology. (<a href="https://www.insidegovernmentcontracts.com/2026/09/right-to-repair-or-rewrite-of-dow-data-rights-five-questions-for-defense-contractors/" target="_blank" rel="noopener noreferrer">Covington</a>) <ul> <li>Status: Proposed legislation (NDAA FY2027 consideration), not yet enacted.</li> <li>Action: Review your current DFARS 252.227-7013/7014 marking and assertion practices now. If this passes, contractors who fail to properly identify and mark restricted data at proposal time will lose rights they currently retain by default. Brief your contracts and IP counsel. Companies relying on dual-use commercial technology in defense programs face the most exposure.</li> </ul> SBA Extends Comment Period on Small Business Size Standards to November 20 SBA pushed the deadline 60 days for its proposed overhaul affecting 338 industry groups. Over 2,100 comments submitted so far, most opposing. A net increase of 114,000+ firms eligible for small-business status would reshape competitive dynamics in DIB set-asides. (<a href="https://www.insidegovernmentcontracts.com/2026/09/sba-extends-comment-period-on-proposed-small-business-size-standards-to-november-20/" target="_blank" rel="noopener noreferrer">Covington</a>) <ul> <li>Status: Proposed rule, comment period open through November 20, 2026.</li> <li>Action: If your NAICS code is affected, submit comments before the new deadline. Small DIB primes and subs should model whether the revised thresholds change their size status or competitive positioning for set-aside contracts.</li> </ul> <hr> <h3>Enforcement & False Claims</h3> Federal News Network: The Hidden FCA Trap in CMMC Self-Attestation With the Phase 2 C3PAO assessment pathway suspended, self-attestation under CMMC Level 1 and Level 2 (Self) is the only active compliance path. Federal News Network published analysis on how the False Claims Act creates legal exposure for contractors who self-attest to NIST 800-171 compliance without adequate documentation. During the suspension, DOJ's Civil Cyber-Fraud Initiative remains the enforcement center of gravity, not third-party assessors. (<a href="https://news.google.com/rss/articles/CBMiuwFBVV95cUxNaGxUTExMX3p4ekE0MV9xM1RXZVV5UlRzTmlTLTV6bkpabE1hVFFpRG9CdkJVNzh4eGE2TTNhcm1LRzQ4X0tReEI4ZVFudExhRlNTNVpxeFBjOWd3bzJpRWJVY25ISVVUOUE0cVp1Umg1YndvaW9kUDdPNWRwU0UyQmdFR05Lalh2NkRIdjdvRkJqVFB2MFMweWZObWJvUGJKODFvaWdOVnZZUVAzQVUtMjJORDV6WjJuQjln?oc=5" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <ul> <li>Action: If you have submitted or plan to submit a CMMC Level 2 self-assessment score to SPRS, ensure your SSP accurately reflects implemented controls, not aspirational ones. POA&M items must be genuine remediation plans with timelines, not placeholders. An inflated SPRS score is a False Claims Act liability. Brief your CISO and legal counsel on attestation risk.</li> </ul> RYUK Ransomware Operator Sentenced to Federal Prison An Armenian national extradited from Ukraine was sentenced for his role in RYUK ransomware attacks targeting U.S. companies, including firms in Oregon. (<a href="https://www.justice.gov/usao-or/pr/armenian-national-extradited-united-states-sentenced-federal-prison-ransomware-extortion" target="_blank" rel="noopener noreferrer">DOJ</a>) <ul> <li>DIB relevance: RYUK and its successors have historically targeted defense supply chain companies. This sentencing signals continued DOJ willingness to pursue international ransomware operators. For DIB contractors, this is a reminder that your incident response plan and NIST 800-171 control family IR (Incident Response) are not optional checkboxes. If ransomware hits and your 800-171 controls were not actually implemented as attested, the FCA exposure compounds the operational damage.</li> </ul> <hr> <h3>Contracting Impact</h3> Data Rights Legislation Bears Watching for Subcontractors The proposed NDAA data-rights changes (see Policy & Rulemaking above) would flow through prime contracts to subcontractors. If enacted, primes will likely push compliance burden downstream. Subcontractors who develop technology with mixed funding or incorporate COTS components into defense deliverables should start documenting funding sources and IP assertions more rigorously now, regardless of whether the legislation passes. The trend toward expanding government data rights is clear. <ul> <li>Action: Audit your current technical data deliverables list and rights assertions on active contracts. Ensure your proposal process captures funding-source documentation for all deliverables. This protects you under current DFARS and positions you if the rules shift.</li> </ul> <hr> <h3>Practitioner Pulse</h3> Thin Collection Day, but the Signal Is Clear Today's feed pull returned 32 articles, but only 4 had direct CMMC/DIB relevance. The DOJ firehose delivered its usual volume of criminal cases (drug trafficking, firearms, fraud) with no new Civil Cyber-Fraud settlements. No new r/CMMC threads scored above the relevance threshold. The absence of new C3PAO or Reform Task Force developments is itself the story: the suspension holds, self-assessment remains the only pathway, and FCA enforcement remains the lever. Contractors waiting for clarity on when (or whether) C3PAO assessments resume should not treat the pause as a compliance holiday. The controls in NIST 800-171 Rev 2 are still contractually required under DFARS 252.204-7012, and every self-assessment score in SPRS is a representation the government can test under the False Claims Act. <ul> <li>Action: Use the quiet period to close POA&M items, validate your SPRS score against actual implementation, and ensure your SSP is audit-ready. When the suspension lifts, whether that means C3PAO assessments resume or a revised framework emerges, contractors with genuine compliance will be positioned to move. Those who treated self-attestation as a paper exercise will not.</li> </ul> 2026-09-22: The DoW CMMC Reform Task Force submitted its report to the CIO on September 11 (not yet public) https://carolinacleartech.com/cmmc-brief/2026-09-22/ Today: The DoW CMMC Reform Task Force submitted its report to the CIO on September 11 (not yet public), DoW issued a broad acquisition reform memo targeting CAS coverage and compliance burdens, and practitioners continue navigating derived CUI workflows under the Phase 2 suspension. --- ### Policy & Rulemaking https://carolinacleartech.com/cmmc-brief/2026-09-22/ Tue, 22 Sep 2026 07:00:00 +0000 <h1>CMMC Brief -- 2026-09-22</h1> Today: The DoW CMMC Reform Task Force submitted its report to the CIO on September 11 (not yet public), DoW issued a broad acquisition reform memo targeting CAS coverage and compliance burdens, and practitioners continue navigating derived CUI workflows under the Phase 2 suspension. <hr> <h3>Policy & Rulemaking</h3> CMMC Reform Task Force submitted its report; recommendations not yet public. The Task Force convened in early September to review the 1,100+ RFI comments generated after the July Phase 2 suspension. The report was due to DoW CIO Kirsten Davies on September 11, 2026, but has not been released. At the Billington Cybersecurity Summit on September 9, Davies said more than half the comments supported the suspension, assessor concerns focused on how DoW will verify compliance without third-party C3PAOs, and DoW is reviewing both possible roll-backs (e.g., limiting third-party assessments) and potential expansions (e.g., operational technology security). The Task Force's recommendations will be the first clear signal of how DoW balances reducing compliance burdens against closing security gaps. <a href="https://www.insidegovernmentcontracts.com/2026/09/cmmc-reform-task-force-updates-september-2026/" target="_blank" rel="noopener noreferrer">Source: Covington Inside Government Contracts</a> What to do: Monitor for the Task Force report release. If your compliance roadmap assumes Phase 2 third-party assessments will resume on a specific timeline, revise it to reflect uncertainty. Self-assessment (CMMC Level 2 Self, DFARS 252.204-7012, NIST SP 800-171 Rev. 2) remains the requirement until further notice. DoW has emphasized continued enforcement through self-assessments and selected DoW-led assessments during the suspension. DoW issued a broad acquisition reform memo targeting CAS coverage, pricing, and administrative burden. Deputy Secretary of War Stephen Feinberg issued a memorandum on September 14, 2026, directing DoW to shift away from the Cost Accounting Standards (CAS) and increase reliance on Generally Accepted Accounting Principles (GAAP). The memo directs DoW to submit proposals to the CAS Board within 60 days to make CAS exemption the default and confine remaining CAS coverage to "sole-source, cost-based development or incentive-fee procurement." The memo also directs a "class exemption" request so CAS applies only to "cost-based development contracts of major scale awarded without adequate price competition," with coverage attaching to the contract and relevant indirect-cost pools, not to the entity or segment. Additional reforms include accelerating OTA use, limiting audits, streamlining business system reviews, and increasing commercial contracting. <a href="https://www.insidegovernmentcontracts.com/2026/09/department-of-war-issues-memorandum-aimed-at-strengthening-the-industrial-base-through-acquisition-reform/" target="_blank" rel="noopener noreferrer">Source: Covington Inside Government Contracts</a> What to do: If your business is currently CAS-covered, watch for the CAS Board's response to DoW's proposal. The proposed changes would require significant revisions to both CAS regulations and the FAR, and the CAS Board has authority to issue class-wide waivers but the proposal may conflict with the CAS statute's intent (CAS currently applies to "all" contracts above $35 million, subject to exemptions). If implemented, this would represent a major shift in cost accounting requirements for defense contractors. For CMMC-related compliance, this does not change your cybersecurity obligations, but it signals DoW's broader appetite for reducing government-unique requirements and increasing reliance on commercial practices. <hr> <h3>Practitioner Pulse</h3> Derived CUI workflow question: Do small parts extracted from Statement D blueprints require CUI handling? A r/CMMC user asked whether derived drawings created from Air Force, Navy, and DLA blueprints marked with Statement D (export-controlled, treated as CTI/CUI) must be handled as CUI when only a small portion of the original drawing is used to manufacture a component. The original blueprints are not formally marked as CUI but carry export warning statements (Statement D), which triggers CUI handling. The derived drawing will move around the shop floor as a physical print. <a href="https://www.reddit.com/r/CMMC/comments/1wmq177/clarification_on_dfars_7012_paragraph_m/" target="_blank" rel="noopener noreferrer">Source: Reddit r/CMMC</a> What to do: If your manufacturing workflow involves extracting portions of government-furnished data to create shop-floor work instructions or component drawings, treat derived documents as CUI if the source data is CUI or export-controlled (Statement D, ITAR, EAR). DFARS 252.204-7012 paragraph (b) requires contractors to "provide adequate security" for covered defense information, and paragraph (m) addresses CUI flow-down to subcontractors. Even if the derived drawing contains only a small subset of the original data, it is still derived from CUI and must be handled accordingly (marking, encryption at rest and in transit, access controls, incident reporting). Document your CUI derivation and marking procedures in your System Security Plan (SSP). If you are uncertain whether specific technical data qualifies as CUI, consult the contracting officer or the government program office; do not assume unmarked data is uncontrolled if it carries export restrictions. 2026-09-21: Open-CMMC v2.0 tackles CUI-to-OT workflows over SMB https://carolinacleartech.com/cmmc-brief/2026-09-21/ Today: Open-CMMC v2.0 tackles CUI-to-OT workflows over SMB, a contractor reported passing a third-party Level 2 assessment and receiving certification, and practitioners continue navigating CCP/CCA exam prep and FCI scoping questions. --- ### Practitioner Pulse Open-CMMC v2.0 extends CUI workflow protection to OT systems https://carolinacleartech.com/cmmc-brief/2026-09-21/ Mon, 21 Sep 2026 07:00:00 +0000 Today: Open-CMMC v2.0 tackles CUI-to-OT workflows over SMB, a contractor reported passing a third-party Level 2 assessment and receiving certification, and practitioners continue navigating CCP/CCA exam prep and FCI scoping questions. <hr> <h3>Practitioner Pulse</h3> Open-CMMC v2.0 extends CUI workflow protection to OT systems A practitioner released Open-CMMC v2.0 (Apache-2.0 licensed CUI enclave for RHEL/Alma 9 FIPS) addressing a persistent gap: getting CUI from IT systems to operational technology (CNC machines, quality scanners, printers) that only read SMB shares. Most shop-floor OT has no secure CUI controls, and opening a CUI enclave to the LAN or relying on VLAN segmentation creates compliance risk. This release provides an open-source option that runs on a single local server, maintaining an IT-side CMMC-compliant file system while controlling CUI flows to OT devices. If your environment processes CUI and feeds it to legacy manufacturing equipment, review the project to see if it fits your threat model and SSP design. Mark this as a community tool, not vendor-supported infrastructure. <a href="https://www.reddit.com/r/CMMC/comments/1wlyjvv/opencmmc_v20_extending_protection_of_cui_workflow/" target="_blank" rel="noopener noreferrer">Reddit thread</a> Contractor reports passing third-party Level 2 CMMC assessment A practitioner posted that their organization passed a third-party Level 2 CMMC assessment and received certification. The post describes a 6-9 month build-out of a CUI enclave from an unfixable inherited environment, managed by a 4-person IT team supporting multiple subsidiaries. The company completed the assessment during the Phase 2 suspension period. This confirms that some C3PAOs are still conducting voluntary Level 2 (C3PAO) assessments despite the suspension of mandatory third-party requirements. If you are planning a future Level 2 (C3PAO) certification or want to get ahead of the Reform Task Force outcome, note that the assessment pipeline is still operational and contractors are moving forward. Expect the thread to surface implementation details and lessons learned. <a href="https://www.reddit.com/r/CMMC/comments/1wlvonp/passed_the_3rd_party_cmmc_level_2_and_received/" target="_blank" rel="noopener noreferrer">Reddit thread</a> FCI scoping question: do assessors check FCI environments during Level 2 assessments? A practitioner asked whether C3PAO assessors examine Federal Contract Information (FCI) environments if the organization declares all Controlled Unclassified Information (CUI) is in a separate enclave. This reflects ongoing confusion about FCI vs. CUI scoping boundaries. The CMMC Assessment Guide scopes Level 2 assessments to the CUI environment, not FCI systems, but assessors may still review boundary controls and network diagrams to validate enclave separation. If your SSP relies on a strict CUI enclave, document FCI/CUI segregation clearly and be prepared to walk the assessor through the boundary. Do not assume FCI systems are invisible to the assessment. <a href="https://www.reddit.com/r/CMMC/comments/1wlxb45/fci_in_a_cmmcl2/" target="_blank" rel="noopener noreferrer">Reddit thread</a> CCP exam passed, practitioner seeks CCA prep recommendations A Certified CMMC Professional (CCP) candidate passed the exam after 6 weeks of study focused on the CMMC Assessment Guide, Level 1 vs. Level 2 domain differentiation, FAR/DFARS clauses, the Cyber AB ecosystem, NARA, CAP, scoping, and COPC. They are now looking for Certified CMMC Assessor (CCA) prep guidance. If you are managing assessors or considering CCA certification, note the exam focus areas and expect the CCA track to go deeper on assessment methodology and evidence validation. The Cyber AB has not announced changes to the CCA program during the Phase 2 suspension, so the certification pathway remains active. <a href="https://www.reddit.com/r/CMMC/comments/1wlyz1a/passed_the_ccp_exam_any_prepping_recommendations/" target="_blank" rel="noopener noreferrer">Reddit thread</a> 2026-09-19: DOJ announced a major False Claims Act enforcement policy revision that limits sub-regulatory https://carolinacleartech.com/cmmc-brief/2026-09-19/ Today: DOJ announced a major False Claims Act enforcement policy revision that limits sub-regulatory guidance as the basis for fraud claims, OFCCP eliminated the Section 503 disability self-ID and 7% utilization goal effective Monday, and AAFES is investigating suspicious messages sent through its official app that may indicate a security breach. https://carolinacleartech.com/cmmc-brief/2026-09-19/ Sat, 19 Sep 2026 07:00:00 +0000 Today: DOJ announced a major False Claims Act enforcement policy revision that limits sub-regulatory guidance as the basis for fraud claims, OFCCP eliminated the Section 503 disability self-ID and 7% utilization goal effective Monday, and AAFES is investigating suspicious messages sent through its official app that may indicate a security breach. <h3>Enforcement & False Claims</h3> DOJ revises Justice Manual to limit False Claims Act enforcement to binding legal obligations. The Department announced two policy changes: (1) sub-regulatory guidance cannot impose legal obligations beyond statute or regulation, and (2) the Department will more actively consider dismissing qui tam cases that don't serve U.S. interests, especially when declining to intervene. This is a signed policy memo in effect now. For DIB contractors during the CMMC Phase 2 suspension: self-attestation under DFARS 252.204-7012 and NIST 800-171 remains a binding contractual obligation, but agency white papers or blog posts cannot create new FCA liability. Update your compliance risk assessments to distinguish between regulatory requirements (DFARS clauses, 32 CFR 170, NIST standards) and non-binding guidance. If you're facing a qui tam action based on sub-regulatory interpretations, this policy shift may support a motion to dismiss. <a href="https://www.justice.gov/opa/pr/doj-revises-justice-manual-strengthen-false-claims-act-enforcement" target="_blank" rel="noopener noreferrer">DOJ Press Release</a> Illegal alien arrested for fraudulent U.S. citizenship claims to secure aerospace contractor employment. A Mexican national ordered removed decades ago was indicted on eight counts for lying on I-9 employment authorization forms, claiming U.S. citizenship and submitting someone else's naturalization certificate to work at a South Bay aerospace manufacturer and military contractor. This case underscores ongoing scrutiny of I-9 compliance and citizenship verification at defense contractors. Review your Form I-9 procedures and E-Verify practices; false claims of work authorization at a cleared facility or defense contractor will draw both immigration and FCA attention. <a href="https://www.justice.gov/usao-cdca/pr/illegal-alien-and-aerospace-manufacturer-employee-arrested-indictment-charging-her" target="_blank" rel="noopener noreferrer">DOJ Press Release</a> <h3>Contracting Impact</h3> OFCCP eliminates Section 503 disability compliance requirements effective September 21. A final rule removes: (1) the requirement to invite applicants/employees to self-identify disability status via Form CC-305, (2) the 7% utilization goal for individuals with disabilities, and (3) related data collection and annual utilization analysis requirements. This is a final rule in effect Monday. The rationale: disability inquiries conflict with the ADA. What remains: non-discrimination obligations, general recordkeeping, and Affirmative Action Program (AAP) development for contractors with 50+ employees and contracts $50K+. Action: Remove Form CC-305 from application packages immediately, stop collecting disability self-ID data, and update your AAPs to remove utilization analyses and CC-305-derived data points. Note that Vietnam Era Veterans' Readjustment Assistance Act (VEVRAA) requirements are unaffected. <a href="https://www.pilieromazza.com/major-changes-to-federal-contractors-compliance-requirements-coming-this-monday-september-21/" target="_blank" rel="noopener noreferrer">PilieroMazza analysis</a> <h3>NIST & Standards</h3> CISA and Five Eyes partners release CI Fortify guidance on network isolation for critical infrastructure. The July 28 framework (CISA, ASD, CCCS, NCSC) urges operators to physically and digitally isolate critical systems (OT, third-party connections) to sustain operations during geopolitical conflict. This is voluntary guidance, not a mandate, but echoes NIS2 (EU) and prior NIST segmentation guidance. The concern: bi-directional remote access paths (VPNs, firewalls, shared auth) enable lateral movement after initial compromise (see: Polish power grid wiper incident). For DIB contractors with OT environments or who support critical infrastructure primes: expect flow-down language requiring network segmentation and isolation capabilities in new solicitations. Air-gapping and data diodes have security benefits but create operational friction (shadow IT risk, data transfer delays). Start planning now if you operate ICS/SCADA or provide OT services to primes; "isolation readiness" will become a differentiator. <a href="https://federalnewsnetwork.com/commentary/2026/09/network-isolation-why-ci-fortifys-new-guidance-presents-both-risks-and-opportunities-for-federal-agencies-and-contractors/" target="_blank" rel="noopener noreferrer">Federal News Network commentary</a> <h3>Practitioner Pulse</h3> AAFES investigating suspicious messages sent via email and official mobile app. The Army and Air Force Exchange Service (30M eligible customers, 5,500+ facilities globally) confirmed it's investigating messages sent to customers Wednesday that contained a "wishlist" link purportedly from the "AAFES Security Team." Messages went out via both email and the My Exchange app. AAFES has not confirmed the source (breach vs. spoofed account) but said PII breach notifications would follow "standard operating procedure" if data is compromised. One security analyst noted the specificity of targeting (AAFES customers only) and transmission through official channels suggests "a breach somewhere or someone got in" at AAFES or a third-party partner. For DIB contractors: this incident highlights supply chain and third-party risk. If you operate a customer portal or mobile app, audit push notification infrastructure, review third-party integrations, and ensure your incident response plan includes PII breach notification timelines. Watch for AAFES updates; if this is confirmed as a breach, it will inform NIST 800-171 3.14.6 (monitor communications at external boundaries) and 3.14.7 (identify unauthorized use) control implementations. <a href="https://defensescoop.com/2026/09/18/aafes-investigating-suspicious-messages-sent-to-military-customers/" target="_blank" rel="noopener noreferrer">DefenseScoop</a> 2026-09-18: The Ninth Circuit ruled that federal agencies cannot unilaterally define what is "material" under https://carolinacleartech.com/cmmc-brief/2026-09-18/ Today: The Ninth Circuit ruled that federal agencies cannot unilaterally define what is "material" under the False Claims Act, a holding that could reshape how DOJ pursues cyber-fraud attestation cases against defense contractors. ISOO issued two new CUI notices directing agencies to give contractors clearer marking, handling, and decontrol guidance. A new FCA cybersecurity settlement signals DOJ's Civil Cyber-Fraud Initiative remains active despite the Phase 2 suspension. https://carolinacleartech.com/cmmc-brief/2026-09-18/ Fri, 18 Sep 2026 07:00:00 +0000 <hr> Today: The Ninth Circuit ruled that federal agencies cannot unilaterally define what is "material" under the False Claims Act, a holding that could reshape how DOJ pursues cyber-fraud attestation cases against defense contractors. ISOO issued two new CUI notices directing agencies to give contractors clearer marking, handling, and decontrol guidance. A new FCA cybersecurity settlement signals DOJ's Civil Cyber-Fraud Initiative remains active despite the Phase 2 suspension. <hr> <h3>Policy & Rulemaking</h3> ISOO Releases CUI Notices 2026-07 and 2026-08: Agencies Must Give Contractors Explicit CUI Handling Guidance NARA's Information Security Oversight Office published two notices on September 2 directing federal agencies to provide contractors, at minimum, 12 categories of CUI guidance on every contract requiring CUI access: identification of government-furnished CUI, process for marking contractor-developed CUI, challenge procedures, training, safeguarding, decontrol, disposition, and penalties for misuse. Notice 2026-07 also requires agencies to assign a specific decontrol date or event to all CUI and to resolve CUI status challenges promptly. Neither notice applies directly to contractors, but they create an obligation on the agency side that contractors can leverage. Status: Agency guidance (not rulemaking), effective immediately. Action: On your next contract modification or new award involving CUI, request in writing that the contracting officer provide the 12-item list from ISOO Notice 2026-07. Document what you receive (or don't receive). This is useful evidence for any future dispute over whether you were properly notified of CUI scope, and it directly supports your NIST 800-171 scoping decisions and SSP boundary definitions. <a href="https://www.governmentcontractslegalforum.com/2026/09/articles/government-contracts/new-isoo-guidance-directs-federal-agencies-to-provide-more-cui-guidance-to-contractors/" target="_blank" rel="noopener noreferrer">Source</a> Army Directive 2026-19: Commercial Software First The Department of the Army issued a directive prioritizing commercial off-the-shelf software over custom-built solutions, implementing Secretary Hegseth's November 2025 acquisition overhaul memo. For DIB software suppliers, this signals faster procurement cycles and a preference for configurable commercial products. Status: Signed directive, in force. Action: If you sell software to Army programs, review your product positioning. Proposals that emphasize configuration over custom development will align better with the directive's intent. Expect other service branches to follow. <a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-september-17-2026/" target="_blank" rel="noopener noreferrer">Source</a> SBA Prioritizing Defense-Critical 8(a) Applicants SBA announced on September 10 that it will fast-track 8(a) Business Development Program applications from firms in defense-critical industries, alongside broader 8(a) reforms for individually owned firms. Status: Agency policy guidance, effective now. Action: Small DIB firms not yet in the 8(a) program should evaluate whether the expedited processing changes their cost-benefit calculation for applying. <a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-september-17-2026/" target="_blank" rel="noopener noreferrer">Source</a> <h3>Enforcement & False Claims</h3> Ninth Circuit: Agencies Cannot Define FCA "Materiality" by Fiat (County of King v. Turner) The Ninth Circuit ruled 2-1 on August 25 that HUD and DOT exceeded their authority by requiring grant recipients to certify that compliance with antidiscrimination laws "is material to the government's payment decisions" under the False Claims Act. The court held that Congress already defined "material" in the FCA statute (31 U.S.C. 3729(b)(4)), and the Executive Branch cannot override that definition through certification requirements. The holding is broadly applicable beyond the antidiscrimination context. This matters for CMMC because DOJ's Civil Cyber-Fraud Initiative relies on the FCA to enforce cybersecurity self-attestation. If agencies try to expand what counts as "material" for FCA purposes through contract certifications or attestation requirements that go beyond the statutory definition, this decision gives contractors a potential defense. It does not gut the FCA's applicability to cybersecurity compliance, but it constrains how creatively the government can define materiality. Status: Ninth Circuit precedent. Expect government to seek rehearing or cert. Action: Flag this case for your legal team. It does not change your obligation to attest accurately under DFARS 252.204-7012 or submit honest SPRS scores. It does provide a legal argument if DOJ attempts to pursue FCA claims based on agency-imposed materiality definitions that stretch beyond the statute. Watch for cert petitions. <a href="https://www.insidegovernmentcontracts.com/2026/09/county-of-king-v-turner-raises-questions-about-executive-agency-authority-to-impose-false-claims-act-and-other-certifications-on-federal-funds-recipients/" target="_blank" rel="noopener noreferrer">Source</a> New FCA Cybersecurity Settlement Reported Foley & Lardner flagged another FCA cybersecurity settlement, signaling DOJ's Civil Cyber-Fraud Initiative continues to produce enforcement actions. Details are limited in the available summary, but the pattern is consistent: DOJ is not waiting for CMMC Phase 2 C3PAO assessments to resume before pursuing contractors whose self-attestations don't match reality. Status: Ongoing enforcement posture. Action: If your SPRS score or self-assessment claims capabilities you haven't fully implemented, treat this as the reminder to close POA&M items or adjust your score. The FCA is the enforcement lever that works right now, with or without C3PAO assessments. <a href="https://news.google.com/rss/articles/CBMi3AFBVV95cUxNbDMxUU5zWENSc1lFUGVkU0Y5OG5mSG1UU1daMUdCUFZYRzVfNXRCWWhpbjQzNi1CVEtZOHdlMlY0R2wtdDdqQndLa3ZnS1ZiaDlhb2tDTWhHc2xtTkJwTTZhQm8tSl9jUGxFNnlGckoyTXc4SlBjZ1ZZQ0haZmNuVm9yaDlsbktwU1BYNmkxbmNsZzNjMW42d0ZSSjJvNzFHU2lpWDlaOE9NbFlJWENCbnFXMDZsX2gxVkY5YUVFLVZ0TEJwOW1YN0xoSVVwV29vMGNpaTdSQ3RaQUJE?oc=5" target="_blank" rel="noopener noreferrer">Source</a> <h3>NIST & Standards</h3> CUI Scoping Gets Clearer (Ties to ISOO 2026-07) The ISOO notices described above directly affect how contractors scope their NIST 800-171 implementations. If your agency provides the 12-item CUI identification checklist, your CUI boundary definition becomes more defensible. If they don't provide it, you now have a documented basis to request it, and the gap itself may be relevant in any future dispute about whether you were protecting the right data. Action: Update your SSP's CUI scoping section to reference ISOO Notice 2026-07. If your contracting officer has not provided explicit CUI identification for your contract, send a written request citing the notice. Document the response (or lack of one) in your compliance files. <h3>Practitioner Pulse</h3> CCP Exam Pass Report A practitioner on r/CMMC reported passing the Certified CMMC Professional (CCP) exam, noting the breadth of the body of knowledge extends well beyond just the CMMC practices into CAP, scoping, assessment methodology, and ecosystem governance. Opinion: The CCP remains a viable credential even during the Phase 2 suspension because self-assessment work continues and the assessment methodology knowledge translates directly to preparing your own organization. <a href="https://www.reddit.com/r/CMMC/comments/1wj25vb/passed_the_ccp_exam/" target="_blank" rel="noopener noreferrer">Source</a> 3.8.2 Media Access: USB Tracking Question A practitioner asked whether NIST 800-171 control 3.8.2 ("limit access to CUI on system media to authorized users") requires sign-out tracking of USB drives. Their organization locks down servers and external drives physically but allows USB drives to be requested without inventory tracking. Opinion: The control requires demonstrable access limitation, not necessarily a specific tracking mechanism. If USB drives can contain CUI, you need a process that limits who gets them and a way to show you enforced that limit. A request-approval process with records likely satisfies the control; issuing USBs without tracking probably does not. Check your assessor's interpretation and document your rationale in the SSP. <a href="https://www.reddit.com/r/CMMC/comments/1wj15v7/382_media_access_question/" target="_blank" rel="noopener noreferrer">Source</a> Funding Level 2 Compliance: The Cost Question A commercial banker posted asking about horror stories funding Level 2 compliance, noting the financing angle has been underaddressed. The poster characterized the Phase 2 suspension as "a stay of execution" likely timed around the midterm election. Opinion: The cost concern is real and widespread. Small DIB firms face $50K-$300K+ implementation costs depending on environment complexity, and traditional lenders don't underwrite compliance projects well. SBA grants exist but are limited. The banker's framing is worth noting: the financial sector sees CMMC compliance as inevitable even if the timeline is uncertain, which is the correct read. <a href="https://www.reddit.com/r/CMMC/comments/1wiw8wh/pains_in_funding_level_2_compliance/" target="_blank" rel="noopener noreferrer">Source</a> 2026-09-17: A new FCA cybersecurity settlement reinforces that DOJ is actively enforcing self-attestation https://carolinacleartech.com/cmmc-brief/2026-09-17/ Today: A new FCA cybersecurity settlement reinforces that DOJ is actively enforcing self-attestation compliance even during the CMMC Phase 2 suspension, CISA's upcoming CIRCIA final rule will stack new incident reporting deadlines on top of DFARS 7012 obligations for defense contractors, and CCA exam candidates are flagging quality problems in training courses as the assessor pipeline sits in limbo. https://carolinacleartech.com/cmmc-brief/2026-09-17/ Thu, 17 Sep 2026 07:00:00 +0000 <hr> Today: A new FCA cybersecurity settlement reinforces that DOJ is actively enforcing self-attestation compliance even during the CMMC Phase 2 suspension, CISA's upcoming CIRCIA final rule will stack new incident reporting deadlines on top of DFARS 7012 obligations for defense contractors, and CCA exam candidates are flagging quality problems in training courses as the assessor pipeline sits in limbo. <hr> <h3>Policy & Rulemaking</h3> CIRCIA Final Rule Expected This Month; DIB Contractors Face Overlapping Reporting Obligations CISA plans to publish the final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September 2026, imposing 72-hour incident reporting and 24-hour ransomware payment notification deadlines across 16 critical infrastructure sectors. CISA estimates over 300,000 entities could fall under the rule's scope, and many defense contractors will be covered based on their sector role or supply chain position, not just headcount. The practical problem for DIB companies: CIRCIA obligations will stack directly on top of existing DFARS 252.204-7012 72-hour reporting requirements and evidence preservation duties, with different definitions, thresholds, and recipients. Reporting to CISA will not satisfy DFARS, and vice versa. (<a href="https://federalnewsnetwork.com/commentary/2026/09/beyond-the-town-halls-getting-ready-for-circia-before-the-clock-starts-ticking/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <ul> <li>Status: Final rule expected September 2026; enforceable deadlines likely late 2026 or early 2027.</li> <li>Action: Map your current DFARS 7012 incident response playbook against CIRCIA's draft definitions now. Identify who makes the CISA notification, confirm it is a separate workflow from your DC3 report, and brief your IR team on the parallel obligations before the rule hits the Federal Register.</li> </ul> <h3>Enforcement & False Claims</h3> New FCA Cybersecurity Settlement Signals DOJ Keeps Foot on the Gas Another False Claims Act cybersecurity settlement confirms DOJ's Civil Cyber-Fraud Initiative remains the primary enforcement mechanism during the CMMC Phase 2 suspension. With third-party C3PAO (Certified Third-Party Assessment Organization) assessments frozen, the government's leverage point is the self-attestation: if you submitted an SPRS (Supplier Performance Risk System) score or made compliance representations in contract proposals, DOJ can and will test those claims under the FCA. The pattern is now consistent across multiple settlements in 2025-2026. (<a href="https://news.google.com/rss/articles/CBMitAFBVV95cUxNR1pKdlo3amxsQTJJRWdlWVlCSnZvMVhFcXBuN2hCZ1VmQzRCY1piQW4ydTNSZVV2eDNuV3djVzhOZTRVbDllY1JOQmZ0bHpUZUFDbHByLXBoeU1OaHpKcXQyVjRQU0Vuam5SMEkwZEtZLU9faVl0YmRqRmJHelJOdWJBMmlFbjFSZnB1aFhUZmxUOGpRWEZ6bTZnUnM4MzlYemdHWlRBdm01ZWt3YWZRUExwdHXSAbQBQVVfeXFMTUdaSnZaN2psbEEySUVnZVlZQkp2bzFYRXFwbjdoQmdVZkM0QmNaYkFuMnUzUmVVdngzbld3Y1c4TmU0VWw5ZWNSTkJmdGx6VGVBQ2xwci1waHlNTmh6SnF0MlY0UFNFbmpuUjBJMGRLWS1PX2lZdGJkakZiR3pSTnViQTJpRW4xUmZwdWhYVGZsVDhqUVhGem02Z1JzODM5WHpnR1pUQXZtNWVrd2FmUVBMcHR1?oc=5" target="_blank" rel="noopener noreferrer">The National Law Review / Google News</a>) <ul> <li>Status: Signed settlement (enforcement action, not rulemaking).</li> <li>Action: Audit your current SPRS score against your actual implementation. If your SSP (System Security Plan) or POA&M (Plan of Action and Milestones) has items that have been "in progress" for months without movement, that gap is exactly what qui tam relators and DOJ investigators target. Document remediation timelines and hold to them.</li> </ul> Former Army Soldier Pleads Guilty to Transmitting National Defense Information A Hillsboro, Oregon man pleaded guilty to conspiracy to gather and transmit national defense information. Not an FCA case, but a direct insider threat reminder for cleared contractors. (<a href="https://www.justice.gov/usao-or/pr/former-us-army-soldier-pleads-guilty-gathering-and-transmitting-national-defense" target="_blank" rel="noopener noreferrer">DOJ</a>) <ul> <li>Action: Review your insider threat program and CUI (Controlled Unclassified Information) access controls. NIST 800-171 control families 3.1 (Access Control) and 3.10 (Physical Protection) are the relevant SSP checkpoints.</li> </ul> <h3>Cyber AB & Ecosystem</h3> No significant Cyber AB or C3PAO ecosystem developments today. The assessment pipeline remains frozen pending the Reform Task Force review. C3PAO businesses continue to wait. <h3>Contracting Impact</h3> Air Force Stands Up 'Megatron' IDIQ for Battle Network Acquisitions The Air Force is establishing a multi-award IDIQ contract vehicle called Megatron to accelerate procurement for the DAF Battle Network and C3BM (Command, Control, Communications and Battle Management) capabilities. The vehicle is designed to support multiple appropriation types and acquisition pathways, including commercial solutions and continuous software delivery. A draft statement of work was posted in August; the Air Force is soliciting industry feedback now. (<a href="https://defensescoop.com/2026/09/16/air-force-megatron-idiq-fast-track-daf-battle-network-acquisitions/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) <ul> <li>Status: Draft SOW posted; acquisition strategy still being defined.</li> <li>Action: If you provide C2, networking, sensor integration, or software capabilities to the Air Force or Space Force, review the special notice and provide feedback. Expect DFARS 252.204-7012 and potentially CMMC Level 2 (Self) requirements in the final solicitation. Companies positioning for task orders under this vehicle should have their SPRS score current and SSP audit-ready.</li> </ul> U.S.-India RDPA Negotiations Advancing; OCI Risks in GovCon M&A Two legal analysis articles flag procurement and compliance considerations for defense contractors. The U.S.-India Reciprocal Defense Procurement Agreement would open Indian defense markets to U.S. firms and vice versa, potentially adding supply chain complexity and export control considerations. Separately, a detailed PilieroMazza analysis of organizational conflicts of interest in GovCon M&A warns buyers that acquisitions can create OCI problems that restrict the combined company's pipeline, even when neither entity had issues independently. (<a href="https://www.insidegovernmentcontracts.com/2026/09/the-u-s-india-reciprocal-defense-procurement-agreement-a-new-chapter-in-a-complex-relationship/" target="_blank" rel="noopener noreferrer">Inside Government Contracts</a>) (<a href="https://www.pilieromazza.com/govcon-ma-and-organizational-conflicts-of-interest-how-acquisitions-can-restrict-future-opportunities-the-govcon-ma-playbook-part-6/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) <ul> <li>Action: For RDPA, monitor for new DFARS clauses or flow-down requirements if the agreement concludes. For M&A, evaluate OCI and cybersecurity compliance posture together during diligence; inheriting a target's SPRS score and SSP gaps is a real liability.</li> </ul> <h3>Practitioner Pulse</h3> CCA Exam Candidates Frustrated with Training Quality An r/CMMC post reports significant dissatisfaction with a CCA (Certified CMMC Assessor) training course: inconsistent instructor guidance, material focused on memorization over practical understanding, and a practice exam that does not align with the actual assessment methodology. The poster is looking for alternative prep resources beyond the official scoping guides, CAP, and CMMC assessment guides. (<a href="https://www.reddit.com/r/CMMC/comments/1wiat9e/cca_prep_recommendations/" target="_blank" rel="noopener noreferrer">r/CMMC</a>) <ul> <li>Context: With the Phase 2 C3PAO phase-in suspended, the CCA pipeline is in an awkward position: candidates are investing in certification for a role that has no active demand. Training providers have less incentive to invest in quality when the market is frozen. This is worth watching. If the Reform Task Force restores Phase 2, the rush to get certified assessors online will expose whoever skimped on training quality.</li> <li>Action (for aspiring assessors): Stick to primary sources. The CMMC Assessment Process (CAP), NIST SP 800-171A assessment procedures, and the scoping guides are the authoritative material. Third-party courses vary wildly; vet instructors' actual assessment experience before paying.</li> </ul> 2026-09-16: DoD's new class deviation confirms baseline DFARS 7012 and NIST 800-171 Rev 2 compliance remain https://carolinacleartech.com/cmmc-brief/2026-09-16/ # CMMC Brief - September 16, 2026 Today: DoD's new class deviation confirms baseline DFARS 7012 and NIST 800-171 Rev 2 compliance remain mandatory during the CMMC Phase 2 suspension, practitioners are debating whether to continue C3PAO prep or pause, and FIPS mode implementation for control 3.13.11 is surfacing painful config-change tradeoffs. https://carolinacleartech.com/cmmc-brief/2026-09-16/ Wed, 16 Sep 2026 07:00:00 +0000 <hr> <h1>CMMC Brief - September 16, 2026</h1> Today: DoD's new class deviation confirms baseline DFARS 7012 and NIST 800-171 Rev 2 compliance remain mandatory during the CMMC Phase 2 suspension, practitioners are debating whether to continue C3PAO prep or pause, and FIPS mode implementation for control 3.13.11 is surfacing painful config-change tradeoffs. <hr> <h2>Policy & Rulemaking</h2> DoD issued an 80+ page class deviation last week clarifying contracting officer instructions during the CMMC Phase 2 suspension. Federal News Network interviewed Stephanie Kostro, who walked through what the deviation is and is not. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/09/as-the-pentagon-rethinks-cmmc-cybersecurity-isnt-pausing/" target="_blank" rel="noopener noreferrer">Source</a>) What remains mandatory: - DFARS 252.204-7012 (safeguarding requirements) - NIST SP 800-171 Revision 2 compliance - Supplier Performance Risk System (SPRS) scoring - Annual affirmation of compliance - CMMC Level 1 (Self) and Level 2 (Self) pathways via self-assessment What is suspended: - Third-party C3PAO assessments (the Phase 2 transition to outside assessors) - CMMC Level 3 - Any contract language requiring C3PAO certification The deviation requires contracting officers to update active solicitations with line-in/line-out changes reflecting these rules. Kostro emphasized this is "not the death knell of CMMC" and dispelled rumors that the suspension guts cybersecurity requirements. The core self-assessment pathway and 800-171 Rev 2 controls are still the floor. Action: If you are mid-solicitation or negotiating flow-downs, expect updated contract language removing C3PAO cert requirements but retaining self-assessment and SPRS obligations. Update your SSP and POA&M to reflect current 800-171 Rev 2 posture. The annual affirmation requirement has not changed. Watch: The Reform Task Force review timeline and whether the suspension becomes permanent policy or a temporary pause before a modified Phase 2 rollout. The rulemaking comment window closed last week; DoD has not published a timeline for task force findings. <hr> <h2>Practitioner Pulse</h2> C3PAO demand during the pause: A Reddit thread asked C3PAOs and contractors what they are seeing post-suspension. Are companies canceling or delaying assessments? Are contractors continuing CMMC prep or holding off? (<a href="https://www.reddit.com/r/CMMC/comments/1wgyoph/cmmc_pause_impact/" target="_blank" rel="noopener noreferrer">Source</a>) No clear consensus emerged in the thread as of this morning, but the question reflects real budget and planning uncertainty. If your org was planning a Q4 2026 or Q1 2027 C3PAO assessment, this is decision time: continue prep as a dry run, pause and reallocate budget, or wait for task force clarity. Post-assessment Rev 3 migration: Another practitioner asked whether anyone who recently passed a CMMC assessment has started copying their Rev 2 SSP and transitioning it to Rev 3 to stay ahead. (<a href="https://www.reddit.com/r/CMMC/comments/1whjl8i/next_steps_after_successful_cmmc_assessment/" target="_blank" rel="noopener noreferrer">Source</a>) Rev 3 is not yet required by contract, but starting the gap analysis and SSP revision now (while Rev 2 is fresh) could smooth the eventual transition. If you have the bandwidth and recently documented your Rev 2 environment, this is a low-risk way to prepare for the next standard shift. FIPS mode implementation pain: A contractor posted about NIST SP 800-171 control 3.13.11 (Employ FIPS-validated cryptography). Their Palo Alto firewalls, Aruba switches, and access points all support FIPS mode but were never enabled. The challenge: enabling FIPS mode post-deployment can break existing VPN and IPsec tunnels, requiring device re-enrollment and config changes that risk downtime. (<a href="https://www.reddit.com/r/CMMC/comments/1wh144i/control_31311_employ_fips/" target="_blank" rel="noopener noreferrer">Source</a>) This is a known friction point. Equipment that supports FIPS but is not running in FIPS mode creates assessment risk, but flipping the switch in production without a maintenance window and rollback plan can cause outages. If you are in this position, plan a staged cutover: test in a lab environment first, document the re-enrollment procedure, schedule the change during a maintenance window, and have a backout plan. Physical security (employee badges): A contractor asked for vendor recommendations for employee badge systems (not for door access, just visual ID to meet physical security controls). (<a href="https://www.reddit.com/r/CMMC/comments/1whdrcn/any_recommendations_for_a_good_employee_badge/" target="_blank" rel="noopener noreferrer">Source</a>) This is a straightforward control (3.10.1, limit physical access), but if you are scaling to 200+ employees and do not know every face, badges are the default path. Look for vendors with quick turnaround and batch printing; avoid printing 200 badges in-house unless you have the time and equipment. <hr> Bottom line: The class deviation confirms what stays and what is suspended. Self-assessment and 800-171 Rev 2 are still the baseline. The uncertainty is whether to invest in C3PAO prep now or wait, and whether to tackle disruptive config changes (like FIPS mode enablement) before or after the Reform Task Force reports. If your contracts require SPRS scores and annual affirmations, those obligations have not changed. If you were banking on self-assessment staying the only pathway indefinitely, do not. The suspension is a pause, not a repeal. 2026-09-15: Cyber AB CEO Matthew Travis outlined reform proposals including continuous monitoring and smaller https://carolinacleartech.com/cmmc-brief/2026-09-15/ Today: Cyber AB CEO Matthew Travis outlined reform proposals including continuous monitoring and smaller assessment teams in response to the CMMC Reform Task Force RFI, DoW issued Revision 3 of its Class Deviation retaining the Phase 2 suspension while adding new supply chain and data protection clauses, and a PreVeil survey of 700+ DIB professionals confirmed 62% of contractors budgeted less than half the government's estimated certification cost. https://carolinacleartech.com/cmmc-brief/2026-09-15/ Tue, 15 Sep 2026 07:00:00 +0000 Today: Cyber AB CEO Matthew Travis outlined reform proposals including continuous monitoring and smaller assessment teams in response to the CMMC Reform Task Force RFI, DoW issued Revision 3 of its Class Deviation retaining the Phase 2 suspension while adding new supply chain and data protection clauses, and a PreVeil survey of 700+ DIB professionals confirmed 62% of contractors budgeted less than half the government's estimated certification cost. <hr> <h3>Policy & Rulemaking</h3> Cyber AB submits reform recommendations to DoW Reform Task Force (task force review). CEO Matthew Travis told Federal News Network the Cyber AB's RFI response focuses on changes that could be implemented without new rulemaking: allowing C3PAOs to conduct delta assessments and continuous monitoring instead of full-point-in-time re-assessments, reducing the mandatory three-assessor team requirement to two for well-organized small companies, and streamlining the background investigation process that is bottlenecking assessor supply. Travis also flagged the "fraught with confusion" relationship between CMMC and FedRAMP as needing clarification. Action: These are proposals, not policy. No changes to current requirements. If you are planning a future Level 2 (C3PAO) assessment, track these recommendations; reduced team sizes and continuous monitoring would lower costs if adopted. <a href="https://federalnewsnetwork.com/technology-main/2026/09/cyber-abs-matt-travis-on-cmmc-reform/" target="_blank" rel="noopener noreferrer">Federal News Network</a> DoW Class Deviation Revision 3 retains Phase 2 suspension, adds new clauses (signed deviation, in force). The September 3 revision implements the new DFARS Part 240 (aligning with the Revolutionary FAR Overhaul) and retains Revision 2's instructions directing contracting officers to remove or revise C3PAO third-party assessment requirements from new and existing contracts and solicitations. The suspension does not affect the underlying obligation to comply with NIST SP 800-171 Rev 2. New in Rev 3: mandatory flow-down clauses prohibiting contractors from transferring covered PII of DoW employees (per NDAA FY2024 Sec. 803 and FY2025 Sec. 836), expanded UAS procurement bans (China, Russia, Iran, North Korea), and a tightened definition of "Chinese military company" limited to Section 1260H designees. Action: Review active contracts for updated DFARS clauses. The PII transfer restriction flows down to subcontracts; if you handle DoW employee data, verify your data handling agreements comply. Self-assessment under 800-171 remains your compliance obligation. <a href="https://www.insidegovernmentcontracts.com/2026/09/dow-issues-revision-3-of-its-class-deviation-on-security-requirements/" target="_blank" rel="noopener noreferrer">Inside Government Contracts</a> Pentagon issues AI-assisted software development procedures (signed instruction, effective Sept. 8). CIO Kirsten Davies signed a 37-page instruction requiring that AI-generated code be treated as "unverified input," subject to the same security review and testing as manually written code. Developers remain fully accountable for AI-generated output. The instruction prohibits entering non-public DoW code, configuration scripts, or infrastructure documentation into unapproved generative AI tools. Components must maintain records of AI models and datasets used, analogous to an SBOM. Action: If you develop software for DoW contracts, update your development policies to reflect these requirements. AI code review obligations and the prohibition on using unapproved AI tools with government data will likely appear in flow-down language. Build your AI usage documentation process now. <a href="https://defensescoop.com/2026/09/14/pentagon-sets-procedures-for-ai-assisted-software-development/" target="_blank" rel="noopener noreferrer">DefenseScoop</a> <h3>Enforcement & False Claims</h3> No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related False Claims Act cases appeared in today's collection. The DOJ feed was dominated by COVID loan fraud enforcement (Operation No Doze, $245M across 40+ districts), narcotics, and violent crime cases with no DIB nexus. Standing reminder: With Phase 2 suspended, self-attestation plus the FCA remains the primary enforcement mechanism. Your SPRS (Supplier Performance Risk System) score is a legal statement. If your score does not reflect your actual implementation status, that is FCA exposure. Ensure your self-assessment is accurate and documented. <h3>Cyber AB & Ecosystem</h3> Travis confirms assessor supply bottleneck is a cost driver. The Cyber AB's RFI response identifies background investigation delays as a key constraint limiting the number of certified assessors entering the market. Fewer assessors means higher assessment costs passed to contractors. Travis argued that increasing supply would naturally drive costs down, and proposed streamlining the investigation process. Action: If you are waiting on a future C3PAO assessment, this bottleneck is not resolving quickly. Use the suspension period to complete your 800-171 implementation so you are assessment-ready when the pipeline reopens. <a href="https://federalnewsnetwork.com/technology-main/2026/09/cyber-abs-matt-travis-on-cmmc-reform/" target="_blank" rel="noopener noreferrer">Federal News Network</a> <h3>NIST & Standards</h3> No new NIST SP 800-171 or 800-172 revisions in today's collection. The Class Deviation Revision 3 reconfirms that compliance with NIST SP 800-171 Revision 2 remains the operative standard during the Phase 2 suspension. <h3>Contracting Impact</h3> Army Directive 2026-19: commercial-first software acquisition (signed directive). The Army is prioritizing commercial software configured for military use over custom-built solutions, with CSOs (Commercial Solutions Openings) and OTAs (Other Transaction Authorities) as default solicitation vehicles. The directive requires continuous authorization to operate, reciprocity across Army organizations, and acceptance of vendor test data. Action: Software vendors serving Army contracts should frame proposals around proven commercial capabilities with clear configuration paths. Prepare for continuous ATO processes rather than one-time certifications. Companies unfamiliar with OTAs should invest in understanding non-FAR-based procurement terms, particularly data rights and IP implications. <a href="https://www.pilieromazza.com/warfighting-at-warp-speed-part-5-software-acquisitions-at-speed-and-scale/" target="_blank" rel="noopener noreferrer">PilieroMazza</a> <h3>Practitioner Pulse</h3> PreVeil survey: the affordability gap is widening (survey data, opinion marked). A survey of 700+ DIB professionals found that 62% budgeted under $50,000 for CMMC compliance, against DoW's own estimate of $101,752 for a small entity Level 2 certification. The share of contractors at the earliest compliance stage grew from 30% to 34% year over year. DIY compliance rose from 46% to 55% while MSP engagement dropped from 26% to 18%. Only 18% had completed a self-attestation. PreVeil's interpretation: new entrants are arriving faster than existing ones are finishing, and budget pressure is pushing companies to absorb compliance work internally. This data was collected before the July 2026 suspension. Action: If you are in the 34% just getting started, the suspension is not a reason to wait. Self-assessment under 800-171 is still required, primes are still flowing down requirements contractually, and the FCA applies to your SPRS score today. Use the suspension window to close gaps at lower cost before third-party assessments resume. <a href="https://www.preveil.com/blog/the-cmmc-affordability-gap/" target="_blank" rel="noopener noreferrer">PreVeil</a> PIEE access delays blocking self-assessments. A practitioner on r/CMMC reported being stuck in "Pending" status on PIEE (Procurement Integrated Enterprise Environment) for a month with no response from administrators or customer support. PIEE access is required for CMMC self-assessments. Action: If you are approaching a self-assessment deadline, start your PIEE account setup early. If stuck, escalate through your contracting officer or DCMA representative rather than relying solely on the PIEE help desk. <a href="https://www.reddit.com/r/CMMC/comments/1wg86h2/piee_user_stuck_at_statuspending/" target="_blank" rel="noopener noreferrer">r/CMMC</a> Cloud enclave vendor comparison. A practitioner is comparing Rimstorm (lower cost, ~60-day standup) against CyberSheath (higher cost, 9-12 month timeline) for a CUI enclave. No resolution in the thread yet. Action (opinion): Timeline and cost differences this large typically reflect scope differences: what is included in the base price, how much configuration is customer-owned, and what level of ongoing management is bundled. Get detailed SOWs from both vendors and compare apples to apples before deciding. <a href="https://www.reddit.com/r/CMMC/comments/1wgg5j5/has_your_org_used_cloud_enclave_services_like/" target="_blank" rel="noopener noreferrer">r/CMMC</a> 2026-09-12: Honeywell settled a $2M False Claims Act case for failing to implement NIST 800-171 controls on a https://carolinacleartech.com/cmmc-brief/2026-09-12/ Today: Honeywell settled a $2M False Claims Act case for failing to implement NIST 800-171 controls on a DoD contract, the 60-day CMMC Phase 2 suspension pause period ended with no announced next steps, and practitioners are wrestling with FIPS-validated encryption requirements for browser-based CUI access. https://carolinacleartech.com/cmmc-brief/2026-09-12/ Sat, 12 Sep 2026 07:00:00 +0000 Today: Honeywell settled a $2M False Claims Act case for failing to implement NIST 800-171 controls on a DoD contract, the 60-day CMMC Phase 2 suspension pause period ended with no announced next steps, and practitioners are wrestling with FIPS-validated encryption requirements for browser-based CUI access. <hr> <h3>Policy & Rulemaking</h3> 60-Day Suspension Review Period Ends, No Public Guidance Yet September 12 marks the end of the 60-day window following DoD's July 13 suspension of CMMC Phase 2 (C3PAO assessments). As of today, no new memo, Federal Register notice, or Reform Task Force announcement has been published. The suspension remains in effect until DoD acts. What is still in force: DFARS 252.204-7012, NIST 800-171 self-assessment obligations, SPRS score submissions, and cyber incident reporting. What is not: no third-party (C3PAO) assessments are being scheduled or required. Action: Do not treat the end of the 60-day window as a deadline that changes your obligations. Continue maintaining your SSP, POA&M, and SPRS score. Watch for a Reform Task Force announcement, likely next week. (<a href="https://www.reddit.com/r/CMMC/comments/1wdgf8n/60day_pause_completion/" target="_blank" rel="noopener noreferrer">r/CMMC discussion</a>) Status: Task force review (no new signed policy). White House Quantum Executive Orders Set PQC Migration Deadlines President Trump signed two executive orders directing accelerated migration to post-quantum cryptography (PQC). Federal agencies must transition high-value key establishment to PQC by 2030, digital signatures by 2031, with a pilot program due December 31, 2027. The Federal Acquisition Regulatory Council is directed to hold covered contractors to federal cybersecurity standards by end of 2030. DIB contractors should expect PQC requirements to flow down through DFARS and contract clauses within the next few years. Action: Begin inventorying your cryptographic implementations now. If you handle CUI, your SSP will eventually need to document PQC readiness. This is not yet a contract requirement for most DIB contractors, but primes working classified programs should start planning. (<a href="https://federalnewsnetwork.com/commentary/2026/09/the-white-house-just-changed-the-quantum-game-heres-what-it-means-for-national-security/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) Status: Signed executive orders. FAR Council rulemaking to follow. <h3>Enforcement & False Claims</h3> Honeywell Pays $2M to Settle NIST 800-171 Noncompliance Allegations Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to implement NIST SP 800-171 security controls required under DFARS 252.204-7012 from April 2020 through December 2023. The case originated from a qui tam whistleblower. Key context: DOJ cybersecurity FCA settlements totaled $52 million in FY2025, more than triple the prior year. With C3PAO assessments suspended, the FCA is the primary enforcement mechanism for NIST 800-171 compliance. Self-attestation carries real legal exposure. Action: Audit your SPRS score against your actual control implementation. If your score claims controls you have not fully implemented, you have FCA exposure right now. Review subcontractor flow-downs; Honeywell's obligations extended to subs handling covered defense information. Brief leadership on the acceleration of cyber-FCA enforcement. (<a href="https://governmentcontracts.foxrothschild.com/2026/09/articles/cybersecurity/doj-continues-government-contractor-cybersecurity-crackdown-honeywells-2m-false-claims-act-settlement/" target="_blank" rel="noopener noreferrer">Fox Rothschild analysis</a>) Status: Settlement finalized. <h3>Cyber AB & Ecosystem</h3> No new Cyber AB announcements or C3PAO market developments today. The ecosystem remains frozen pending the Reform Task Force outcome. C3PAOs and Registered Practitioners should monitor for post-60-day guidance. <h3>NIST & Standards</h3> No new NIST SP 800-171/172 revisions or CUI guidance published today. <h3>Contracting Impact</h3> DoD Multi-Model AI Migration Signals Vendor Diversification Expectations DoD is 90% complete migrating classified AI workloads away from Anthropic, with full transition expected by end of September. Under Secretary Emil Michael emphasized the risk of single-vendor dependency. While this is an AI procurement story, the principle applies to DIB cybersecurity tooling: contracting officers increasingly expect vendor diversification and supply chain resilience. Contractors relying on a single security vendor for CMMC compliance tooling should note the department's direction. (<a href="https://defensescoop.com/2026/09/11/dod-poised-to-move-all-classified-ai-workloads-off-anthropic-by-october/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) <h3>Practitioner Pulse</h3> Browser FIPS Validation for CUI Access: No Easy Answer An r/CMMC thread highlights a persistent pain point: how to satisfy FIPS 140 encryption requirements (NIST 800-171 control 3.13.11) when users access CUI through a web browser. The server side can use FIPS-validated TLS, but mainstream browsers (Chrome, Firefox, Edge) do not use FIPS-validated cryptographic modules. Practitioner consensus points toward VDI solutions (Citrix, AWS WorkSpaces, PreVeil) as the cleanest path, with technical controls blocking direct browser access to the CUI service. Opinion: This is one of the most common "last mile" compliance gaps. If your SSP says you enforce FIPS-validated encryption for CUI in transit and your users access it from a standard browser, your documentation does not match your implementation. That gap is exactly the kind of discrepancy a qui tam relator notices. (<a href="https://www.reddit.com/r/CMMC/comments/1wdpyyt/browser_fips/" target="_blank" rel="noopener noreferrer">r/CMMC</a>) 60-Day Pause Thread: Practitioners Watching, Not Expecting The r/CMMC community notes the 60-day mark with measured expectations. Most practitioners anticipate no announcement before Monday at the earliest. The prevailing sentiment: continue operating under current requirements (self-assessment, DFARS 7012, SPRS) and do not pause compliance work waiting for clarity. Opinion: This is the right posture. The suspension removed the C3PAO requirement; it did not create a compliance holiday. (<a href="https://www.reddit.com/r/CMMC/comments/1wdgf8n/60day_pause_completion/" target="_blank" rel="noopener noreferrer">r/CMMC</a>) 2026-09-05: No CMMC-specific policy, enforcement, or rulemaking developments today https://carolinacleartech.com/cmmc-brief/2026-09-05/ Today: No CMMC-specific policy, enforcement, or rulemaking developments today. The White House national security technology strategy discussion highlighted embedded-systems patching gaps that reinforce why NIST 800-171 asset inventory and patch management controls remain critical during the Phase 2 suspension. A new executive order on bulk-power system supply chain security signals continued expansion of ICTS-style foreign-sourcing restrictions that could eventually touch DIB energy infrastructu https://carolinacleartech.com/cmmc-brief/2026-09-05/ Sat, 05 Sep 2026 07:00:00 +0000 Today: No CMMC-specific policy, enforcement, or rulemaking developments today. The White House national security technology strategy discussion highlighted embedded-systems patching gaps that reinforce why NIST 800-171 asset inventory and patch management controls remain critical during the Phase 2 suspension. A new executive order on bulk-power system supply chain security signals continued expansion of ICTS-style foreign-sourcing restrictions that could eventually touch DIB energy infrastructure. <hr> <h3>Policy & Rulemaking</h3> Executive Order 14421: Bulk-Power System Supply Chain Security (Signed, Aug. 26, 2026) President Trump signed EO 14421 establishing a national security regulatory framework for equipment, software, services, and supply chain relationships tied to the U.S. electric grid. The order revives and expands the 2020 EO 13920 framework, modeled on Commerce's ICTS supply chain authority. It shifts federal scrutiny from foreign ownership of infrastructure to the equipment and suppliers themselves, regardless of asset ownership. DIB contractors operating data centers, manufacturing facilities, or installations with grid-connected power infrastructure should watch this space: the ICTS-model approach (case-by-case reviews, class-based restrictions, or both) mirrors how CMMC's own supply chain requirements evolved, and primes with energy-sector subcontractors may begin flowing down energy-equipment sourcing requirements. No immediate action required for most DIB contractors, but companies with foreign-sourced power equipment at CUI-processing facilities should flag this for their compliance teams. (<a href="https://www.insidegovernmentcontracts.com/2026/09/the-electric-grids-icts-moment-new-national-security-executive-order-targets-foreign-sourced-energy-equipment/" target="_blank" rel="noopener noreferrer">Covington analysis</a>) <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act cases, DOJ Civil Cyber-Fraud Initiative settlements, or DIB enforcement actions today. The DOJ press releases covered healthcare fraud, drug trafficking, immigration, firearms, and antitrust matters with no CMMC or defense contractor nexus. Standing reminder: The FCA remains the primary enforcement lever during the Phase 2 C3PAO suspension. Self-assessment scores in SPRS (Supplier Performance Risk System) are legal attestations. If your score does not match your actual implementation status, you have FCA exposure right now, not at some future date when C3PAO assessments resume. <h3>NIST & Standards</h3> National Security Tech Strategy Highlights Embedded-Systems Patching Gap A Federal News Network panel discussed the new White House national security science and technology strategy, with cybersecurity practitioner Rob Smith emphasizing that embedded operational technology devices (satellites, power systems, telecom) cannot be patched fast enough to counter AI-accelerated vulnerability discovery. For DIB contractors, this reinforces the importance of NIST 800-171 controls around asset inventory (3.4.1), configuration management (3.4.2), and flaw remediation (3.14.1). If your System Security Plan (SSP) lists OT or embedded devices in scope, your Plan of Action and Milestones (POA&M) should document patching constraints and compensating controls. Primes and contracting officers increasingly expect this level of specificity. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/09/as-washington-races-ahead-are-existing-national-security-technology-systems-at-risk/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <h3>Contracting Impact</h3> DISA DoDNet Migration: 231,000 Users, 11 Combatant Commands by FY2028 DISA is pushing to migrate all combatant commands to the Defense Department Network by September 2028, impacting approximately 231,000 users across 200 sites. GDIT protested a sole-source award to Leidos under the $11B Defense Enclave Services contract; DISA agreed to conduct new market research. For defense IT contractors and MSPs: this is a significant opportunity pipeline, but the 24-hour response windows on sources-sought notices suggest the agency is moving faster than normal acquisition timelines. Watch SAM.gov for follow-on solicitations. Only about 40,000 of the target 370,000+ users have migrated so far, meaning substantial work remains. Companies with FedRAMP-authorized cloud services or enterprise migration capabilities should monitor this closely. (<a href="https://federalnewsnetwork.com/defense-news/2026/09/disa-rushes-to-migrate-combatant-commands-to-dodnet/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <h3>Cyber AB & Ecosystem</h3> No Cyber AB statements, C3PAO business developments, or assessor ecosystem news today. Context: The Phase 2 C3PAO assessment phase-in remains suspended pending the Reform Task Force review. Only Level 1 (Self) and Level 2 (Self) designations are active. The CMMC rule (32 CFR 170) and DFARS 252.204-7021 were not repealed. Continue maintaining your 800-171 implementation and SPRS score. If you are a C3PAO or planning to engage one, there is no timeline for resumption. <h3>Practitioner Pulse</h3> No notable r/CMMC threads or practitioner discussions surfaced in today's collection. Standing guidance for a quiet day: Use low-news days to audit your own house. Verify your SPRS score matches reality. Review your SSP for accuracy against your actual network architecture. Confirm your POA&M milestones have not slipped. Check that your incident response plan names current personnel and current contact information. These are the items that matter when an FCA qui tam relator or a prime's audit team comes knocking, and they cost nothing but time to verify. 2026-08-26: No policy, rulemaking, or enforcement developments https://carolinacleartech.com/cmmc-brief/2026-08-26/ Today: No policy, rulemaking, or enforcement developments. Summit 7 published detailed insourcing cost models showing $1M-$6M annual staffing budgets across organization sizes, and PreVeil released a CMMC acronym guide. --- ## Practitioner Pulse Compliance cost benchmarks now public. Summit 7 released granular staffing models for insourcing CMMC-aligned operations across three org sizes: 100 employees ($1M/year loaded), 500 employees ($4.3M/year), and 1,000 employees ($6M/year). SOC operations a https://carolinacleartech.com/cmmc-brief/2026-08-26/ Wed, 26 Aug 2026 07:00:00 +0000 <h1>CMMC Brief - August 26, 2026</h1> Today: No policy, rulemaking, or enforcement developments. Summit 7 published detailed insourcing cost models showing $1M-$6M annual staffing budgets across organization sizes, and PreVeil released a CMMC acronym guide. <hr> <h2>Practitioner Pulse</h2> Compliance cost benchmarks now public. Summit 7 released granular staffing models for insourcing CMMC-aligned operations across three org sizes: 100 employees ($1M/year loaded), 500 employees ($4.3M/year), and 1,000 employees ($6M/year). SOC operations alone account for $2-$2.5M at scale, and C3PAO assessments run $40k-$60k. The firm claims outsourcing to Summit 7 cuts costs 30-60% at these sizes. <a href="https://summit7.us/blog/real-numbers-real-budgets-what-insourcing-cmmc-compliance-really-costs/" target="_blank" rel="noopener noreferrer">Read the breakdown</a>. What to do: If you are planning FY27 compliance budgets or evaluating build-vs-buy for CMMC infrastructure, these figures provide a starting point for internal staffing models. Note that the analysis excludes roles often required at enterprise scale (ERP admins, server infrastructure teams, CIS admins) and does not account for FedRAMP Moderate cloud costs, physical access controls, or badge systems. CMMC jargon guide published. PreVeil released an explainer covering C3PAO (Certified Third-Party Assessment Organization), CAP (CMMC Assessment Process), CCFI (Civil Cyber-Fraud Initiative), CRM (Customer Responsibility Matrix), CSP (Cloud Service Provider), and CUI/FCI definitions. The guide is aimed at contractors new to the CMMC ecosystem. <a href="https://www.preveil.com/blog/how-well-do-you-know-department-of-defense-acronyms/" target="_blank" rel="noopener noreferrer">Read the guide</a>. Context note: The article contains text that appears to be testing content filters (instructional directives embedded in body content). This is a data integrity issue with the source feed, not a compliance development. Contractors should rely on official Cyber AB and DoD sources for authoritative definitions. <hr> <h2>No developments today in:</h2> <ul> <li>Policy & Rulemaking (no DoD memos, Federal Register notices, or Reform Task Force updates)</li> <li>Enforcement & False Claims (no DIB-related cyber FCA settlements or DOJ actions)</li> <li>Cyber AB & Ecosystem (no C3PAO or assessor announcements)</li> <li>NIST & Standards (no 800-171/172 updates)</li> <li>Contracting Impact (no new flow-down language or solicitation requirements)</li> </ul> <hr> Federal cyber context (not DIB-specific): CISA published a Logging Reference Architecture guide to help federal agencies meet Nov. 18 logging plan deadlines under OMB's May memo. The guidance prioritizes "quality over quantity" and shifts focus from bulk retention to operationally useful data. This is a federal civilian agency requirement, not a DIB mandate, but expect primes to reference CISA logging frameworks in flow-down language for contractors handling CUI (Controlled Unclassified Information) on federal networks. <a href="https://federalnewsnetwork.com/cybersecurity/2026/08/cisa-wants-agencies-to-maximize-insight-from-cyber-data-logging/" target="_blank" rel="noopener noreferrer">Read CISA's guide summary</a>. <hr> About this brief: Covers DoD CMMC policy, False Claims Act cyber enforcement, the Cyber AB and C3PAO ecosystem, NIST 800-171 standards, and contracting impact for defense industrial base contractors and their advisors. During the Phase 2 suspension, self-assessment plus FCA enforcement remains the active compliance pathway. Reminder: The C3PAO phase-in is suspended pending Reform Task Force review. Only Level 1 (Self) and Level 2 (Self) designations are allowed. DFARS 252.204-7012 and NIST 800-171 self-assessments remain in force. Primes can still flow down certification requirements contractually. 2026-08-25: The Navy stood up a new Office of the Defense Industrial Base to revitalize maritime supply chains https://carolinacleartech.com/cmmc-brief/2026-08-25/ Today: The Navy stood up a new Office of the Defense Industrial Base to revitalize maritime supply chains and push dual-use tech to the fleet. PilieroMazza published guidance on how M&A transactions affect small business eligibility and facility clearances. GSA and Treasury kicked off post-quantum cryptography initiatives that will eventually cascade to DIB contractors. No CMMC Reform Task Force updates, no new FCA cyber-fraud settlements, no 800-171 guidance. https://carolinacleartech.com/cmmc-brief/2026-08-25/ Tue, 25 Aug 2026 07:00:00 +0000 Today: The Navy stood up a new Office of the Defense Industrial Base to revitalize maritime supply chains and push dual-use tech to the fleet. PilieroMazza published guidance on how M&A transactions affect small business eligibility and facility clearances. GSA and Treasury kicked off post-quantum cryptography initiatives that will eventually cascade to DIB contractors. No CMMC Reform Task Force updates, no new FCA cyber-fraud settlements, no 800-171 guidance. <hr> <h3>Policy & Rulemaking</h3> Navy creates Office of the Defense Industrial Base to accelerate dual-use tech and supply chain resilience. Acting Secretary Hung Cao announced the office on August 24, tapping Andrew Magliochetti (former director of the Navy's Office of Small Business Programs and a venture capital investor) as deputy assistant secretary. The office will "lead initiatives to expand the domestic manufacturing ecosystem, mitigate supply chain vulnerabilities, and integrate dual-use commercial technologies" to support the administration's "Golden Fleet" modernization push. This follows President Trump's August memo directing the Department of War (DoD) to restore capacity and competition to the maritime industrial base after "large backlogs of orders across six major Navy shipbuilding programs" exposed an "atrophied shipbuilding industrial base." (<a href="https://defensescoop.com/2026/08/24/navy-launches-office-of-the-defense-industrial-base/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) What to do: If you supply the Navy or are pursuing dual-use tech opportunities, expect new pathways for early-stage companies and venture-backed firms to engage the service. Magliochetti's background signals the Navy wants commercial innovation and private capital flowing into the defense supply chain. Watch for RFIs and OTA opportunities from this office. GSA updates FICAM architecture and Treasury launches Quantum-Readiness Task Force ahead of 2030/2031 post-quantum crypto deadlines. GSA is revising the Federal Identity, Credential and Access Management framework to support quantum-resistant algorithms and developing a testing process for physical access control tech. Treasury stood up a public-private task force to coordinate the financial sector's transition to quantum-safe cryptography. Both initiatives stem from Trump's June 22 executive orders: one requires agencies to migrate "high value assets" and "high impact systems" to post-quantum cryptographic keys by December 31, 2030, and PQC digital signatures by end of 2031; the other focuses on quantum research and commercialization. OMB's follow-up memo (issued in late June) told agencies to submit a "PQC Migration Plan" within 120 days (due in about 30 days from today) detailing how they will inventory cryptographic systems, define a migration strategy, and execute pilots between 2027-2028. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/08/gsa-treasury-kick-off-post-quantum-initiatives-to-protect-against-cyber-threats/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) What to do: DIB contractors will inherit these requirements as agencies migrate their systems and update contract language. If you build or operate cryptographic systems for federal customers, start inventorying where you use traditional public-key crypto (RSA, ECC) and planning a phased migration to NIST's post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). The 2030/2031 deadlines are for federal high-value assets, but expect primes and contracting officers to flow down PQC requirements earlier. Crypto agility (the ability to swap algorithms without re-architecting) is now a design requirement, not a nice-to-have. <hr> <h3>Enforcement & False Claims</h3> Tetra Tech pays $57M to settle FCA allegations for falsifying soil radiation tests at Hunters Point Naval Shipyard. The settlement resolves claims that Tetra Tech EC, Inc. fabricated work and falsified data the Navy relied on to determine whether the former shipyard in San Francisco was free from harmful radiation. This is an environmental False Claims Act case, not a cyber-fraud case, but it illustrates the enforcement lever DOJ uses when contractors submit false attestations or test results the government relies on for compliance decisions. (<a href="https://www.justice.gov/usao-ndca/pr/tetra-tech-ec-inc-agrees-pay-57-million-settle-false-claims-act-allegations-falsifying" target="_blank" rel="noopener noreferrer">DOJ</a>) Air Force member indicted for lying on background investigation forms to get NASA/IRS/NOAA contract work while on active duty. Davide Velarde, 44, of Tucson, was charged with making materially false statements on background investigation forms to obtain employment with federal contractors supporting NASA, the IRS, and NOAA. The indictment does not specify what he lied about, but the case is a reminder that background investigation fraud (SF-86 omissions, misrepresentations of foreign contacts, undisclosed financial issues) is prosecuted and that contract personnel clearances depend on truthful disclosures. (<a href="https://www.justice.gov/usao-az/pr/tucson-man-indicted-lying-obtain-federal-contract-work-while-active-duty-air-force" target="_blank" rel="noopener noreferrer">DOJ</a>) What to do: These cases are not cyber-specific, but they reinforce the enforcement pattern: when contractors submit false attestations or falsify compliance data, DOJ will pursue FCA or fraud charges. During the CMMC Phase 2 suspension, self-assessment is the only active pathway and the False Claims Act is the primary enforcement lever. Every NIST 800-171 self-assessment submission and SPRS score is a potential FCA exposure if it overstates your actual implementation. Ensure your POA&M, SSP, and SPRS entries reflect what you have actually deployed, not what you plan to deploy or what you think the government wants to see. <hr> <h3>Cyber AB & Ecosystem</h3> DoD's Drone OTA Consortium opens Joint UGV demo for October. The Defense Department is planning a mid-October unmanned ground vehicle demonstration (GroundBreaker 1) at Camp Grafton, North Dakota. Only members of the DoW Drone OTA Consortium are eligible to participate. The Pentagon launched the consortium a few months ago to "facilitate the rapid solicitation, evaluation, and award" of OTAs for prototyping and production, cutting through traditional acquisition bureaucracy and bringing nontraditional vendors into the procurement pipeline. Vendors whose UGV systems demonstrate "high tactical value and technical maturity" at the demo may be invited to submit full proposals for OTA awards. (<a href="https://defensescoop.com/2026/08/24/us-military-gearing-up-for-unmanned-ground-vehicle-demo/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) What to do: If you build robotic or autonomous systems and want access to DoD prototyping dollars, join the Drone OTA Consortium. OTAs bypass FAR-based acquisition processes, which means faster awards but also less predictable contract structure and terms. The consortium model signals how DoD is trying to onboard commercial and dual-use tech firms that would not traditionally compete for defense contracts. Expect more of these domain-specific consortia (cyber, AI, quantum, biotech) as the administration pushes "tactical speed" procurement. <hr> <h3>Contracting Impact</h3> SBA tightens 7(a) lending rules effective October 1, making acquisitions harder to finance. SOP 50 10 8.1 raises the debt-service coverage requirement for most change-of-ownership transactions from 1.15x to 1.25x, restricts financing to U.S. citizens and U.S. nationals (no more green card holders as owners or guarantors), and subjects all acquisitions to full standard underwriting regardless of size (previously, deals under $350K qualified for streamlined small-loan treatment). Historical cash flow will matter more than projections: a business with attractive growth potential may not qualify if its existing cash flow cannot support the proposed debt under the new 1.25x coverage test. The changes apply to all lending applications issued an SBA loan number on or after October 1, 2026. (<a href="https://www.pilieromazza.com/five-sba-7a-changes-that-could-reshape-business-acquisitions/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) What to do: If you are buying or selling a defense contractor and planning to use SBA 7(a) financing, get your application submitted and a loan number issued before October 1. After that date, expect lenders to demand stronger historical financials, full appraisals, and site visits even for smaller deals. Non-citizen owners (including green card holders) will no longer qualify, which could kill deals for companies with foreign-born founders or investors. Structure the transaction around SBA requirements from the start; retrofitting a deal after it fails underwriting is expensive and often fatal. M&A buyers need to understand which GovCon assets survive closing and which do not. PilieroMazza published a detailed guide on due diligence for government contractor acquisitions, focusing on the assets that depend on ownership structure, size, control, and regulatory status. Small business eligibility, contract vehicle positions (OASIS+, Polaris, VETS 2, CIO-SP3, GSA MAS), facility security clearances, FOCI mitigation arrangements, past performance, and pending proposals can all be affected by a change of ownership. A transaction that triggers SBA recertification can cost the target its access to set-aside work. Different contract vehicles have different off-ramping provisions and post-recertification order eligibility rules; a vehicle position worth tens of millions in projected task orders may not retain that value after closing. Facility clearances do not automatically transfer and may require new FOCI mitigation if the buyer has foreign ownership. The timing of an acquisition relative to active procurements and proposal deadlines can determine whether the target keeps an award that was central to the acquisition thesis. (<a href="https://www.pilieromazza.com/the-govcon-ma-playbook-govcon-due-diligence-the-assets-investors-and-pe-buyers-need-to-understand-before-closing-part-3/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) What to do: If you are acquiring a defense contractor or being acquired, model the transaction's effect on every revenue-generating asset: set-asides, vehicle positions, clearances, pending proposals, and past performance. Do not assume a contract vehicle or small business status survives closing. Recertification timing, SBA affiliation rules, and vehicle-specific terms can kill projected revenue that looks solid on a balance sheet. Engage a GovCon M&A attorney early (before LOI) to map what stays, what goes, and what requires government approval or mitigation. If the deal depends on a major IDIQ position or a facility clearance, get DCSA and the relevant vehicle program office involved before closing. <hr> <h3>NIST & Standards</h3> No new NIST SP 800-171 or 800-172 guidance this cycle. No updates to CUI handling requirements, assessment methodology, or FedRAMP intersections with the DIB. The post-quantum crypto transition (covered under Policy & Rulemaking) will eventually require updates to 800-171's cryptographic protection controls (3.13.11, 3.13.16), but NIST has not published revised guidance yet. <hr> <h3>Practitioner Pulse</h3> Secure communications remain a human problem, and approved tools still lose to convenience. Federal News Network published commentary noting that employees choose communications platforms by familiarity and ease of use, not security architecture. "There's a price to convenience," said David Wiseman of BlackBerry. "How convenient is it when it actually comes out that your account had been hacked for a six-month window?" Policies and training can explain which communications must be preserved and which systems are approved, but compliance improves when the technology enforces the rules rather than depending on users to remember administrative steps. The article focuses on federal employees, but the dynamic applies to cleared contractor personnel: if the approved secure messaging tool is harder to use than Signal or WhatsApp, people will use the unapproved tool and rationalize it later. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/08/why-secure-communications-remain-a-human-problem/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) What to do: If your SSP requires encrypted communications for CUI and you have deployed an approved platform (e.g., government-furnished devices, FIPS 140-2 validated messaging), audit whether your personnel are actually using it. Spot-check phones and laptops. Ask project managers how they coordinate classified or CUI discussions. If people are using personal devices or commercial apps for convenience, you have a 3.1.20 (external system use) and 3.13.8 (collaborative device control) gap that an assessor or an insider threat investigation will find. Fix it by making the compliant tool the path of least resistance (pre-provision accounts, integrate with Outlook/Teams, train people on the workflow), not by issuing another policy memo. 2026-08-22: The FAR CUI proposed rule mandating NIST SP 800-171 rev 3 across all federal contracts is expected https://carolinacleartech.com/cmmc-brief/2026-08-22/ Today: The FAR CUI proposed rule mandating NIST SP 800-171 rev 3 across all federal contracts is expected to enter contracts before year-end, DOJ settled a $2.5M PPP fraud case with a Virginia company, and the Army's Project Griffin is seeking AI cyber defense agents that won't create new vulnerabilities or rack up token costs. https://carolinacleartech.com/cmmc-brief/2026-08-22/ Sat, 22 Aug 2026 07:00:00 +0000 Today: The FAR CUI proposed rule mandating NIST SP 800-171 rev 3 across all federal contracts is expected to enter contracts before year-end, DOJ settled a $2.5M PPP fraud case with a Virginia company, and the Army's Project Griffin is seeking AI cyber defense agents that won't create new vulnerabilities or rack up token costs. <hr> <h3>Policy & Rulemaking</h3> FAR CUI Rule: Government-Wide NIST 800-171 Rev 3 Mandate Coming Before Year-End The FAR CUI proposed rule, published in 2025 and folded into the Revolutionary FAR Overhaul, is expected to enter federal contracts before the end of 2026. This is not another DoD-only requirement. The rule creates a government-wide contract clause requiring NIST SP 800-171 rev 3 compliance for the protection of Controlled Unclassified Information (CUI) across all 19 civilian agencies represented in the Civilian Agency Acquisition Council, including Agriculture, Commerce, Education, Energy, HHS, DHS, Justice, VA, and others. Action required: DoD contractors will now be responsible for both NIST 800-171 rev 2 (the baseline for CMMC assessments under 32 CFR 170) and rev 3 compliance (for FAR CUI contracts). Rev 3 has fewer top-level requirements than rev 2, but NIST 800-171A rev 3 (the assessment procedures) includes a 32% increase in verification questions. Contractors holding or pursuing civilian agency contracts must begin gap analysis now. Update your System Security Plan (SSP) to address rev 3 controls, faster 8-hour incident reporting timelines, standardized CUI identification, and FedRAMP Moderate cloud requirements. Brief leadership on the dual-standard compliance burden and budget for dual assessments if you work both DoD and civilian contracts. <a href="https://summit7.us/blog/far-cui-rule-major-hurdle/" target="_blank" rel="noopener noreferrer">Summit 7 analysis</a> <hr> <h3>Enforcement & False Claims</h3> Virginia Company Pays $2.5M to Settle PPP Fraud Allegations EBI LLC, a Virginia company based in Charlottesville, agreed to pay $2,541,742.12 to resolve allegations that it fraudulently obtained a Paycheck Protection Program loan from the Small Business Administration for which it was not eligible. The settlement reflects DOJ's continued scrutiny of COVID-era relief fraud. <a href="https://www.justice.gov/usao-wdva/pr/virginia-company-pay-25-million-anti-fraud-case" target="_blank" rel="noopener noreferrer">DOJ press release</a> FCA risk note: During the CMMC Phase 2 suspension, self-attestation plus the False Claims Act is the enforcement center of gravity. DOJ continues prosecuting fraud in adjacent SBA programs; expect the same rigor applied to contractors self-certifying NIST 800-171 compliance or CMMC readiness. If your SPRS score or self-assessment is inaccurate, fix it before a qui tam relator or a prime contractor audit surfaces the gap. <hr> <h3>NIST & Standards</h3> See FAR CUI item above. NIST SP 800-171 rev 3 is the standard of record for the FAR CUI rule. No other NIST guidance changes were reported today. <hr> <h3>Contracting Impact</h3> FAR CUI Flow-Down to All Federal Contracts When the FAR CUI rule enters contracts (expected before year-end 2026), prime contractors across civilian agencies will flow down NIST 800-171 rev 3 requirements to subs handling CUI, mirroring what DIB contractors already face under DFARS 252.204-7012. Expect primes to begin auditing sub compliance against rev 3 controls even before the rule is finalized, and expect SAM.gov solicitations to start citing the clause in late 2026. Review your proposals and teaming agreements now to flag rev 3 compliance costs and timelines. <hr> <h3>Practitioner Pulse</h3> Army Project Griffin: AI Cyber Defense Without Token Bloat or New Vulnerabilities The Army's defensive cyber warfare arm is piloting AI agents (Project Griffin, IRON capability) to ingest sensor feeds and autonomously execute defensive actions against cyber threats. The solicitation warns industry: token costs must be manageable, and agents cannot increase the attack surface. "If you guys are presenting things to us from a pilot perspective and it looks great, but then you guys are going to have an inflated cost at the end, we're gonna have a problem with that," said Wayne Sok, product manager. <a href="https://defensescoop.com/2026/08/21/army-wants-fast-ai-cybersecurity-agents-wont-run-up-costs-create-vulnerabilities/" target="_blank" rel="noopener noreferrer">DefenseScoop coverage</a> DIB takeaway: Autonomous AI cyber defense is coming to DoD networks. If you're a managed service provider or software vendor targeting DoD, budget and architecture matter as much as capability. The Army is explicitly warning against solutions that rack up token charges or introduce new vulnerabilities. Use this as a design constraint for any AI-driven compliance, monitoring, or incident response tools you're building or deploying. CISA Logging Guidance: Voluntary, But Expect Prime Flow-Down CISA issued guidance for agencies to improve cybersecurity data logging. The guidance is voluntary for civilian agencies, but DIB contractors should expect primes to fold logging requirements into flow-down language, especially on contracts involving incident detection and response. <a href="https://federalnewsnetwork.com/federal-newscast/2026/08/cisa-issues-guidance-for-agencies-to-improve-cybersecurity-data-logging/" target="_blank" rel="noopener noreferrer">Federal News Network item</a> Navy SECNAV Warning: Multi-Domain Campaign Targeting Personnel and Installations Acting Secretary of the Navy Hung Cao issued an administrative message warning of a "coordinated, multi-domain campaign" against DoN personnel, civilians, and installations, including doxing, drone surveillance of ships and flight lines, physical probes of access control points, and cyber threats. Cao directed personnel to harden social media profiles, remove info connecting them to DoN, and report suspicious activity. <a href="https://defensescoop.com/2026/08/21/navy-secretary-hung-cao-warning-about-threats-to-personnel-installations/" target="_blank" rel="noopener noreferrer">DefenseScoop coverage</a> Contractor impact: If you support Navy contracts or operate near Navy installations, this is a force protection and OPSEC reminder with compliance implications. Review your security awareness training to cover social media hygiene, doxing risk, and reporting procedures for surveillance or suspicious contact. Update your Insider Threat Program if you have one, and brief employees on the threat environment. 2026-08-15: The r/CMMC community is working through FIPS 140-3 validation requirements and GCC-High migration https://carolinacleartech.com/cmmc-brief/2026-08-15/ Today: The r/CMMC community is working through FIPS 140-3 validation requirements and GCC-High migration logistics, while the White House signed a presidential memorandum authorizing contracted private-sector offensive cyber operations against transnational criminal organizations, a program DIB contractors should monitor for potential flow-down implications. https://carolinacleartech.com/cmmc-brief/2026-08-15/ Sat, 15 Aug 2026 07:00:00 +0000 Today: The r/CMMC community is working through FIPS 140-3 validation requirements and GCC-High migration logistics, while the White House signed a presidential memorandum authorizing contracted private-sector offensive cyber operations against transnational criminal organizations, a program DIB contractors should monitor for potential flow-down implications. <hr> <h3>NIST & Standards</h3> FIPS 140-3 Validation: What DIB Contractors Need to Know An r/CMMC thread surfaces a common practitioner question: how to obtain FIPS 140-3 (Federal Information Processing Standard for cryptographic module validation) certified products, and whether using a vendor whose product is already validated (e.g., Rubrik) satisfies the requirement. The short answer: FIPS 140-3 validation attaches to the cryptographic module, not the end customer. If your vendor's product uses a FIPS 140-3 validated module and you deploy it in approved mode, you inherit that validation. You do not need your own certificate. Check NIST's CMVP (Cryptographic Module Validation Program) list to confirm your vendor's module is current, and document the validated module version in your SSP (System Security Plan). If you are evaluating backup or encryption vendors, confirm they run validated modules, not just "FIPS-compliant" ones; the distinction matters for NIST SP 800-171 control 3.13.11. <ul> <li><a href="https://www.reddit.com/r/CMMC/comments/1vo5fno/fips_1403_basic_questions/" target="_blank" rel="noopener noreferrer">r/CMMC: FIPS 140-3 Basic Questions</a></li> </ul> Action: Verify your encryption and key management products appear on the NIST CMVP validated modules list. Update your SSP to cite specific module names and certificate numbers. <hr> <h3>Practitioner Pulse</h3> Commercial-to-GCC-High Migration: Practitioner War Stories A practitioner running a 40-user migration from Microsoft 365 Commercial to GCC-High (the Microsoft cloud environment required for CUI handling under DFARS 252.204-7012) reports they skipped third-party migration tools due to minimal SharePoint/Teams data and are now tackling mailbox migration via PST export/import plus MDM (Mobile Device Management) enrollment. This is a common small-org approach, but comes with risks: PST migrations can lose folder permissions and retention labels, and manual MDM re-enrollment means a window where devices are unmanaged. Practitioners in the thread are sharing alternative workflows. Opinion: for orgs under 50 users with minimal SharePoint, PST export is pragmatic, but document the gap period in your POA&M (Plan of Action and Milestones) and ensure Intune enrollment is completed before users access CUI in the new tenant. <ul> <li><a href="https://www.reddit.com/r/CMMC/comments/1vnyktd/migrating_out_of_commercial/" target="_blank" rel="noopener noreferrer">r/CMMC: Migrating out of Commercial</a></li> </ul> Action: If you are planning a GCC-High migration, document your migration method, identify any compliance gaps during transition, and track device re-enrollment in your POA&M. <hr> <h3>Contracting Impact</h3> White House Authorizes Private-Sector Offensive Cyber Operations President Trump signed a national security presidential memorandum establishing a government-run program contracting with private companies to conduct offensive cyber operations against transnational criminal organizations. The program will be co-led by DHS and DOJ executive directors, with operations conducted under federal supervision and authority. This is not "hack back" authorization for individual companies; participants must be approved and operate under government direction. For DIB contractors: this does not change your CMMC obligations, but watch for two downstream effects. First, if your company provides cybersecurity services, the program could create new contract vehicles. Second, expect primes and contracting officers to start asking about offensive capability and vetting during subcontractor evaluations, particularly for companies working cyber-adjacent DoD contracts. The liability framework is still being defined. <ul> <li><a href="https://federalnewsnetwork.com/cybersecurity/2026/08/trumps-move-to-unleash-private-sector-hackers-raises-novel-oversight-liability-questions/" target="_blank" rel="noopener noreferrer">Federal News Network: Trump's move to 'unleash' private sector hackers</a></li> </ul> Action: No immediate compliance action required. MSPs and MSSPs serving the DIB should track this program's implementation for potential contract opportunities and liability implications. <hr> <h3>Policy & Rulemaking</h3> No CMMC-specific policy, rulemaking, or Reform Task Force developments today. The Phase 2 C3PAO suspension remains in effect. DFARS 252.204-7012 and NIST SP 800-171 self-assessment requirements remain in force. No new Federal Register notices relevant to 32 CFR 170 or DFARS 252.204-7021. <h3>Enforcement & False Claims</h3> No DOJ Civil Cyber-Fraud Initiative activity or cyber-related False Claims Act cases today. The 30 DOJ press releases in today's feed were general criminal matters (violent crimes, drug trafficking, immigration) with no connection to defense contractor compliance or cyber attestation fraud. <h3>Cyber AB & Ecosystem</h3> No Cyber AB statements or C3PAO ecosystem developments today. 2026-08-09: DoW CIO Kirsten Davies signaled at Black Hat that the Phase 2 hold may be termed a "pause" rather https://carolinacleartech.com/cmmc-brief/2026-08-09/ Today: DoW CIO Kirsten Davies signaled at Black Hat that the Phase 2 hold may be termed a "pause" rather than a "suspension" and that upcoming solicitations could benefit organizations already holding C3PAO-issued Level 2 certifications. Meanwhile, practitioners are debating FedRAMP requirements for VOIP voicemail systems storing CUI and the economics of migrating to GCC High. https://carolinacleartech.com/cmmc-brief/2026-08-09/ Sun, 09 Aug 2026 07:00:00 +0000 Today: DoW CIO Kirsten Davies signaled at Black Hat that the Phase 2 hold may be termed a "pause" rather than a "suspension" and that upcoming solicitations could benefit organizations already holding C3PAO-issued Level 2 certifications. Meanwhile, practitioners are debating FedRAMP requirements for VOIP voicemail systems storing CUI and the economics of migrating to GCC High. <h3>Policy & Rulemaking</h3> DoW CIO Kirsten Davies provided an update on the CMMC Phase 2 status during a Black Hat fireside chat on August 8. The program is being referred to internally as a "pause" rather than a "suspension," and upcoming solicitations are expected to include some form of benefit or award consideration for organizations that completed Level 2 (C3PAO) certification before the July 13 hold. <a href="https://www.reddit.com/r/CMMC/comments/1vi8y0m/were_curious/" target="_blank" rel="noopener noreferrer">Source</a> Action item: If you already hold a C3PAO-issued Level 2 cert, watch for solicitation language referencing prior certification as an evaluation factor or award preference. Contracting officers now have explicit DoW direction to recognize the investment you made before the pause. If you're mid-assessment, the comment suggests completed certs may still carry weight even though new C3PAO assessments are not currently allowed under the suspension (or "pause," depending on which term sticks). <h3>Practitioner Pulse</h3> VOIP voicemail and FedRAMP scope creep. An assessor is reportedly requiring FedRAMP Moderate for VOIP systems that store CUI voicemail, escalating to FedRAMP High if ITAR or EAR-controlled information is in play. <a href="https://www.reddit.com/r/CMMC/comments/1vi2wm6/voip/" target="_blank" rel="noopener noreferrer">Source</a> This is opinion masquerading as requirement. NIST SP 800-171 applies to CUI in any system, including voicemail, but 800-171 compliance does not automatically trigger FedRAMP. FedRAMP is a cloud service authorization framework for systems processing federal information; it is not a per-se requirement unless the contract or agency specifically mandates it. If your VOIP provider is already FedRAMP Moderate (many are), you satisfy the requirement by contract flow-down. If not, you satisfy 800-171 via your SSP controls for the system storing the voicemail (access control, audit, media protection, etc.). Push back on assessors conflating 800-171 with FedRAMP unless the solicitation explicitly requires FedRAMP authorization for the service. GCC High migration economics. A 100-person organization received a quote of $300,000 in migration costs plus $400 per user annually to transition from Google Workspace to Microsoft 365 GCC High. <a href="https://www.reddit.com/r/CMMC/comments/1viu5ym/migrate_from_gsuite_to_gcc_high_cost/" target="_blank" rel="noopener noreferrer">Source</a> The per-user annual license fee ($400/year) is in line with GCC High pricing (roughly $35/user/month for E3 equivalent). The $300,000 migration cost is high but not outlandish for a 100-seat organization if it includes data migration, configuration, training, and post-migration support; that works out to $3,000 per user for the one-time transition. Whether it's justified depends on data volume, custom integrations, and how much hand-holding the migration vendor is providing. Get at least two competing quotes. Some vendors will bid the migration as a loss leader to win the recurring GCC High resale margin. For context: GCC High is not a CMMC requirement. It satisfies DFARS 252.204-7012 and 800-171 for cloud email and collaboration, but so does any FedRAMP Moderate or equivalent service. Google Workspace does not offer a FedRAMP Moderate environment, so DIB contractors using it for CUI are out of compliance unless they've implemented compensating controls (not realistic for SaaS email). GCC High is the path of least resistance for Microsoft shops, but it is not the only compliant path. Evaluate your CUI footprint before committing to the migration cost; if CUI never touches email or SharePoint, you may not need GCC High at all. 2026-08-08: A Federal News Network interview with early CMMC Level 2 adopter IntelliGenesis highlights the real https://carolinacleartech.com/cmmc-brief/2026-08-08/ Today: A Federal News Network interview with early CMMC Level 2 adopter IntelliGenesis highlights the real costs of certification and the frustration small contractors face after DoD suspended Phase 2, while DSCA's expansion of Foreign Military Financing to 52 countries for direct commercial contracts creates new export pathways that still carry DFARS and CUI compliance obligations. https://carolinacleartech.com/cmmc-brief/2026-08-08/ Sat, 08 Aug 2026 07:00:00 +0000 <hr> Today: A Federal News Network interview with early CMMC Level 2 adopter IntelliGenesis highlights the real costs of certification and the frustration small contractors face after DoD suspended Phase 2, while DSCA's expansion of Foreign Military Financing to 52 countries for direct commercial contracts creates new export pathways that still carry DFARS and CUI compliance obligations. <hr> <h3>Policy & Rulemaking</h3> <ul> <li>CMMC Phase 2 suspension remains in effect; no new rulemaking this cycle. There are no new Federal Register notices, memos, or Reform Task Force developments today. 32 CFR 170 and DFARS 252.204-7021 remain on the books; DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting) is still enforceable. Self-assessment under NIST SP 800-171 is still required. The C3PAO assessment pathway is frozen pending the Reform Task Force review. Action: No changes to your compliance posture today. Continue maintaining your NIST 800-171 self-assessment, SSP (System Security Plan), and SPRS (Supplier Performance Risk System) score.</li> </ul> <h3>Enforcement & False Claims</h3> <ul> <li>No new cyber-related FCA cases today. The DOJ press release feed is dominated by immigration, firearms, and drug trafficking cases with no connection to defense contractor cybersecurity attestation. The Civil Cyber-Fraud Initiative remains the primary enforcement mechanism during the Phase 2 suspension, but no new settlements, qui tam (whistleblower) actions, or cyber-fraud complaints were announced. Action: No immediate action, but the enforcement posture has not changed. If your self-assessment score does not match your actual implementation, you remain exposed to FCA liability.</li> </ul> <h3>Contracting Impact</h3> <ul> <li>DSCA expands Foreign Military Financing for direct commercial contracts to 52 countries. DSCA issued policy guidance implementing the Consolidated Appropriations Act of 2023, expanding FMF eligibility from 10 countries to all 32 NATO members and 19 Major Non-NATO Allies. This means more foreign buyers can finance direct commercial purchases from U.S. defense contractors without routing through the FMS (Foreign Military Sales) government-to-government channel. Taiwan's eligibility is arguable under a separate statutory authorization. (<a href="https://www.insidegovernmentcontracts.com/2026/08/dsca-expands-fmf-eligibility-for-direct-commercial-contracts/" target="_blank" rel="noopener noreferrer">Covington analysis</a>)</li> <li> DIB compliance angle: Direct commercial contracts with foreign buyers still require ITAR (International Traffic in Arms Regulations) export licenses, and contractors handling CUI (Controlled Unclassified Information) in connection with these contracts remain subject to DFARS 252.204-7012 and NIST 800-171 requirements. If your company pursues DCC opportunities with newly eligible countries, ensure your SSP scope covers any CUI generated or handled in those transactions. Action: Brief your BD and export compliance teams. If you are pursuing international defense sales, verify your CUI handling procedures cover DCC workflows. </li> <li> War Data Platform core integration contract ($821M to Accenture Federal Services) draws scrutiny. DoD's Chief Digital and AI Office awarded a single-source task order via GSA Alliant 2 for the War Data Platform (formerly Advana), the enterprise data and analytics backbone that integrates 700+ data sources for AI-driven warfighter decisions. Critics question whether a "traditional cost-plus consultancy" can deliver the mission-focused transformation the rebranding promised. (<a href="https://defensescoop.com/2026/08/07/pentagon-war-data-platform-integration-plans-under-scrutiny/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>) </li> <li>DIB relevance: WDP/Advana integration touches data flowing from contractors into DoD analytics systems. Subcontractors providing data feeds or integration services to CDAO programs should watch for flow-down cybersecurity requirements tied to this contract vehicle. Action: If your company feeds data into DoD enterprise analytics platforms, monitor for updated security requirements in task order modifications.</li> </ul> <h3>Practitioner Pulse</h3> <ul> <li>IntelliGenesis interview surfaces the real cost of early CMMC Level 2 certification. Angie Lienert (IntelliGenesis CEO) and Jeremiah Jensen detailed their experience pursuing C3PAO-assessed Level 2 certification before it was required. Key takeaways from the Federal News Network interview: the team wrote 50+ policy and procedure documents, migrated CUI to GCC High, and worked seven days a week for four months. They moved early because primes were "threatening to remove businesses from the team" without certification. When DoD suspended Phase 2, Lienert described deep frustration at the investment made against a requirement that is now on hold. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/08/some-contractors-got-cmmc-certified-early-now-the-implementation-is-on-hold/" target="_blank" rel="noopener noreferrer">Federal News Network</a>)</li> <li>What this means for you: The certification itself is not wasted; IntelliGenesis still holds a validated NIST 800-171 implementation that satisfies the self-assessment requirement and gives them a competitive edge when primes evaluate subcontractor risk. But the interview underscores a real tension: the government encouraged early adoption, industry invested heavily, and the pause creates uncertainty about whether the C3PAO pathway will resume in its current form.</li> <li> Action: If you have already achieved Level 2 certification, maintain it. Your assessment evidence supports your SPRS score and reduces FCA risk. If you have not started, continue building toward full NIST 800-171 implementation (self-assessment pathway) rather than waiting for the C3PAO phase-in to resume. Primes are still flowing down cybersecurity requirements contractually regardless of the Phase 2 freeze. </li> <li> NIST publishes OT remote access security guide for water/wastewater sector. While not DIB-specific, NIST's new operational technology remote access guidance reflects the agency's continued focus on securing remote connections to critical infrastructure. Defense contractors with OT environments (manufacturing floors, test ranges, SCADA systems) should note the principles; CISA and DoD have historically adopted NIST OT guidance into supply chain security expectations. (<a href="https://federalnewsnetwork.com/cybersecurity/2026/08/remote-connections-to-monitor-critical-systems-create-opportunities-for-cyber-attackers/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) </li> <li>Action: If your company operates OT systems that process defense work, review NIST's remote access recommendations against your own OT segmentation and access controls. No compliance mandate today, but expect primes with OT supply chains to reference this guidance in future flow-downs.</li> </ul> <hr> Thin day for CMMC-specific developments. The IntelliGenesis interview is the most actionable item: it validates that early movers are frustrated but not worse off, and that primes are enforcing cybersecurity requirements contractually even without the C3PAO mandate. The FMF expansion is worth flagging for contractors with international sales exposure. No new enforcement actions, rulemaking, or Cyber AB announcements. 2026-08-07: No new CMMC rulemaking or enforcement actions dropped today https://carolinacleartech.com/cmmc-brief/2026-08-07/ Today: No new CMMC rulemaking or enforcement actions dropped today. The acquisition restructuring wave continues with Air Force completing its PAE consolidation, and practitioners are trading notes on Group Policy hardening for Level 2. --- ### Policy & Rulemaking No new CMMC-specific policy actions today. The Phase 2 (C3PAO) suspension remains in effect pending the Reform Task Force review. 32 CFR 170 and DFARS 252.204-7021 are not repealed. DFARS 252.204-7012 safeguarding requirements and NIST https://carolinacleartech.com/cmmc-brief/2026-08-07/ Fri, 07 Aug 2026 07:00:00 +0000 <hr> Today: No new CMMC rulemaking or enforcement actions dropped today. The acquisition restructuring wave continues with Air Force completing its PAE consolidation, and practitioners are trading notes on Group Policy hardening for Level 2. <hr> <h3>Policy & Rulemaking</h3> No new CMMC-specific policy actions today. The Phase 2 (C3PAO) suspension remains in effect pending the Reform Task Force review. 32 CFR 170 and DFARS 252.204-7021 are not repealed. DFARS 252.204-7012 safeguarding requirements and NIST 800-171 self-assessment obligations remain in force. What to do: Continue maintaining your SSP and POA&M against NIST 800-171 Rev 2. If you have not submitted your self-assessment score to SPRS, that obligation is current and enforceable regardless of the C3PAO suspension. <h3>Contracting Impact</h3> <ul> <li>Air Force completes PAE acquisition overhaul. All Air Force program executive offices have been consolidated into 17 portfolio acquisition executive (PAE) organizations, including a new PAE for cyber and networks. PAEs now hold cradle-to-grave authority over programs in their mission area, replacing the fragmented PEO structure. For DIB contractors, this means a single decision-maker per mission portfolio with broader authority to set requirements and timelines. Expect solicitation language and evaluation criteria to shift as PAEs exercise new delegation authorities. (<a href="https://defensescoop.com/2026/08/06/air-force-portfolio-executives-acquisition-reform/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>)</li> </ul> What to do: If you hold or pursue Air Force contracts in cyber, networks, or electronic systems portfolios, identify the relevant PAE. Relationship mapping matters more now that authority is concentrated. <ul> <li>PilieroMazza weekly update flags several contracting developments. Key items: (1) The Court of Federal Claims confirmed jurisdiction over SBIR Phase III procurement disputes in Strategi Consulting v. United States, expanding bid protest options for SBIR contractors. (2) Space Force is shifting to "minimum viable capability" with 18-24 month delivery windows, favoring speed over maturity. (3) An ASBCA decision in Jaxon Construction reminds contractors that the government must meet its burden of proof before a default termination; it cannot simply point to performance problems. (4) DISA is seeking industry input on migrating combatant command IT services to the DoD network. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-august-6-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>)</li> </ul> What to do: SBIR participants with Phase III disputes now have clearer protest standing at the Court of Federal Claims. Contractors bidding USSF work should adjust proposals for rapid delivery timelines. If you face a default termination threat, document the government's own performance obligations carefully. <ul> <li>Presidential Determination adds recoverable critical minerals to Defense Production Act list. On July 30, the President added recoverable critical minerals and materials as items necessary to promote national defense. This expands DPA Title III authorities for these materials. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-august-6-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>)</li> </ul> What to do: DIB suppliers in the critical minerals supply chain should monitor for new DPA-backed contracts and funding opportunities. <h3>Practitioner Pulse</h3> <ul> <li>r/CMMC: GPO hardening for Level 2. A practitioner who built out Group Policy Objects (GPOs) for enterprise-wide CMMC Level 2 compliance is asking the community what admins most commonly overlook. This is a practical thread for anyone using Active Directory to enforce 800-171 controls. Common blind spots in GPO-based compliance include: audit policy gaps (especially advanced audit policy vs. legacy audit policy conflicts), incomplete account lockout settings, unrestricted PowerShell execution policies, and missing screensaver/session lock enforcement. (<a href="https://www.reddit.com/r/CMMC/comments/1vgrhjn/gpos/" target="_blank" rel="noopener noreferrer">r/CMMC</a>)</li> </ul> What to do: If you are using GPOs to implement 800-171 controls, audit your policies against the NIST 800-171A assessment objectives, not just the control families. Pay particular attention to AC-2 (account management), AU-2/AU-3 (audit events and content), and SC-7 (boundary protection) where GPO misconfigurations are most common. <hr> Sections omitted today (no relevant articles): Enforcement & False Claims, Cyber AB & Ecosystem, NIST & Standards. 2026-08-06: No new CMMC policy actions, enforcement cases, or standards updates surfaced in today's collection https://carolinacleartech.com/cmmc-brief/2026-08-06/ Today: No new CMMC policy actions, enforcement cases, or standards updates surfaced in today's collection. Summit 7, a top CMMC/GCC High managed service provider, ranked #37 on the 2026 CRN Fast Growth 150 list, signaling continued demand for DIB compliance services despite the Phase 2 suspension. https://carolinacleartech.com/cmmc-brief/2026-08-06/ Thu, 06 Aug 2026 07:00:00 +0000 <hr> Today: No new CMMC policy actions, enforcement cases, or standards updates surfaced in today's collection. Summit 7, a top CMMC/GCC High managed service provider, ranked #37 on the 2026 CRN Fast Growth 150 list, signaling continued demand for DIB compliance services despite the Phase 2 suspension. <hr> <h3>Policy & Rulemaking</h3> No new developments today. The CMMC Phase 2 (C3PAO assessment) suspension remains in effect pending the Reform Task Force review. 32 CFR 170 and DFARS 252.204-7021 are still on the books; DFARS 252.204-7012 safeguarding requirements and NIST 800-171 self-assessment obligations remain in force. No action required beyond maintaining your current SSP and SPRS score. <h3>Enforcement & False Claims</h3> None of today's 24 DOJ press releases involved cyber-related False Claims Act enforcement, defense contractor fraud, or CMMC/DFARS compliance failures. The cases covered general criminal matters (narcotics, firearms, tax fraud, CSAM, smuggling). The Civil Cyber-Fraud Initiative remains active, and self-attestation under DFARS 252.204-7019/7020 carries FCA exposure; today simply had no new filings or settlements in that lane. <h3>Practitioner Pulse</h3> <ul> <li>Summit 7 hits #37 on CRN Fast Growth 150. The Huntsville-based MSP, one of Microsoft's top U.S. security and compliance partners, has tripled headcount from 100 to 300+ in three years, driven by CMMC, NIST 800-171, and GCC High engagements. The growth trajectory reflects sustained DIB demand for compliance services even while the C3PAO assessment pathway is frozen. For contractors evaluating MSP partners: Summit 7's scale and specialization make it a benchmark, but the suspension means you are not required to engage a C3PAO or an MSP for third-party assessment prep right now. Focus MSP spend on maintaining your 800-171 controls and SPRS score, which remain enforceable. (<a href="https://summit7.us/blog/summit-7-ranks-37-solution-provider-on-2026-crn-fast-growth-150-list/" target="_blank" rel="noopener noreferrer">Summit 7 Blog</a>)</li> </ul> <hr> Sections omitted today (no relevant articles): Cyber AB & Ecosystem, NIST & Standards, Contracting Impact. <hr> Bottom line: Quiet day on the CMMC front. The suspension holds, self-assessment remains the only active pathway, and the FCA is still the enforcement lever. If you haven't reviewed your SPRS score and SSP accuracy this quarter, today's lull is a good time to do it. 2026-08-04: Practitioners report confusion about Level 2 self-assessment vs C3PAO timelines during the https://carolinacleartech.com/cmmc-brief/2026-08-04/ Today: Practitioners report confusion about Level 2 self-assessment vs C3PAO timelines during the suspension, the Senate CR extends key cyber information-sharing authorities through December, and an ASBCA decision underscores the government's burden before issuing pre-completion default terminations. https://carolinacleartech.com/cmmc-brief/2026-08-04/ Tue, 04 Aug 2026 07:00:00 +0000 Today: Practitioners report confusion about Level 2 self-assessment vs C3PAO timelines during the suspension, the Senate CR extends key cyber information-sharing authorities through December, and an ASBCA decision underscores the government's burden before issuing pre-completion default terminations. <hr> <h3>Policy & Rulemaking</h3> The Senate Appropriations Committee's continuing resolution would extend two cybersecurity authorities through Dec. 11: the Cybersecurity Information Sharing Act of 2015 (CISA 2015) and the Federal Cybersecurity Enhancement Act of 2015. CISA 2015 provides liability protections that underpin voluntary information sharing between defense contractors and government on cyber vulnerabilities and threats. The Trump administration's GOLD EAGLE AI vulnerability-sharing program depends on these protections. A lapse would freeze that collaboration during the middle of the CMMC suspension when self-attestation plus FCA enforcement is the primary compliance mechanism. Watch the Senate-House CR negotiations; the House version does not include the CISA extension. <a href="https://federalnewsnetwork.com/congress/2026/08/senate-stopgap-extends-key-cyber-authorities-tmf/" target="_blank" rel="noopener noreferrer">Source</a> <h3>Contracting Impact</h3> Default termination burden: The ASBCA ruled in Jaxon Construction, Inc. that the government must prove a contractor was unlikely to finish within the time reasonably available before issuing a pre-completion default termination. Performance problems alone are not enough; the Army failed to show no reasonable prospect of completion when the record supported a winter suspension and spring resumption. The Board also rejected an anticipatory repudiation claim where the contractor continued submitting documentation and proposed a weather-adjusted schedule rather than refusing performance. For DIB contractors facing cure notices during the suspension, this reinforces that requesting additional time is not repudiation and the government must still prove impossibility of timely completion. Document all progress, propose realistic revised schedules, and force the contracting officer to make the case. <a href="https://www.pilieromazza.com/not-so-fast-recent-asbca-decision-highlights-governments-burden-before-terminating-a-contractor-for-default/" target="_blank" rel="noopener noreferrer">Source</a> Space Force acquisition shift: General Saltzman's "minimum viable capability" push means USSF procurements will increasingly favor rapid prototyping (18-24 months) over fully mature solutions. Expect more OTAs, Commercial Solutions Openings, Middle Tier Acquisition authorities, and Software Acquisition Pathway use. For DIB contractors, this means proposals should demonstrate speed, adaptability, and proven commercial capability over customization. CMMC Level 2 self-assessments and POA&Ms become a competitive differentiator when the acquisition timeline is compressed and cyber compliance can't delay delivery. Align your SSP with agile delivery models; overly rigid proposals lose. <a href="https://www.pilieromazza.com/competing-at-the-speed-of-space-what-space-forces-acquisition-shift-means-for-government-contractors/" target="_blank" rel="noopener noreferrer">Source</a> <h3>Practitioner Pulse</h3> A compliance manager interviewing for a role reports the org "needs L2 by Nov" but wasn't clear whether that means final C3PAO assessment or just a POA&M and SPRS score. With three months until November and the C3PAO phase-in suspended, this is a common confusion point. During the suspension, only Level 1 (Self) and Level 2 (Self) designations are allowed. A November "L2" requirement most likely means a self-assessment (System Security Plan, POA&M, SPRS score of 110 submitted to SPRS portal) unless the prime is contractually flowing down a future C3PAO requirement. Clarify with the hiring manager what the contract actually requires and whether the prime is imposing stricter-than-DFARS terms. If it's self-assessment, three months is tight but doable if the org has already scoped its CUI and started the SSP. If they haven't, that's a red flag. <a href="https://www.reddit.com/r/CMMC/comments/1velnqt/interviewing_for_a_compliance_mng_role_org_needs/" target="_blank" rel="noopener noreferrer">Source</a> Another practitioner asked where to get reliable CMMC updates, citing daily checks of the DoW CIO and Cyber AB sites and hearing rumors the suspension may lift "with minimal to no changes" but finding no confirmation. The official sources remain the DoD CIO CMMC page and Cyber AB announcements; Federal Register for rulemaking; and the Reform Task Force when it publishes. Rumors without sourcing should be ignored. As of today, the suspension is in force, the task force has not published findings, and no Federal Register notice has proposed lifting it. Continue planning for self-assessment compliance and False Claims Act attestation risk. <a href="https://www.reddit.com/r/CMMC/comments/1vexbws/where_do_you_get_your_updates/" target="_blank" rel="noopener noreferrer">Source</a> 2026-08-01: DoD raised the TINA certified cost/pricing data threshold to $10M effective July 1 https://carolinacleartech.com/cmmc-brief/2026-08-01/ Today: DoD raised the TINA certified cost/pricing data threshold to $10M effective July 1, published new IT category management policy affecting all components, and reminded contractors about Chinese military company lobbyist restrictions while remote worker fraud cases highlight FCA exposure for workforce attestation failures. https://carolinacleartech.com/cmmc-brief/2026-08-01/ Sat, 01 Aug 2026 07:00:00 +0000 Today: DoD raised the TINA certified cost/pricing data threshold to $10M effective July 1, published new IT category management policy affecting all components, and reminded contractors about Chinese military company lobbyist restrictions while remote worker fraud cases highlight FCA exposure for workforce attestation failures. <hr> <h2>Policy & Rulemaking</h2> DoD IT Category Management Directive (DoW Instruction 8000.02) Takes Effect Pentagon CIO Kirsten Davies approved a department-wide directive (effective July 29) establishing policy for IT category management across all DoD components, including national security systems and defense business systems. The instruction mandates use of enterprise capabilities before pursuing individual IT investments "unless mission or cost dictate otherwise," emphasizes best-in-class purchasing vehicles (core enterprise technology agreements, joint enterprise licensing agreements), and requires cyber supply chain risk management in ITCM acquisition programs. Key requirement: program managers must assess the suitability of DoD-wide purchasing solutions when acquiring commercial IT. The directive establishes the ITCM Cross Functional Board (chaired by the deputy CIO for the information enterprise) as the senior decision body and the Enterprise Software Initiative Working Group as the implementation lead. Action item: If you sell IT products/services to DoD, familiarize yourself with the ESI framework and best-in-class contract vehicles; if you're a contractor buying IT, expect more centralized purchasing and less component-level discretion. <a href="https://defensescoop.com/2026/07/31/dod-cio-directive-itcm-kirsten-davies/" target="_blank" rel="noopener noreferrer">Source</a> Chinese Military Company Covered Lobbyist Prohibition: DoD Publishes Guidance DoD published a two-page guidance document ("PROJECT CLEAR Contractor Lobbying Evaluation for Adversarial Relationships") and a webpage implementing Section 851 of the FY 2025 NDAA (10 U.S.C. § 4663), which restricts defense contractors from retaining outside consultants who lobby for Chinese military companies. The guidance focuses on relationships with entities on DoD's 1260H list, a narrower scope than the broader definition in the DFARS class deviation. Action item: If you use outside consultants, lobbyists, or government relations firms, confirm they do not represent entities on the 1260H list; failure to comply could trigger contract termination or suspension. The guidance is available on DoD's website; Covington's analysis notes the narrower focus may provide some relief but does not eliminate the compliance burden. <a href="https://www.insidegovernmentcontracts.com/2026/07/defense-department-publishes-guidance-page-concerning-restrictions-on-defense-contractors-retaining-outside-consultants/" target="_blank" rel="noopener noreferrer">Source</a> <h2>Contracting Impact</h2> $10 Million TINA Threshold Now in Force (As of July 1, 2026) The FY 2026 NDAA raised the threshold for requiring certified cost or pricing data from $2.5M to $10M, effective for contracts entered into after June 30, 2026. Contracts entered into on or before June 30 remain subject to the $2.5M threshold, and modifications to legacy contracts still trigger certification at the old threshold. The statutory change is operative now, even though FAR 15.403-4 has not yet been amended (still shows $2.5M). Contracting officers are instructed to apply the $10M threshold immediately. Critical detail: This is not retroactive and the two thresholds will coexist for years. A contractor negotiating a new award after July 1 applies the $10M threshold; a modification to a pre-July 1 contract applies $2.5M. Subcontractors should confirm with primes which threshold applies, as a subcontract entered into after July 1 may still be governed by $2.5M if the underlying prime was awarded before July 1. Action item: Map every pending award, modification, and subcontract that straddles the July 1 cutoff; update proposal templates and compliance checklists; do not assume the higher threshold applies without confirming the contract entry date. Defective pricing stakes (downward adjustment with interest, FCA exposure) remain unchanged. <a href="https://www.insidegovernmentcontracts.com/2026/07/the-10-million-tina-threshold-is-now-in-effect-what-contractors-and-subcontractors-need-to-know/" target="_blank" rel="noopener noreferrer">Source</a> <h2>Enforcement & False Claims</h2> Remote Worker Fraud: Foreign Actors and FCA Exposure for Contractors Organizations are discovering that remote workers they hired may not be the people actually performing the work, with cases ranging from "paycheck fraud" (one person working multiple jobs using AI-assisted interviews or stolen credentials) to foreign actors accessing systems via laptop farms. DOJ recently prosecuted multiple cases involving a North Korean remote worker scheme in which employers believed workers were in Virginia (where laptops were physically located) but the work was performed from North Korea via installed software. For government contractors, this creates three compliance risks: (1) Export control violations if data is accessed from prohibited jurisdictions, (2) Cybersecurity/data breach obligations if unauthorized persons access CUI or other controlled data, and (3) False Claims Act liability if you represented to the government that a specific person is doing the work or that personnel are located in the U.S., then discover a breach. Action item: If you hire remote IT workers, implement controls to verify identity and location (not just at hire, but continuously); if you discover a mismatch, determine whether you have a reporting obligation under your contract or DFARS 252.204-7012 (cyber incident reporting). During the CMMC Phase 2 suspension, self-attestation plus FCA enforcement is the center of gravity; a workforce fraud discovery that contradicts your SSP or SPRS attestation is an FCA risk. <a href="https://federalnewsnetwork.com/workforce/2026/07/organizations-are-discovering-the-remote-worker-they-hired-might-not-be-the-one-doing-the-work/" target="_blank" rel="noopener noreferrer">Source</a> 2026-07-31: A new Executive Order requires defense prime contractors and subcontractors at every tier to map https://carolinacleartech.com/cmmc-brief/2026-07-31/ Today: A new Executive Order requires defense prime contractors and subcontractors at every tier to map and illuminate critical supply chains within 180 days, the White House's quantum executive orders set post-quantum cryptography migration timelines that will flow into DIB compliance requirements, and practitioners on r/CMMC are debating SSP tooling for micro-SMBs and whether the Phase 2 suspension changes what small entrants should prioritize. https://carolinacleartech.com/cmmc-brief/2026-07-31/ Fri, 31 Jul 2026 07:00:00 +0000 <hr> Today: A new Executive Order requires defense prime contractors and subcontractors at every tier to map and illuminate critical supply chains within 180 days, the White House's quantum executive orders set post-quantum cryptography migration timelines that will flow into DIB compliance requirements, and practitioners on r/CMMC are debating SSP tooling for micro-SMBs and whether the Phase 2 suspension changes what small entrants should prioritize. <hr> <h3>Policy & Rulemaking</h3> Executive Order: Securing America's Defense Supply Chains (Signed July 20, 2026) The President signed an EO requiring DoD to initiate regulatory action within 180 days to identify all acquisitions related to national security and require prime contractors and subcontractors at every tier to map their critical supply chains. Starting in 2027, waivers under 10 U.S.C. 4872 will be restricted unless the contractor submits a formal mitigation plan. Contractors relying on supply chains that include material from "unreliable foreign suppliers" must qualify alternative sources as soon as possible. Status: Signed executive order, in force. This is not a proposal. If you supply to DoD, begin documenting your supply chain now; don't wait for the implementing regulation. Identify any components sourced from restricted or adversary-nation suppliers and start qualifying alternatives. This will likely appear as new flow-down language in contracts within the next year. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-30-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) Post-Quantum Cryptography Migration Timelines Accelerate The White House's June executive orders on quantum computing have moved from policy discussion into operational planning. DoD released its official PQC Strategy with strict timelines for DIB compliance, requiring migration to NIST-standardized algorithms (ML-KEM, ML-DSA) by the end of the decade. Federal systems must begin migration planning now; this will flow into contractor requirements through DFARS and CUI protection mandates. Status: Signed executive orders + DoD strategy document; implementing requirements forthcoming. For contractors maintaining NIST 800-171 compliance: start inventorying your cryptographic implementations now. Your SSP should document what encryption you use and where. When the migration requirement hits contract language, you'll need to show a plan, and that plan starts with knowing what you have. The "harvest now, decrypt later" threat means CUI encrypted with current algorithms has a defined shelf life. (<a href="https://federalnewsnetwork.com/commentary/2026/07/washingtons-quantum-orders-put-trust-infrastructure-on-the-clock/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <h3>Enforcement & False Claims</h3> No DOJ Civil Cyber-Fraud Initiative cases or cyber-related False Claims Act actions appeared in today's feed. The DOJ press releases were dominated by unrelated criminal matters (firearms, drug trafficking, fraud schemes with no defense nexus). The enforcement quiet does not mean reduced risk. Self-attestation under DFARS 252.204-7012 remains the active compliance mechanism during the Phase 2 suspension, and the FCA remains the primary enforcement lever. Every SPRS score you submit is a representation to the government. If your score doesn't reflect reality, that's FCA exposure regardless of whether C3PAO assessments resume. <h3>Contracting Impact</h3> Defense Supply Chain Mapping Will Create New Flow-Down Requirements The supply chain EO (above) directs DoD to require illumination of supply chains "at any tier." Expect primes to begin inserting new flow-down clauses requiring subcontractors to disclose sourcing details for critical materials. If you're a sub, review your existing contracts for supply chain reporting obligations and prepare to respond to new data calls from primes. SAM.gov solicitations issued after implementing regulations drop will likely include these requirements. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-30-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) House Passes $1.15T Defense Policy Bill (216-212) The annual defense authorization cleared the House narrowly. The bill's final language will determine funding and policy direction for CMMC implementation, DIB cybersecurity programs, and acquisition reform. Watch the Senate version and conference report for any CMMC-related provisions or amendments to 32 CFR 170 timelines. No action required yet, but track the conference process if you're planning around CMMC certification timelines. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-30-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) <h3>Practitioner Pulse</h3> Micro-SMB Tooling for CMMC Compliance (r/CMMC) A practitioner asked for tools that help small DIB companies track NIST 800-171 control status, build a compliant SSP, document gap assessments, and maintain an artifact repository. This is the single most common question from small contractors entering the DIB space. Options range from free (NIST's own assessment tools, Project Spectrum) to commercial GRC platforms (e.g., Totem, PreVeil, Summit 7's managed offerings). The key criterion: does the tool map directly to the 110 controls in 800-171 Rev 2 and produce documentation an assessor would accept? If you're evaluating tools, check whether they support the NIST SP 800-171A assessment procedures, not just a checklist. Opinion: most micro-SMBs are better served by a managed security provider (MSP/MSSP) that handles both the technical controls and the documentation than by buying a GRC tool they lack staff to operate. (<a href="https://www.reddit.com/r/CMMC/comments/1vbn56g/cmmc_assessment_prep_systemtool/" target="_blank" rel="noopener noreferrer">Reddit</a>) Two-Person LLC Struggling with Compliance Burden (r/CMMC) A new DIB consulting LLC (four months old, two people) described the difficulty of achieving CMMC compliance without IT expertise, even after completing Project Spectrum and Enclave education modules. The poster correctly noted that the Phase 2 suspension does not relieve DFARS obligations. This is reality for the smallest entrants: DFARS 252.204-7012 and NIST 800-171 self-assessment requirements apply regardless of company size, and the compliance burden is not scaled to headcount. If you're in this position, the most practical path is a FedRAMP-authorized enclave (Microsoft GCC High, PreVeil, or similar) that handles most technical controls, paired with a consultant who can write your policies and SSP. Trying to self-implement 110 controls with two people and no IT background is not viable. (<a href="https://www.reddit.com/r/CMMC/comments/1va3aec/extra_small_businesses_and_cmmc_2_compliance/" target="_blank" rel="noopener noreferrer">Reddit</a>) "CMMC at Sea" Training Cruise Draws Skepticism (r/CMMC) A $5,000 Caribbean cruise offering CCP (Certified CMMC Professional) training drew pointed criticism from the community. The training runs 8 AM to noon on sea days only. Opinion: this kind of packaging doesn't help the ecosystem's credibility problem. The Cyber AB's training and certification pipeline is already under scrutiny during the suspension; pay-to-play optics make it worse. Assess any training provider on curriculum quality and instructor credentials, not the venue. (<a href="https://www.reddit.com/r/CMMC/comments/1vb0yux/cmmc_at_sea/" target="_blank" rel="noopener noreferrer">Reddit</a>) Tier 3 Background Investigation Delays (r/CMMC) A prospective assessor reported submitting their Tier 3 application in December, completing the special agent interview in February, and hearing nothing since. The Cyber AB and DoW CIO office both said processing takes 4-6 months or longer. With the Phase 2 C3PAO phase-in suspended, there's less urgency on the government side to clear the assessor pipeline. If you're waiting on a Tier 3, there's likely no action you can take to accelerate it, but document your timeline in case you need to demonstrate diligence later. (<a href="https://www.reddit.com/r/CMMC/comments/1vbe2tb/when_should_i_worry_about_my_tier_3/" target="_blank" rel="noopener noreferrer">Reddit</a>) CUI-Safe Meeting Notetakers (r/CMMC) A practitioner asked about AI meeting notetakers safe for Level 2 environments. Any tool processing CUI must run in a FedRAMP-authorized or equivalent environment; commercial transcription services (Otter, Fireflies, etc.) that send audio to non-FedRAMP cloud infrastructure are not compliant. Local/on-premises models are an option but require hardware most work laptops can't provide. Check whether your organization's enclave provider offers transcription services within the boundary before evaluating third-party tools. (<a href="https://www.reddit.com/r/CMMC/comments/1vbbk81/meeting_notetaker/" target="_blank" rel="noopener noreferrer">Reddit</a>) 2026-07-30: A practitioner shared a detailed CMMC-CCP exam pass/fail breakdown on Reddit that surfaces real https://carolinacleartech.com/cmmc-brief/2026-07-30/ Today: A practitioner shared a detailed CMMC-CCP exam pass/fail breakdown on Reddit that surfaces real study-strategy gaps, and Summit 7 published a critical take on the DoW CIO's "Brilliant at the Basics" campaign and what it actually means for small DIB suppliers. --- ### Practitioner Pulse CMMC-CCP Exam: First-Hand Pass/Fail Breakdown Reveals Study Gaps https://carolinacleartech.com/cmmc-brief/2026-07-30/ Thu, 30 Jul 2026 07:00:00 +0000 <hr> Today: A practitioner shared a detailed CMMC-CCP exam pass/fail breakdown on Reddit that surfaces real study-strategy gaps, and Summit 7 published a critical take on the DoW CIO's "Brilliant at the Basics" campaign and what it actually means for small DIB suppliers. <hr> <h3>Practitioner Pulse</h3> CMMC-CCP Exam: First-Hand Pass/Fail Breakdown Reveals Study Gaps A Reddit user shared their experience failing the CMMC-CCP (Certified CMMC Professional) exam on the first attempt despite a month of preparation using YouTube videos, Udemy courses, and official CMMC resources, then passing on the second try. The post highlights that general study materials alone are insufficient; the exam tests applied understanding of assessment methodology and control implementation, not just familiarity with the NIST 800-171 control families. If you or your team are pursuing CCP certification, treat this as a signal to supplement study guides with hands-on SSP/POA&M work and mock assessment scenarios rather than relying on passive course consumption. Opinion: community consensus in the thread aligns with this, noting the exam rewards practical experience over memorization. - <a href="https://www.reddit.com/r/CMMC/comments/1vah182/failed_cmmcccp_the_first_time_passed_on_my_second/" target="_blank" rel="noopener noreferrer">Failed CMMC-CCP the First Time, Passed on My Second Attempt</a> Summit 7 Dissects "Brilliant at the Basics" for DIB Contractors Summit 7 published an analysis of the DoW CIO's "Brilliant at the Basics" campaign, which frames a set of foundational cybersecurity practices as a simplified starting point for small, midsize, and nontraditional DIB suppliers. Summit 7's take: calling something "basic" does not make it simpler for resource-constrained shops. For contractors already working toward NIST 800-171 compliance, "Brilliant at the Basics" overlaps heavily with what you should already be doing; it is not a separate requirement. Use it as a sanity check against your existing SSP, not as a substitute for the 110-control self-assessment that DFARS 252.204-7012 still requires. The campaign is a DoW CIO initiative (not a rulemaking or contractual mandate), so treat it as guidance, not as a compliance obligation. - <a href="https://summit7.us/blog/what-is-brilliant-at-the-basics-what-it-means-for-dib-contractors/" target="_blank" rel="noopener noreferrer">What is Brilliant at the Basics? What It Means for DIB Contractors</a> <h3>Contracting Impact</h3> Navy LETHALITY Consortium Seeks Network Consolidation Prototypes The Navy issued a request for prototype proposals through the LETHALITY Consortium (managed by Advanced Technology International) to support the Single Design Four Enclave Network Consolidation Initiative at Naval Surface Warfare Center Corona Division. The effort consolidates fragmented IT/OT environments into a unified four-environment architecture aligned with zero trust and data mesh patterns. Only LETHALITY Consortium members are eligible to respond. If your company provides network architecture, cybersecurity, AI/ML, or advanced computing services to the Navy, consortium membership is open to traditional and nontraditional contractors, emerging companies, nonprofits, and academic institutions. All future communications about this RPP will be managed through the consortium's portal, so SAM.gov watchers will not see updates there. - <a href="https://defensescoop.com/2026/07/29/navy-network-consolidation-initiative-nswc-corona/" target="_blank" rel="noopener noreferrer">Navy using LETHALITY Consortium to advance network consolidation initiative</a> <hr> What's not here today: No new CMMC rulemaking, no Reform Task Force announcements, no FCA cyber-fraud settlements, no Cyber AB or C3PAO updates, and no NIST standards activity. The DOJ feed was dominated by drug trafficking, immigration, and violent crime press releases with no cyber-fraud or FCA cases. The Phase 2 C3PAO suspension remains in effect; DFARS 252.204-7012, NIST 800-171 self-assessment, and SPRS score submission remain the active compliance obligations. Nothing changes today. 2026-07-29: Federal agencies are debating whether commercial technology acquisition policies can coexist with https://carolinacleartech.com/cmmc-brief/2026-07-29/ Today: Federal agencies are debating whether commercial technology acquisition policies can coexist with CUI protection requirements, the CyberAB confirmed fraudulent Level 2 certifications are circulating and provided verification guidance, and practitioners continue to surface confusion over FIPS requirements and boundary enforcement for CUI enclaves. https://carolinacleartech.com/cmmc-brief/2026-07-29/ Wed, 29 Jul 2026 07:00:00 +0000 <h1>CMMC Brief - 2026-07-29</h1> Today: Federal agencies are debating whether commercial technology acquisition policies can coexist with CUI protection requirements, the CyberAB confirmed fraudulent Level 2 certifications are circulating and provided verification guidance, and practitioners continue to surface confusion over FIPS requirements and boundary enforcement for CUI enclaves. <hr> <h3>Policy & Rulemaking</h3> CUI requirements creating commercial technology access tension across federal agencies. Federal News Network reports that DoD's CMMC program suspension signals concern that cybersecurity requirements may limit access to the defense industrial base. The article frames the debate as part of a larger struggle between agencies wanting commercial innovation and the reality that government procurement comes with unique requirements including cyber controls, trade policy, and socioeconomic obligations. GSA is working on government-wide CUI rules (FAR Part 40) while DoD pursues CMMC as a mission-specific implementation of the same underlying NIST standards. The commercial technology community is pushing back on fragmentation. <a href="https://federalnewsnetwork.com/contracting/2026/07/the-debate-over-cui-is-revealing-a-larger-struggle-over-how-government-buys-technology/" target="_blank" rel="noopener noreferrer">Read more</a> What to do: If you're tracking the Reform Task Force review, this signals the review scope extends beyond CMMC mechanics to the broader question of whether strict cyber requirements are pricing DoD out of commercial innovation. Watch for potential relaxation of CUI handling requirements or a push to harmonize FAR Part 40 and CMMC. No immediate action required, but brief leadership that the suspension is part of a wider policy fight. <hr> <h3>Cyber AB & Ecosystem</h3> CyberAB warns fraudulent Level 2 certifications are circulating, provides verification path. At this week's CyberAB Town Hall, officials confirmed fraudulent Level 2 CMMC certifications are a concern and provided guidance for primes vetting subcontractors. The verification method: request a PDF export of the sub's SPRS entry. The CyberAB also clarified that the Reform Task Force review extends beyond CMMC to Pentagon-wide issues including cost, agility, resilience, automation, and small business burden. Fraudulent certs remain a risk even during the Phase 2 suspension because primes can still require certification contractually. <a href="https://www.reddit.com/r/CMMC/comments/1v9loxb/this_weeks_cyberab_town_hall/" target="_blank" rel="noopener noreferrer">Read more</a> What to do: If you're a prime vetting subs for CMMC compliance, do not rely on verbal attestations or contractor-provided "certificates." Request a SPRS PDF export showing the sub's self-assessment score and any recorded certifications. If you're a sub, be prepared to provide that export on request. <hr> <h3>Practitioner Pulse</h3> FIPS compliance confusion continues for CUI enclaves. A Reddit thread surfaced a common misunderstanding: a contractor deploying a commercial product into a government cloud enclave for CUI workflows was told the "entire deployment" must be FIPS-validated to achieve "100% compliance." The poster questioned whether FIPS applies to the entire system or just the cryptographic boundary protecting CUI. This reflects ongoing confusion about where NIST 800-171 control boundaries apply. FIPS 140-2/140-3 validation is required for cryptographic modules protecting CUI at rest and in transit (SC.L2-3.13.11), not for every component in the environment. <a href="https://www.reddit.com/r/CMMC/comments/1v9gdb2/question_about_fips_and_cui/" target="_blank" rel="noopener noreferrer">Read more</a> Outbound firewall scoping questions for cloud-only GCC-High environments. A practitioner running a cloud-only GCC-High deployment with Intune-managed Windows laptops and no on-prem servers asked how granular outbound firewall rules need to be for SC.L2-3.13.6 (boundary protection). The poster noted inbound was straightforward but questioned whether outbound requires per-app rules, a short port list, or something in between. NIST 800-171 does not mandate a specific granularity, but assessors typically look for documented justification for what is allowed outbound and evidence that the boundary is monitored. In a cloud-only environment, endpoint firewall plus Azure/M365 egress logging is the compensating control for lack of edge filtering. <a href="https://www.reddit.com/r/CMMC/comments/1v93zch/scl23136_wheres_the_line_on_outbound/" target="_blank" rel="noopener noreferrer">Read more</a> CNC machine access control raises OT network CUI boundary questions. A manufacturer reported that while they restrict who can pull drawings from network drives, once a drawing is loaded onto a CNC machine, it becomes accessible to anyone at the machine. This is a classic OT (operational technology) problem: CUI data at rest is controlled, but CUI in use on the shop floor is not. NIST 800-171 AC.L2-3.1.1 (access control) and AC.L2-3.1.22 (control public information) both apply. Practical mitigations include physical access controls for the machine area, role-based HMI (human-machine interface) lockouts, or air-gapping CUI-processing machines from general shop floor networks. Document the residual risk and the mitigation in your SSP. <a href="https://www.reddit.com/r/CMMC/comments/1v95398/the_ot_network/" target="_blank" rel="noopener noreferrer">Read more</a> What these signal: Practitioners are still struggling with boundary enforcement in non-traditional environments (cloud-only, OT, edge devices). If you're advising clients or preparing for assessment, focus on documenting why a control is scoped the way it is and what compensating controls exist. "We followed vendor defaults" is not an acceptable answer. 2026-07-28: The CMMC suspension continues to drive confusion among practitioners preparing for presentations https://carolinacleartech.com/cmmc-brief/2026-07-28/ Today: The CMMC suspension continues to drive confusion among practitioners preparing for presentations and town halls, PreVeil published a comprehensive guide for international defense contractors navigating CMMC certification requirements, and two quantum computing executive orders set a 2031 deadline for federal post-quantum cryptography migration that will cascade into DIB contract requirements. https://carolinacleartech.com/cmmc-brief/2026-07-28/ Tue, 28 Jul 2026 07:00:00 +0000 <hr> Today: The CMMC suspension continues to drive confusion among practitioners preparing for presentations and town halls, PreVeil published a comprehensive guide for international defense contractors navigating CMMC certification requirements, and two quantum computing executive orders set a 2031 deadline for federal post-quantum cryptography migration that will cascade into DIB contract requirements. <hr> <h3>Policy & Rulemaking</h3> Quantum Computing Executive Orders Set 2031 PQC Migration Deadline President Trump signed two executive orders on June 22 directing federal agencies to migrate to post-quantum cryptography (PQC) by December 31, 2031, and targeting a commercially relevant quantum computer by 2028. The orders also require critical infrastructure operators, space systems, and defense agencies to adopt quantum-enabled sensors and communications within five years. No dedicated funding mechanism accompanies the mandates, creating pressure on mid-tier DIB contractors who will absorb compliance costs through flow-downs. Status: signed executive orders (in force). Action: begin inventorying cryptographic implementations in your environment now. Expect NIST-approved PQC algorithms to appear in future DFARS clauses and prime contractor flow-downs well before the 2031 deadline. The "harvest now, decrypt later" threat makes CUI-handling systems a priority target for early migration. (<a href="https://federalnewsnetwork.com/commentary/2026/07/analyzing-the-new-quantum-computing-executive-orders-what-they-got-right-and-whats-still-missing/" target="_blank" rel="noopener noreferrer">Federal News Network</a>) <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act actions or Civil Cyber-Fraud Initiative settlements were announced today. The DOJ press release feed was dominated by firearms, drug trafficking, tax evasion, and healthcare fraud cases, none of which involve defense contractor cybersecurity attestation. The $2.6M PPP fraud settlement (Universal Environmental Services, a German subsidiary) involved COVID-era loan fraud, not cyber self-assessment. (<a href="https://www.justice.gov/usao-ndga/pr/german-subsidiary-peachtree-city-settles-ppp-fraud-claim-26-million" target="_blank" rel="noopener noreferrer">DOJ</a>) The quiet day does not reduce attestation risk. With C3PAO assessments suspended and Level 2 self-assessment as the only active pathway, the FCA remains the primary enforcement lever. Every self-assessment score you submit to SPRS is a certification under penalty of law. Keep your SSP and POA&M current. <h3>NIST & Standards</h3> No new NIST SP 800-171 or 800-172 revisions published today. The PQC executive orders (above) will eventually drive updates to cryptographic requirements in 800-171 controls (SC.L2-3.13.8 and related). No action required yet, but track NIST's PQC standards finalization timeline alongside your SSP cryptographic inventory. <h3>Contracting Impact</h3> Claim Sponsorship in Federal Subcontracts: What DIB Subs Need in Their Agreements PilieroMazza published a detailed analysis of CDA claim sponsorship, the mechanism by which subcontractors pursue recovery for government-caused impacts through their prime contractor. Key points for DIB subcontractors: your subcontract must expressly require the prime to cooperate on claim preparation and presentation; define notice requirements, documentation standards, and cost allocation up front; and understand the Severin doctrine, which bars the prime from recovering on your behalf if the prime has been completely relieved of liability to you. This matters for CMMC-adjacent disputes: if a prime's flow-down of cybersecurity requirements causes you additional compliance costs due to a government-directed change, your subcontract's claim sponsorship provisions determine whether you can recover. Action: review your subcontract dispute clauses during your next contract review cycle. (<a href="https://www.pilieromazza.com/contract-claims-101-claim-sponsorship-part-7/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) <h3>Practitioner Pulse</h3> International Contractors: CMMC Certification Is Available but Complicated PreVeil published a guide covering CMMC for foreign-based defense contractors. The core takeaway: certification follows the CUI, not the company's headquarters. Canadian, UK, Australian, and other allied-nation suppliers handling CUI under DoD contracts must meet the same CMMC requirements as domestic companies. Additional challenges include data residency requirements, cross-border data transfer, and finding authorized C3PAOs willing to conduct international assessments (most currently operate in the US). Action for international subs: coordinate with your US prime to confirm the required CMMC level per contract, and begin evaluating cloud environments that satisfy both FedRAMP equivalency and local data sovereignty regulations. During the suspension, Level 2 self-assessment is the active pathway regardless of geography. (<a href="https://www.preveil.com/blog/cmmc-implementation-for-foreign-countries/" target="_blank" rel="noopener noreferrer">PreVeil</a>) Reddit: Consolidating Suspension Confusion for a Presentation A practitioner thread attempted to clarify what the Phase 2 suspension actually changes. The consensus: DoD paused mandatory Level 2 C3PAO assessments in new solicitations while the Reform Task Force reviews Phase II implementation. Acquisition officials must require Level 2 self-assessments instead. The underlying rule (32 CFR 170, DFARS 252.204-7021) was not repealed; DFARS 252.204-7012 and NIST 800-171 self-assessments remain in force; and primes can still contractually require third-party assessments from subcontractors as part of supply-chain risk management. If you are presenting to leadership or clients, frame it this way: the requirement is not gone, only the government-mandated third-party verification step is paused. (<a href="https://www.reddit.com/r/CMMC/comments/1v8asyb/trying_to_consolidate_confusion_around_the_cmmc/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) Reddit: ChatGPT Enterprise FedRAMP Capability Questions A practitioner reported 8+ weeks of conflicting responses from OpenAI support regarding whether ChatGPT Enterprise FedRAMP can accept and extract data from PDFs. No resolution posted. This signals a broader problem: FedRAMP-authorized AI tools in the DIB need clear documentation on data-handling capabilities before contractors can safely process CUI-adjacent content. Do not assume a FedRAMP authorization covers every feature of a product; verify the authorization boundary. (<a href="https://www.reddit.com/r/CMMC/comments/1v8kodq/chatgpt_enterprise_fedramp/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) Reddit: Town Hall Anticipation Practitioners are watching an upcoming town hall (likely Cyber AB or DoD-related) for signals on the Phase 2 suspension timeline and potential policy shifts. No predictions posted beyond general excitement. Worth monitoring for any announcements that change the self-assessment status quo. (<a href="https://www.reddit.com/r/CMMC/comments/1v7zh7h/town_hall_predictions/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) 2026-07-25: Summit 7 published MSP vs MSSP guidance for CMMC contractors https://carolinacleartech.com/cmmc-brief/2026-07-25/ Today: Summit 7 published MSP vs MSSP guidance for CMMC contractors, federal agencies accelerated vulnerability patching timelines after AI-driven exploits, and DIU appointed its first active-duty military deputy to speed defense tech fielding. --- ### Practitioner Pulse MSP vs MSSP: different roles, both needed for CMMC https://carolinacleartech.com/cmmc-brief/2026-07-25/ Sat, 25 Jul 2026 07:00:00 +0000 <h1>CMMC Brief -- 2026-07-25</h1> Today: Summit 7 published MSP vs MSSP guidance for CMMC contractors, federal agencies accelerated vulnerability patching timelines after AI-driven exploits, and DIU appointed its first active-duty military deputy to speed defense tech fielding. <hr> <h3>Practitioner Pulse</h3> MSP vs MSSP: different roles, both needed for CMMC Summit 7 published guidance distinguishing Managed Service Providers (MSPs) from Managed Security Service Providers (MSSPs) in the CMMC context. MSPs handle IT operations (patching, identity, backups, engineering); MSSPs deliver continuous security monitoring. Both are essential for CMMC Level 2, but using the wrong provider or one without DIB-specific experience risks failed assessments. The article emphasizes that CMMC isn't "compliance theater" - you must prove policies and procedures are followed (Examine, Interview, Test), maintain CUI visibility (Monitor and Assert), and answer where every piece of CUI lives. Contractors who can't map CUI locations or lack monitoring logs for forensic investigation will fail assessments. Summit 7 offers Guardian (MSP) and Vigilance (MSSP) services purpose-built for DIB contractors. <a href="https://summit7.us/blog/msps-vs-mssps-why-each-matters-for-cmmc-compliance/" target="_blank" rel="noopener noreferrer">Summit 7 Blog</a> Action: If you're outsourcing IT or security, verify your provider understands CMMC Level 2 evidence requirements (artifact collection, monitoring, CUI labeling). General-purpose MSPs/MSSPs may not meet DIB-specific assessment standards. <hr> <h3>Policy & Rulemaking</h3> No CMMC-specific policy developments today. Federal Register, DoD CIO, and Cyber AB feeds had no new CMMC rulemaking or guidance. <hr> <h3>NIST & Standards</h3> CISA accelerates vulnerability patching after AI exploit incidents CISA issued a binding operational directive requiring federal agencies to adopt faster, prioritized software patching cycles following AI-driven exploitation incidents (including OpenAI's Mythos model breaching Hugging Face networks autonomously). OMB is enforcing the directive across agencies. The vulnerability-to-exploit timeline has collapsed from over a year (2020) to 10 hours (2026), and AI models now discover and exploit zero-days at machine speed. While the directive targets federal agencies, expect primes to fold similar patch timelines into DIB flow-down language. NIST SP 800-171 r3 already requires timely remediation of flaws (3.14.1); this signals stricter interpretation is coming. <a href="https://federalnewsnetwork.com/cybersecurity/2026/07/ai-incidents-bolster-push-for-federal-cyber-improvements/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Action: Review your patch management procedures. If you're running on a monthly cycle, plan to accelerate. Document your patch prioritization methodology (CVSS scoring, CISA KEV catalog) in your SSP and ensure monitoring logs prove compliance. FedRAMP 20X transition deadline: June 2027 GSA's FedRAMP director announced the program will stop accepting "Rev Five" authorization packages by June 2027, fully transitioning to the FedRAMP 20X model (automation, machine-readable data, weeks instead of years). The shift was driven by AI-driven attack timelines. FedRAMP isn't a DIB requirement, but cloud vendors serving DIB contractors often hold FedRAMP authorizations. If your CUI environment relies on FedRAMP-authorized services, confirm your vendor's 20X transition plan. <a href="https://federalnewsnetwork.com/cybersecurity/2026/07/ai-incidents-bolster-push-for-federal-cyber-improvements/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Action: If you use FedRAMP-authorized cloud services for CUI, check your vendor's authorization status and 20X timeline. SSP Section 3.13 (System and Communications Protection) should document third-party service authorizations. <hr> <h3>Contracting Impact</h3> DIU appoints first active-duty military deputy to speed fielding Defense Innovation Unit appointed Maj. Gen. Joseph Kunkel as its first full-time military deputy to improve DOD's contract-to-deployment conversion ratio and help reverse cost equations where U.S. weapons cost more than threats. DIU is embedding personnel in combatant commands and increasing senior-level engagement to bridge operational needs and commercial tech. Secretary Hegseth's directive: faster contracting, cheaper systems. This signals continued push for rapid acquisition pathways (OTAs, prototype agreements) that may bypass traditional DFARS flows. <a href="https://defensescoop.com/2026/07/24/diu-first-active-duty-military-deputy-meet-future-fights-with-swagger/" target="_blank" rel="noopener noreferrer">DefenseScoop</a> Action: If you're pursuing DOD contracts, monitor DIU and combatant command rapid-acquisition channels. CMMC requirements still apply to CUI-handling contracts, but expect streamlined procurement timelines. SOF launches same-day acquisition challenge Office of the Assistant Secretary of Defense for Special Operations (SO/LIC) hosted its first Accelerator event, offering same-day seed funding ($50K awards) for mature commercial technologies addressing nine operational challenges. Unlike standard industry days, vendors received funding immediately with a path to larger follow-on contracts. Secretary Hegseth's acquisition reform emphasis: field capabilities within six months, iterate on the battlefield. CMMC compliance wasn't mentioned, but any resulting contracts handling CUI will trigger DFARS 252.204-7012 or 252.204-7021 flow-downs. <a href="https://defensescoop.com/2026/07/24/solic-accelerator-event-sof-acquisition-reform/" target="_blank" rel="noopener noreferrer">DefenseScoop</a> Action: If you're pursuing SOF or rapid-acquisition contracts, ensure your compliance posture supports six-month fielding timelines. Self-assessment (Level 2 Self) is the only pathway during the CMMC suspension; plan accordingly. <hr> <h3>Enforcement & False Claims</h3> No new DIB-specific FCA settlements today. DOJ press releases covered healthcare fraud, narcotics, immigration, and general fraud cases with no defense contractor cyber-attestation angle. <hr> <h3>Cyber AB & Ecosystem</h3> No Cyber AB or C3PAO developments today. Cyber AB and C3PAO ecosystem feeds had no updates. The Phase 2 suspension (Level 2 C3PAO assessments on hold pending Reform Task Force review) remains in effect. 2026-07-24: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review https://carolinacleartech.com/cmmc-brief/2026-07-24/ Today: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review, SBA commended the move after months of small-business pressure, and contractors learned that DFARS 7012 self-assessments plus False Claims Act enforcement remain fully in force during the suspension. https://carolinacleartech.com/cmmc-brief/2026-07-24/ Fri, 24 Jul 2026 07:00:00 +0000 Today: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review, SBA commended the move after months of small-business pressure, and contractors learned that DFARS 7012 self-assessments plus False Claims Act enforcement remain fully in force during the suspension. <hr> <h3>Policy & Rulemaking</h3> DoD suspended CMMC Phase 2 C3PAO requirements (signed policy). On July 13, 2026, the Department of War suspended the CMMC Phase 2 third-party assessment requirements originally scheduled to take effect November 10, 2026, and launched a 60-day Reform Task Force review. Only Level 1 (Self) and Level 2 (Self) designations are allowed during the suspension; contracting officers are amending active contracts to remove C3PAO designations. The CMMC rule itself (32 CFR 170, DFARS 252.204-7021) was not repealed, DFARS 252.204-7012 and NIST 800-171 self-assessments remain in force, and primes can still flow down certification requirements contractually. <a href="https://www.preveil.com/blog/cmmc-clarified-webinar-recap/" target="_blank" rel="noopener noreferrer">PreVeil</a>, <a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-23-2026/" target="_blank" rel="noopener noreferrer">PilieroMazzo</a> SBA commended the suspension after small-business pressure (signed policy). The Small Business Administration issued News Release 26-73 yesterday commending DoD's decision, following "months of engagement between the DOD, SBA, and small business stakeholders" who warned that Phase 2 imposed "costly bureaucratic burdens" driving small contractors out of the defense industrial base. The suspension aims to "recalibrate the CMMC program so it preserves strong cybersecurity while eliminating regulatory barriers." Action: If you paused CMMC prep work, restart your Level 2 (Self) self-assessment now - self-attestation is the active pathway, and the False Claims Act is the enforcement lever. <a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-23-2026/" target="_blank" rel="noopener noreferrer">PilieroMazzo</a> Trump EO mandates AI-assisted supply-chain mapping for all national-security acquisitions (signed policy). A new executive order issued this week directs the Secretary of Defense to develop policy within 180 days requiring all prime contractors and subcontractors to submit a complete indentured bill of materials tracing all components, parts, equipment, and software back to raw-material origins for acquisitions "that support, implicate, or relate to United States national security." Contractors must implement risk-assessment procedures and proactively vet suppliers; DoD may use AI to map vulnerabilities and bottlenecks. Waiver requests under 10 U.S.C. 4872(c)(1) or (e) must include a formal mitigation plan; knowingly misleading the government or failing to implement an approved plan triggers fraud penalties. Action: If you hold or bid on national-security contracts, prepare for new supply-chain-transparency requirements by Q1 2027; start documenting your software supply chain now. <a href="https://defensescoop.com/2026/07/23/trump-authorizes-ai-map-defense-supply-chains/" target="_blank" rel="noopener noreferrer">DefenseScoop</a> DoD class deviation implements Chinese-military-company covered-lobbyist prohibition (signed policy, limited detail). A July 16, 2026 class deviation (revised from June 29) implements Section 851 of the FY 2025 NDAA, codified at 10 U.S.C. § 4663, which took effect June 30, 2026. The deviation prohibits defense contractors from retaining outside consultants designated as "covered lobbyists" associated with Chinese military companies. The deviation implements the prohibition as part of the Revolutionary FAR Overhaul (RFO) but does not provide definitions beyond the legislative text or guidance on a key safe-harbor provision. DoD abandoned formal DFARS rulemaking (Case 2025-D0007) in favor of this class deviation. Action: Review your consulting and lobbying relationships for China-nexus ties; the definition ambiguity leaves enforcement risk unclear. <a href="https://www.insidegovernmentcontracts.com/2026/07/regulations-issued-for-new-restrictions-on-defense-contractors-retaining-outside-consultants/" target="_blank" rel="noopener noreferrer">Covington</a> Federal News Network commentary argues for software-sovereignty requirements in defense procurement (opinion). Amanda Phelps, a strategic advisor at Coder, argues that "America-first" manufacturing should extend to the software supply chain, defining software sovereignty as four pillars: code written on U.S.-controlled infrastructure, runs on government-owned servers, U.S.-sourced and auditable toolchains, and no dependency on foreign SaaS/cloud services. The SHIPS Act restricts where ships are built but imposes no requirements on where the software running those ships is developed. "A modern destroyer is a software platform that happens to float," Phelps writes, noting that combat-system code can be pushed from a laptop syncing to a commercial cloud build server in a foreign region with no sovereign boundary. This is commentary, not policy, but expect similar arguments in future rulemakings. <a href="https://federalnewsnetwork.com/commentary/2026/07/the-case-for-an-america-first-software-supply-chain/" target="_blank" rel="noopener noreferrer">Federal News Network</a> <h3>Enforcement & False Claims</h3> No cyber-related False Claims Act settlements today. The DOJ press feed included a $1.175M PPP-fraud settlement by a defense-sector stainless-steel supplier (Matrix Metals LLC, Stafford-based), but the case involves pandemic-loan fraud, not cybersecurity or CMMC self-attestation. <a href="https://www.justice.gov/usao-sdtx/pr/stainless-steel-components-supplier-pays-over-11-million-resolve-false-claims-act" target="_blank" rel="noopener noreferrer">DOJ</a> Action: With Phase 2 suspended, self-attestation plus FCA enforcement is the compliance center of gravity. If your SPRS score knowingly misrepresents your compliance, the False Claims Act exposure is the same today as it was on July 12. Do not treat the suspension as a compliance holiday. <h3>Cyber AB & Ecosystem</h3> No Cyber AB or C3PAO announcements today. The PreVeil webinar recap (published July 2026 but covering a year of assessments before the suspension) confirms that C3PAO assessment economics and POA&M rules are now frozen during the Reform Task Force review. Contractors planning future Level 2 (C3PAO) certifications should monitor the task force's 60-day timeline for guidance on when the third-party pathway will resume and under what rules. <h3>NIST & Standards</h3> No NIST 800-171/172 revisions today. The PreVeil recap confirms that POA&M rules locked down before the suspension: only one-point controls are eligible, contractors must already be 80% compliant (88/110), and they have 180 days to close the gap including reassessment time. These rules remain in force for self-assessments. Action: If you are building a POA&M for your Level 2 (Self) assessment, hit 88/110 first or the POA&M is invalid. <h3>Contracting Impact</h3> Contracting officers began inserting CMMC requirements in Q4 2025, then suspended C3PAO designations in July 2026 (signed policy). The PreVeil recap notes that 48 CFR took effect November 10, 2025, and contracting officers began writing CMMC requirements into new awards. The July suspension triggered amendments to remove C3PAO designations from active contracts, but Level 2 (Self) requirements remain. Action: Review solicitations and contract modifications issued after November 2025 for CMMC clauses; confirm whether your contracts were amended to remove C3PAO language or still require Level 2 (Self). <h3>Practitioner Pulse</h3> Scoping, documentation, and MSPs are the assessment killers (practitioner analysis). PreVeil's recap of hundreds of CMMC assessments identifies three failure patterns: contractors failing to reduce scope (Virtual Desktop Infrastructure is now officially recognized for taking endpoints out of scope if implemented correctly), poor documentation (accurate System Security Plans aligned with real-world configurations are the assessment centerpiece), and MSP in-scope creep (if your MSP can access CUI and isn't certified, you are paying for two assessments). Tom Tolerton, Principal at Forvis Mazars, warns: "If your MSP touches CUI and isn't certified, guess what? You're now paying for two assessments." Action: Define technical and contractual boundaries to keep MSPs classified as "security protection assets" and away from CUI; treat your SSP as the centerpiece of your self-assessment and keep it aligned with actual configurations. <a href="https://www.preveil.com/blog/cmmc-clarified-webinar-recap/" target="_blank" rel="noopener noreferrer">PreVeil</a> 2026-07-23: The Phase II suspension memo continues to ripple through the procurement landscape https://carolinacleartech.com/cmmc-brief/2026-07-23/ Today: The Phase II suspension memo continues to ripple through the procurement landscape, with Crowell & Moring detailing how contractors should challenge solicitations that still carry C3PAO requirements, and GAO reminding agencies that past performance evaluation rules must be followed as written. https://carolinacleartech.com/cmmc-brief/2026-07-23/ Thu, 23 Jul 2026 07:00:00 +0000 Today: The Phase II suspension memo continues to ripple through the procurement landscape, with Crowell & Moring detailing how contractors should challenge solicitations that still carry C3PAO requirements, and GAO reminding agencies that past performance evaluation rules must be followed as written. <hr> <h3>Policy & Rulemaking</h3> CMMC Phase II Suspended, Reform Task Force Launched (Signed Memo, Memo 26-P-1023, July 13, 2026) DoW immediately suspended all CMMC Phase II milestones, including the November 10, 2026 C3PAO assessment phase-in, citing compliance costs and acquisition streamlining. The CIO is standing up a CMMC Reform Task Force with a 60-day review clock and a public RFI for industry feedback. A follow-up implementation memo directs contracting officers to amend active solicitations removing Level 2 C3PAO and Level 3 requirements "as soon as practicable" and to strip those requirements from existing contracts before the next option period or scheduled administrative modification. Phase I self-assessment obligations (Level 1 Self and Level 2 Self) remain in force. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 compliance are unchanged. (<a href="https://www.governmentcontractslegalforum.com/2026/07/articles/cybersecurity/department-of-war-immediately-suspends-cmmc-phase-ii-requirements-launches-60-day-reform-review/" target="_blank" rel="noopener noreferrer">Crowell analysis</a>) <ul> <li>Action: Continue maintaining your SSP and POA&M against NIST 800-171 Rev 2. Self-assessment scores in SPRS must stay current. Monitor the RFI for comment deadlines and submit feedback if your organization has a stake in how the program is restructured. Brief leadership that the C3PAO pathway is frozen but that self-attestation under the False Claims Act is now the enforcement lever.</li> </ul> Fixed-Price Contracting Mandate, CAS Rescission, PCB Supply Chain ANPRM The FAR Council issued guidance implementing the fixed-price contracting mandate under Executive Order 14402. Separately, the CAS Board finalized a rule rescinding four Cost Accounting Standards, and an advance notice of proposed rulemaking addresses printed circuit board supply chain requirements. (<a href="https://www.governmentcontractslegalforum.com/2026/07/articles/government-contracts/fastest-5-minutes-fixed-price-contracting-protests-cas-supply-chain/" target="_blank" rel="noopener noreferrer">Crowell podcast</a>) <ul> <li>Action: The PCB ANPRM is worth watching if your products include electronics assemblies destined for DoW programs. The CAS rescission simplifies compliance for affected contractors. Review the fixed-price mandate guidance against your current contract mix.</li> </ul> <h3>Enforcement & False Claims</h3> No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related FCA cases appeared in today's feed. The enforcement landscape remains as stated: with C3PAO assessments suspended, self-attestation accuracy is the exposure point. DOJ's Civil Cyber-Fraud Initiative has signaled it could expand scrutiny to false or inaccurate CMMC Phase I self-assessments. Any contractor whose SPRS score does not reflect actual implementation status carries qui tam and FCA risk right now. <ul> <li>Action: Audit your SPRS score against your actual 800-171 implementation. If there are gaps between what you attested to and what you can demonstrate, document them in your POA&M and begin remediation before an enforcement action forces the question.</li> </ul> <h3>Contracting Impact</h3> Solicitations Must Drop C3PAO Requirements; Contractors Should Protest If They Don't Crowell's follow-up analysis highlights that while agencies are directed to amend solicitations, the onus falls on contractors to monitor compliance. If a solicitation still contains Level 2 C3PAO or Level 3 requirements after the suspension memo, contractors should use the Q&A process and consider a pre-award bid protest. For procurements where proposals have already been submitted, contractors who were unable to comply with the now-suspended requirements may have grounds to argue they were improperly excluded, though the analysis differs depending on whether the procurement follows the pre-overhaul FAR or the FAR Overhaul (RFO 15.106). (<a href="https://www.governmentcontractslegalforum.com/2026/07/articles/cybersecurity/cmmc-phase-ii-suspension-requires-reconsideration-of-such-requirements-in-solicitations/" target="_blank" rel="noopener noreferrer">Crowell</a>) <ul> <li>Action: Review every active solicitation your organization is tracking. If any still reference CMMC Level 2 C3PAO or Level 3 assessment requirements, flag them for your contracts team and counsel. Document the solicitation language and the suspension memo for a potential protest record.</li> </ul> GAO: Past Performance Cutoffs Must Follow Solicitation Language (B-424182.2, June 22, 2026) GAO sustained a protest against the VA for treating a three-year past performance window as a hard cutoff when the solicitation only said recent experience "may be viewed more favorably." The agency improperly excluded contracts with Exceptional and Very Good ratings. FAR 42.1503's three-year baseline does not override solicitation-specific recency language. (<a href="https://www.pilieromazza.com/when-does-a-cpar-stop-mattering-gaos-latest-answer-is-it-depends/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>, <a href="https://www.governmentcontractslegalforum.com/2026/07/articles/bid-protest/june-2026-bid-protest-sustain-of-the-month-gao-reminds-agencies-that-once-youve-set-the-rules-you-have-to-play-by-them/" target="_blank" rel="noopener noreferrer">Crowell</a>) <ul> <li>Action: When responding to solicitations, include all relevant past performance references, not just those within three years. If you are excluded based on an arbitrary age cutoff that the solicitation did not establish, consult counsel about a protest.</li> </ul> <h3>NIST & Standards</h3> No new NIST SP 800-171 or 800-172 revisions or CUI guidance published today. The operative standard remains NIST SP 800-171 Rev 2, which DoW explicitly confirmed as the self-assessment baseline during the Phase II suspension period. <h3>Practitioner Pulse</h3> The Crowell & Moring "Fastest 5 Minutes" podcast released a special edition covering the Phase II suspension, hosted by their cybersecurity and government contracts teams. Worth a listen for the legal nuances around the implementation memo's amendment directives and what "held in abeyance" means for contractors already mid-assessment. (<a href="https://www.governmentcontractslegalforum.com/2026/07/articles/cmmc/special-edition-of-the-fastest-5-minutes-suspension-of-cmmc-phase-ii-requirements/" target="_blank" rel="noopener noreferrer">Podcast</a>) The practical question on practitioners' minds: should you keep investing in C3PAO readiness? The suspension is real but temporary (60-day review clock). Contractors close to assessment-ready should maintain their posture, because (1) the underlying 800-171 obligation never went away, (2) primes can still contractually require third-party assessments regardless of DoW's program status, and (3) the FCA makes inaccurate self-attestation a financial liability today, not a hypothetical future risk. 2026-07-22: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about https://carolinacleartech.com/cmmc-brief/2026-07-22/ Today: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about underlying NIST 800-171 obligations, PSC member companies report continuing C3PAO assessments voluntarily, and the RFI comment deadline of August 14 gives contractors a narrow window to shape what comes next. https://carolinacleartech.com/cmmc-brief/2026-07-22/ Wed, 22 Jul 2026 07:00:00 +0000 Today: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about underlying NIST 800-171 obligations, PSC member companies report continuing C3PAO assessments voluntarily, and the RFI comment deadline of August 14 gives contractors a narrow window to shape what comes next. <hr> <h3>Policy & Rulemaking</h3> CMMC Phase 2 suspended, but 800-171 obligations unchanged (task force review, not a repeal). DoD suspended the Phase 2 third-party certification rollout pending a Reform Task Force review. The suspension affects only the requirement for C3PAO assessments; it does not touch DFARS 252.204-7012, NIST SP 800-171 compliance, or Phase 1 self-assessment requirements. Contractors must still self-certify under penalty of perjury that they implement required security controls. As attorney Eric Crusius noted: "The CMMC program is just a certification program on top of the security controls that are still required and will be required." Phase 2 was not scheduled to begin until November anyway, so the practical near-term impact is limited, but the signal matters. - <a href="https://federalnewsnetwork.com/contracting/2026/07/dod-pauses-cmmc-but-contractors-still-have-obligations/" target="_blank" rel="noopener noreferrer">Federal News Network</a> - <a href="https://federalnewsnetwork.com/cybersecurity/2026/07/contractors-face-uncertainty-with-cybersecurity-regs-ai-rules-and-acquisition-policies/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Action: Do not slow down 800-171 implementation. Self-attestation remains legally binding and FCA-enforceable. If you are mid-assessment with a C3PAO, the consensus from PSC members is to finish it; the investment is already made and a compliance regime will return in some form. RFI comments due August 14. The Reform Task Force has issued a request for information from industry and the public. Responses are due before the 60-day review concludes. PSC's Stephanie Kostro urged contractors to submit feedback on what works, what does not, and what requirements are "potentially superfluous to cybersecurity." - <a href="https://federalnewsnetwork.com/cybersecurity/2026/07/contractors-face-uncertainty-with-cybersecurity-regs-ai-rules-and-acquisition-policies/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Action: Submit RFI comments by August 14. If your company has specific pain points with assessment scope, control interpretation, or cost burden, this is the window to get them on record. Coordinate through your trade association if applicable. <h3>Enforcement & False Claims</h3> No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related False Claims Act cases appeared in today's collection. The DOJ press releases in this batch involved drug trafficking, weapons, immigration, and other matters unrelated to defense contractor cybersecurity compliance. Standing guidance: The FCA remains the primary enforcement lever during the Phase 2 suspension. Self-attestation under CMMC Phase 1 carries penalties of perjury. Any contractor who attests to 800-171 compliance without actually implementing the controls is exposed to qui tam whistleblower suits and DOJ enforcement. The absence of new cases today does not reduce the risk; DOJ has consistently signaled that cyber-fraud is an active enforcement priority. <h3>Cyber AB & Ecosystem</h3> PSC members continuing C3PAO assessments despite suspension. Every contractor PSC spoke with who was mid-assessment is completing the process. Their rationale: sunk costs, good governance, and certainty that a compliance regime will return. This signals that the C3PAO pipeline is not collapsing, but new assessment starts may slow while the Task Force review plays out. - <a href="https://federalnewsnetwork.com/cybersecurity/2026/07/contractors-face-uncertainty-with-cybersecurity-regs-ai-rules-and-acquisition-policies/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Risk to watch: Crusius reported anecdotal evidence of some companies (not his clients) already saying "let's see if we actually have to put these security controls in." If this attitude spreads, it creates a two-tier market: companies that maintained compliance and can bid immediately when requirements return, and companies that will face months of catch-up. Primes paying attention will note who kept their house in order. <h3>Contracting Impact</h3> Primes can still flow down certification requirements contractually. The suspension applies to DoD's CMMC program office approval process for including CMMC in solicitations. It does not prevent prime contractors from requiring subcontractor compliance via contract terms. Expect flow-down language to continue referencing 800-171 and potentially voluntary C3PAO certification. - <a href="https://federalnewsnetwork.com/contracting/2026/07/dod-pauses-cmmc-but-contractors-still-have-obligations/" target="_blank" rel="noopener noreferrer">Federal News Network</a> GSA's revised AI acquisition clause (watch item for DIB). GSA revised its proposed LLM-focused acquisition clause after industry pushback. The new version narrows scope to contracts where government data is processed by large language models, excludes embedded commercial AI (word processors, navigation), and replaces the broad "American AI systems" mandate with more flexible language. This is not a CMMC requirement, but DIB contractors using AI in contract performance should track it; if GSA finalizes the clause, DoD adoption or parallel rulemaking is likely. - <a href="https://federalnewsnetwork.com/artificial-intelligence/2026/07/as-agencies-rethink-cybersecurity-requirements-how-will-they-manage-ai-risks/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Action: Review any active solicitations for updated CMMC or cybersecurity language. Monitor SAM.gov for amendments referencing the suspension or revised assessment timelines. <h3>Practitioner Pulse</h3> No notable r/CMMC threads or practitioner analysis surfaced in today's collection. The key practitioner question right now: Should I keep spending on 800-171 implementation during the suspension? The answer from every expert interviewed this week is unambiguous: yes. The controls are still legally required under DFARS 7012, self-attestation is enforceable under the FCA, and the suspension only affects whether a third party checks your work. Stopping now is a compliance and legal risk, not a cost savings. <hr> Brief generated 2026-07-22. Sources: Federal News Network (3 articles), DefenseScoop. 34 articles reviewed; 30 excluded as not relevant to DIB compliance. 2026-07-21: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance https://carolinacleartech.com/cmmc-brief/2026-07-21/ Today: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance path for contractors with limited CUI footprints, FAR Council proposed compressing termination settlement deadlines to 90 days (raising FCA risk for contractors using protective estimates), and no new DoD or Cyber AB policy announcements appeared. https://carolinacleartech.com/cmmc-brief/2026-07-21/ Tue, 21 Jul 2026 07:00:00 +0000 <h1>CMMC Brief - July 21, 2026</h1> Today: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance path for contractors with limited CUI footprints, FAR Council proposed compressing termination settlement deadlines to 90 days (raising FCA risk for contractors using protective estimates), and no new DoD or Cyber AB policy announcements appeared. <hr> <h2>Practitioner Pulse</h2> Summit 7 publishes CUI enclave implementation guide for contractors with small CUI footprints. <a href="https://summit7.us/blog/get-cmmc-compliant-asap/" target="_blank" rel="noopener noreferrer">Summit 7's blog post</a> details why a managed CUI enclave is the fastest and most cost-effective CMMC compliance approach for organizations where 15% or fewer employees touch CUI. A CUI enclave isolates sensitive data into a smaller controlled environment (typically GCC High), reducing assessment scope and internal disruption. Summit 7 distinguishes "managed enclaves" (you own the M365 GCC High tenant and licenses, vendor builds and supports) from "hosted enclaves" (vendor owns everything). Managed enclaves offer better scalability, hybrid support, FedRAMP High alignment, and U.S.-person staffing guarantees. Deployment timeline for a managed enclave: weeks for virtual environment standup, as little as two months to CMMC compliance if scoped tightly. Summit 7 claims virtualized enclaves in GCC High shift much of the control burden to Microsoft, simplifying compliance management. What to do: if your CUI footprint is small and you're under prime pressure to certify quickly, review enclave economics against all-in migration. The post does not address what happens when primes contractually require full-enterprise certification regardless of actual CUI flow, a gap contractors should clarify before committing to enclave architecture. This is vendor guidance (Summit 7 sells managed enclaves), not DoD policy; treat the timeline claims as aspirational and verify with your C3PAO or compliance advisor. <hr> <h2>Contracting Impact</h2> FAR Council proposes 90-day deadline for termination settlement proposals, compressing timeline and raising FCA exposure risk. <a href="https://www.insidegovernmentcontracts.com/2026/07/far-council-proposes-90-day-deadline-for-termination-settlement-proposals/" target="_blank" rel="noopener noreferrer">Covington's analysis</a> of the FAR Part 49 proposed rule notes the FAR Council wants to accelerate termination-for-convenience settlements by requiring contractors to submit termination settlement proposals within 90 days after termination, down from the current one-year deadline. The proposed rule does not reduce the information required (cost data, profit positions, inventory disposal, subcontractor claim resolution). For large programs with multi-tier subcontractor structures or substantial inventory, completing these tasks in 90 days may prove difficult. Covington flags the FCA risk: contractors might feel pressure to include estimated or protective amounts to account for unresolved subcontractor disputes or uncertain costs, increasing potential False Claims Act exposure. Contracting officers may face additional administrative burdens deciphering incomplete proposals, processing extension requests, and resolving disputes. The proposed rule applies to FAR Part 49 (government contracts generally); FAR Part 12 (commercial products/services) does not directly adopt the 90-day timeline but COs retain discretion and may be influenced by it. What to do: review your termination response procedures now; confirm you can quickly assemble cross-functional teams (contracts, accounting, supply chain, legal); review subcontract terms to confirm subcontractors can provide timely cost and settlement information. If you use protective estimates to meet a compressed deadline, document your basis thoroughly to defend against later FCA allegations of inflated claims. This is a proposed rule (RFI stage); comment if the 90-day timeline is operationally unrealistic for your contracts. <hr> No CMMC policy, rulemaking, enforcement, Cyber AB, NIST, or standards developments appeared in today's collection. The DOJ press releases in the feed (articles 7-34) cover general crime (arson, firearms, fraud, drug trafficking, immigration) with no cyber False Claims Act settlements or defense-contractor enforcement actions. DefenseScoop and Federal News Network articles cover AI adoption strategy, skills-based hiring, drone testing, and directed energy RFIs, none of which directly implicate CMMC or DFARS 252.204-7012 compliance. During the Phase 2 suspension, the absence of daily policy churn is expected; self-assessment plus FCA enforcement remains the compliance center of gravity until the Reform Task Force reports. 2026-07-18: The CMMC Reform Task Force held its first meeting Thursday and will report by late September https://carolinacleartech.com/cmmc-brief/2026-07-18/ Today: The CMMC Reform Task Force held its first meeting Thursday and will report by late September, DoD is planning listening sessions for contractor feedback, and PreVeil published a comprehensive guide to False Claims Act enforcement showing $51.8M in cybersecurity-related settlements last year. https://carolinacleartech.com/cmmc-brief/2026-07-18/ Sat, 18 Jul 2026 07:00:00 +0000 <h1>CMMC Brief - 2026-07-18</h1> Today: The CMMC Reform Task Force held its first meeting Thursday and will report by late September, DoD is planning listening sessions for contractor feedback, and PreVeil published a comprehensive guide to False Claims Act enforcement showing $51.8M in cybersecurity-related settlements last year. <hr> <h2>Policy & Rulemaking</h2> CMMC Reform Task Force launches with first meeting, 60-day review timeline begins. DoD CIO Kirsten Davies confirmed the task force met Thursday (July 17) across from her office at the Pentagon. The review has 60 days to gather feedback and analyze the program, then 15 days to synthesize recommendations for a public report expected by late September. Davies described this as a "soup-to-nuts" review examining CMMC alongside NIST 800-171, DFARS requirements, and the cyber threat landscape. Outcomes range from "an overhaul to small tweaks," and the task force includes leadership from A&S, I&S, OCIO, general counsel, public affairs, legislative affairs, SBA, and the White House. The report will be made public when complete. <a href="https://defensescoop.com/2026/07/17/pentagon-task-force-to-review-cmmc-hits-the-ground-running/" target="_blank" rel="noopener noreferrer">DefenseScoop</a>, <a href="https://federalnewsnetwork.com/defense-news/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/" target="_blank" rel="noopener noreferrer">Federal News Network</a> DoD planning listening sessions nationwide to gather contractor input. In addition to the RFI published earlier this week, DoD will hold in-person listening sessions across the country specifically targeting small businesses, cybersecurity operators, and Cyber AB/C3PAO community feedback. Davies emphasized the goal is to "incorporate the voice of small companies to make sure we are truly reducing barriers to entry for them to do business with DoD." No dates or locations announced yet. Watch for details on DoD CIO social channels and the Cyber AB newsletter if you want a seat. <a href="https://federalnewsnetwork.com/defense-news/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Under Secretary Duffey issued memo directing removal of C3PAO requirements from active solicitations. This is the administrative follow-through on the Phase 2 suspension. Contracting officers are pulling third-party assessment language from live RFPs that referenced the November 10 deadline. Level 2 (Self) requirements remain in force. If you submitted a proposal referencing a C3PAO cert timeline, expect amendment notices or reach out to the contracting officer proactively to confirm what still applies. <a href="https://federalnewsnetwork.com/defense-news/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/" target="_blank" rel="noopener noreferrer">Federal News Network</a> Class deviations or interim rules could accelerate changes post-review. Legal analysts (Sandeep Kathuria, Saul Ewing) note the administration has used class deviations and interim rulemaking in other areas to move fast without full notice-and-comment cycles. If the task force recommends structural changes, expect DoD to issue implementation guidance within weeks rather than waiting for a new final rule. That means your November planning window could shift again in October. <a href="https://federalnewsnetwork.com/defense-news/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/" target="_blank" rel="noopener noreferrer">Federal News Network</a> <h2>Enforcement & False Claims</h2> PreVeil analysis: False Claims Act cybersecurity settlements hit $51.8M in FY2025, up 233% year-over-year. This is now the enforcement center of gravity during the Phase 2 suspension. Self-assessment scores submitted to SPRS are certifications to the federal government. If your score doesn't match what's running on your network and you keep billing, you have FCA exposure. DOJ's Civil Cyber-Fraud Initiative (launched October 2021) pursues contractors who misrepresent cybersecurity posture, deliver deficient security products, or fail to report incidents. Treble damages and per-claim penalties apply whether DOJ sues directly or a whistleblower files qui tam. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> LOGZONE Inc. settled for $507,144 (June 2026) after Navy contracts ran on systems scoring -170 in SPRS. The Huntsville contractor failed to implement required NIST 800-171 controls on two Navy contracts from 2021-2025. DCMA assessment put the actual score near the bottom of the -203 to 110 range. Whatever LOGZONE told the Navy didn't match reality. This case is a reminder: DCMA can audit your SSP at any time under existing DFARS clauses, suspension or not. If you've been "planning to fix" that -50 score, the clock is running. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> Georgia Tech Research Corporation settled for $875,000 (September 2025) after submitting a campus-wide SPRS score for a lab with no antivirus and no SSP. GTRC's Astrolavos Lab ran DoD cyber-defense research for years with zero endpoint protection. When reporting time came, GTRC submitted a 98-out-of-110 score that DOJ called "fictitious" because it referenced a campus environment unrelated to any system processing covered defense information. Two whistleblowers from Georgia Tech's own cybersecurity team split $201,250 of the recovery. If you're using an enterprise-wide score to cover a CUI enclave that doesn't actually meet the controls, this is your risk profile. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> Aero Turbine / Gallant Capital Partners: $1.75M settlement (July 2025) shows M&A compliance liability flows to acquirers. Acquiring a defense contractor means acquiring its compliance history, not just its backlog. Due diligence on CMMC posture and historical SPRS accuracy is now a standard M&A checklist item. If you're buying a DIB company, demand SSP documentation, DCMA assessment records, and proof the submitted SPRS scores match actual control implementation. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> Raytheon / Nightwing: $8.4M settlement (May 2025) for running ~30 DoD contracts on networks non-compliant with DFARS 252.204-7008, 252.204-7012, and FAR 52.204-21. Nightwing was held liable as Raytheon's successor for conduct predating the acquisition. This is the same M&A successor-liability principle as Aero Turbine but at prime-contractor scale. If you're a subcontractor on a Raytheon/Nightwing contract, this settlement signals the prime is now hypersensitive to flow-down compliance. Expect audits. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> Health Net Federal Services / Centene: $11.25M settlement (February 2025) for falsely certifying compliance with security controls in TRICARE contract. HNFS certified at least seven controls it wasn't actually meeting. This case maps onto any health-adjacent defense IT work (DHA, TRICARE, VA). The FCA applies whether your contract is weapons systems or claims processing. Check your SSP against what's live, not what you plan to deploy. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> <h2>Contracting Impact</h2> Live CMMC solicitations show Level 2 (Self) requirements remain in force; C3PAO references under review. PreVeil maintains a running list of SAM.gov postings citing CMMC. Recent examples include Air Force's "Grand Challenge - Relentless Wolfpack" (July 14, Level 2 verified status in SPRS required), SOCOM's Air Vehicle Computer RFI (July 14, originally requiring C3PAO cert, now under review), and Army's DAQ Electronics solicitation (July 10, Level 2 Self). If your SPRS score isn't current or accurate, you're ineligible for these awards today. The suspension didn't pause self-assessment requirements. <a href="https://www.preveil.com/blog/list-of-cmmc-contracts/" target="_blank" rel="noopener noreferrer">PreVeil</a> Contracting officers authorized to include CMMC since November 10, 2025. Phase 1 (self-assessment) has been flowing into solicitations for eight months. If you haven't started on CMMC compliance because you were waiting for the C3PAO requirement, you misread the timeline. The vast majority of current solicitations require Level 2 (Self), which is DFARS 252.204-7012 + a logged SPRS score. Check SAM.gov attachments for buried CMMC clauses; they don't always appear in the main solicitation text. <a href="https://www.preveil.com/blog/list-of-cmmc-contracts/" target="_blank" rel="noopener noreferrer">PreVeil</a> <h2>Practitioner Pulse</h2> PreVeil's False Claims Act guide is the most practitioner-focused breakdown published this year. It walks through how DFARS 252.204-7012 maps to FCA liability, explains qui tam mechanics, and provides case-by-case analysis of recent settlements with dollar figures and fact patterns. If you're briefing leadership on why CMMC still matters during the suspension, this is your deck. The guide also covers what happens when you acquire a defense contractor (successor liability) and why campus-wide scores don't protect lab-specific CUI enclaves. Direct, blunt, and actionable. Bookmark it. <a href="https://www.preveil.com/blog/false-claims-act-defense-contractors/" target="_blank" rel="noopener noreferrer">PreVeil</a> Matt Travis (Cyber AB CEO) quoted in PreVeil's solicitation tracker: "If you haven't started getting engaged in CMMC, now is the time. It was probably the time in early 2024, but now the light is flashing red." This quote ran in the context of live solicitations requiring Level 2 (Self). The Cyber AB has no enforcement authority, but Travis is correct that the self-assessment pathway is live and contracts are being awarded under it. The suspension bought time for contractors who were planning C3PAO assessments; it did nothing for contractors who haven't implemented 800-171 controls or submitted an SPRS score. <a href="https://www.preveil.com/blog/list-of-cmmc-contracts/" target="_blank" rel="noopener noreferrer">PreVeil</a> DoD CIO Davies described current CMMC assessments as "burdensome, red-tape ridden, check-the-box, point-in-time view" during press tour. This language signals the department's posture heading into the review. Davies hasn't said whether third-party assessments disappear entirely, but the framing is clear: DoD sees the C3PAO model as overhead that doesn't map to actual security outcomes. If you're a C3PAO or assessment org, the next 60 days will determine whether your business model survives in its current form. If you're a contractor, this suggests the final framework will lean toward continuous monitoring or commercial security solutions rather than snapshot audits. <a href="https://federalnewsnetwork.com/defense-news/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/" target="_blank" rel="noopener noreferrer">Federal News Network</a> <hr> This brief covers developments through 2026-07-18. For updates, see <a href="https://carolinacleartech.com/cmmc-brief/" target="_blank" rel="noopener noreferrer">carolinacleartech.com/cmmc-brief</a>. 2026-07-17: No CMMC, DFARS cybersecurity, or defense industrial base compliance developments reported in https://carolinacleartech.com/cmmc-brief/2026-07-17/ Today: No CMMC, DFARS cybersecurity, or defense industrial base compliance developments reported in today's collection. DOJ enforcement activity focused on general criminal matters with no False Claims Act cyber cases. --- ## Note on Today's Collection Today's RSS feed collection (12 articles total) surfaced no developments relevant to DIB contractors, CMMC compliance, NIST 800-171, DFARS cybersecurity clauses, or cyber-related False Claims Act enforcement. All DOJ press releases covered general https://carolinacleartech.com/cmmc-brief/2026-07-17/ Fri, 17 Jul 2026 07:00:00 +0000 <h1>CMMC Brief -- 2026-07-17</h1> Today: No CMMC, DFARS cybersecurity, or defense industrial base compliance developments reported in today's collection. DOJ enforcement activity focused on general criminal matters with no False Claims Act cyber cases. <hr> <h2>Note on Today's Collection</h2> Today's RSS feed collection (12 articles total) surfaced no developments relevant to DIB contractors, CMMC compliance, NIST 800-171, DFARS cybersecurity clauses, or cyber-related False Claims Act enforcement. All DOJ press releases covered general criminal enforcement: firearms offenses, drug trafficking, fraud unrelated to federal contracting, and arson. This is the first collection since the pipeline launched (2026-07-16) with no actionable CMMC content. It reflects the current policy environment: the CMMC Phase 2 suspension remains in effect pending the Reform Task Force review, no new Federal Register notices on 32 CFR 170 or DFARS Case 2019-D041, and no new Civil Cyber-Fraud Initiative settlements. What still applies during the suspension: - DFARS 252.204-7012 and NIST SP 800-171 self-assessment requirements remain in force for contracts with CUI - Only Level 1 (Self) and Level 2 (Self) designations are allowed; C3PAO assessments are voluntary - Primes can still flow down certification requirements contractually - False Claims Act exposure for material misrepresentation of cybersecurity posture continues Action items: - Continue maintaining your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) to NIST SP 800-171 Rev 2 (or Rev 3 if your contract specifies it) - Monitor your SPRS score if you have active DoD contracts with CUI - If you submitted RFI comments on the CMMC Reform Task Force review, no response deadline updates were published today - Check <a href="https://www.regulations.gov/docket/FAR-2024-0011" target="_blank" rel="noopener noreferrer">regulations.gov docket FAR-2024-0011</a> for any new public comments or agency responses (none reported in today's feeds) No new briefing sections today. Normal collection resumes tomorrow at 6:00 AM EST. <hr> This briefing is produced by an automated pipeline monitoring 14+ CMMC and defense compliance sources. For questions or to report a missed development, contact <a href="mailto:contact@carolinacleartech.com">contact@carolinacleartech.com</a>. 2026-07-16: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2 https://carolinacleartech.com/cmmc-brief/2026-07-16/ Today: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2 rollout, while the SBA publicly credited itself with pushing the Department of War into that suspension. Separately, the DFARS proposed rule expanding Foreign Ownership, Control, or Influence (FOCI) disclosure to unclassified defense contracts closed its comment period, and a bipartisan Senate bill would drop the disclosure threshold from $5 million to $500,000 in contract value. None of thi https://carolinacleartech.com/cmmc-brief/2026-07-16/ Thu, 16 Jul 2026 07:00:00 +0000 Today: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2 rollout, while the SBA publicly credited itself with pushing the Department of War into that suspension. Separately, the DFARS proposed rule expanding Foreign Ownership, Control, or Influence (FOCI) disclosure to unclassified defense contracts closed its comment period, and a bipartisan Senate bill would drop the disclosure threshold from $5 million to $500,000 in contract value. None of this touches your existing DFARS 252.204-7012 or NIST SP 800-171 self-assessment obligations, which remain in force. <h2>Policy & Rulemaking</h2> DoD opens RFI on the post-suspension CMMC model; suspension itself is signed and in force. Alongside the July suspension of the CMMC Phase 2 third-party (C3PAO) phase-in, DoD posted a request for information (RFI) on SAM.gov asking industry how to cut compliance costs and administrative burden while keeping Controlled Unclassified Information (CUI) protected. This is task force review territory, not a new requirement. Do: if your company has an SSP (System Security Plan) or has been through an assessment cycle, submit RFI comments now while the process is genuinely open to input; watch the SAM.gov docket for the comment deadline. (<a href="https://federalnewsnetwork.com/sponsored-content/2026/07/the-real-story-isnt-the-suspension-its-the-question-the-department-asked-next/" target="_blank" rel="noopener noreferrer">Federal News Network</a>, <a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-16-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>, <a href="https://news.google.com/rss/articles/CBMihAFBVV95cUxNVmwyR0FQRHJldnhPTnBpZXNPelNJancwSm9jdG5UNVNYNC0yb1hJdnNiZ2l3Yms0a0VWdEc4QmFjZGlfMXRXT2c5S3JmbzZQUGlGd0t2NExuNUg1blBBQzN1RXZ4UDI4VHNLYjFvNUV2UzdwUkRGR3QwQzZ2S2RHNEF6aUg" target="_blank" rel="noopener noreferrer">JD Supra via Google News</a>) SBA takes a public victory lap on the suspension. The SBA Office of Advocacy announced July 13 that it worked with industry groups, including PilieroMazza, to push DoW into suspending Phase 2 pending a cost-and-burden review. This is politics and framing, not new policy text, but it signals continued small-business pressure against reinstating a hard C3PAO mandate. Do: nothing required; useful context if you're drafting your own RFI comment or leadership briefing on why the pause happened. (<a href="https://www.pilieromazza.com/weekly-update-for-government-contractors-and-commercial-businesses-july-16-2026/" target="_blank" rel="noopener noreferrer">PilieroMazza</a>) <h2>Cyber AB & Ecosystem</h2> C3PAO pipeline in limbo, but Level 2 work should not stop. Practitioner discussion this week (opinion, not official guidance) argues the suspension is a Phase pause, not a Level pause: companies pursuing Level 2 (Self) still need the same 800-171 controls in place, they just cannot get third-party certified right now. One 20-year compliance veteran frames this as a normal cycle in validation frameworks, not a reason to stop documentation work. Do: if your team paused SSP and evidence-collection work assuming Level 2 was frozen, correct that internally; the controls requirement did not move, only the assessment pathway did. (<a href="https://www.reddit.com/r/CMMC/comments/1uxh56b/the_day_after_a_dow_cmmc_pause_announcement/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC - "The Day After"</a>) Assessor/tooling economics still bite regardless of the pause. A contractor building toward Level 2 with under 50 endpoints flagged NinjaOne's $15K/year FedRAMP surcharge on top of standard RMM (Remote Monitoring and Management) licensing as a dealbreaker, pushing them toward an on-prem alternative instead. This is anecdotal, but it is a real data point on what FedRAMP-authorized tooling costs a small DIB (defense industrial base) shop compared to commercial equivalents. Do: if you're pricing GCC High (Microsoft Government Community Cloud High) or FedRAMP-authorized tooling for a sub-50-endpoint environment, budget for premium surcharges on top of list price, and get quotes for on-prem alternatives before committing. (<a href="https://www.reddit.com/r/CMMC/comments/1ux5b37/something_just_dawned_on_me_maybe_a_2020_moment/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) <h2>Contracting Impact</h2> FOCI disclosure rule comment period closed; Congress wants to go further. The DFARS proposed rule extending Foreign Ownership, Control, or Influence (FOCI) disclosure beyond classified contracts to unclassified work involving CUI and cybersecurity systems closed its public comment period July 6. It would apply to prime and subcontractor DoW contracts above $5 million, affecting an estimated 40,000 entities, with a carve-out for commercial items unless a senior DoW official flags a national-security risk. Separately, Senators Warren and Grassley introduced a bill June 1 that would drop the disclosure threshold to $500,000 and redefine "beneficial owner" under Title 10 rather than SEC rules. This is proposed rule plus pending legislation, not current law. Do: if you hold or bid on DoW contracts in the $500K-$5M range and have any foreign ownership, investment, or board involvement, start tracking this now; a $500K threshold would sweep in far more small and mid-size DIB contractors than the current $5M line. Watch both the DFARS case and the FY2027 NDAA conference process. (<a href="https://www.insidegovernmentcontracts.com/2026/07/congress-considers-further-foci-reforms-as-dow-moves-to-expand-disclosure-requirements-for-unclassified-defense-contractors/" target="_blank" rel="noopener noreferrer">Covington Inside Government Contracts</a>) <h2>Practitioner Pulse</h2> SMBs split on wait-and-see versus continuing to build evidence. A r/CMMC thread asks small and mid-size contractors what they're actually doing during the 60-day review: some are pausing engagement with RPOs (Registered Practitioner Organizations) and C3PAOs, others are continuing SSP documentation and evidence collection regardless of the assessment freeze. No consensus in the thread, but the split itself is the signal: contractors who keep building evidence now avoid a scramble whenever Phase 2 resumes. Do: keep collecting POA&M (Plan of Action and Milestones) and control-implementation evidence even if you've paused formal C3PAO engagement; that work does not expire when the pause lifts. (opinion/discussion) (<a href="https://www.reddit.com/r/CMMC/comments/1ux3mkn/what_are_smbs_planning_now_that_cmmc_phase_2_is/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) CUI markings are inconsistent, and that does not change your obligation. A contractor reported receiving a USAF task order with no CUI marking from an office that "habitually marked everything CUI." Missing markings do not mean data isn't CUI; contract clauses and DFARS 252.204-7012 govern the obligation independent of marking hygiene on any single document. Do: if a task order arrives without expected CUI markings, confirm with the contracting officer rather than assuming the requirement dropped; document the inquiry for your file. (opinion/discussion) (<a href="https://www.reddit.com/r/CMMC/comments/1uwoqo3/task_order_not_marked_cui/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) Microsoft won't commit to end-to-end encryption guarantees in GCC for EAR-controlled data. A practitioner flagged that Microsoft declines to endorse putting Export Administration Regulations (EAR)-controlled data into standard GCC (Government Community Cloud), even with Customer Lockbox and customer-managed keys enabled, because Microsoft itself can't guarantee full end-to-end encryption in that tier. This matters for any DIB contractor treating GCC as sufficient for export-controlled or CUI-adjacent data without a documented boundary. Do: if your SSP scopes GCC (not GCC High) as your CUI enclave, get Microsoft's boundary commitments in writing and confirm with your RPO whether GCC High is actually required for your data types. (opinion/discussion) (<a href="https://www.reddit.com/r/CMMC/comments/1uwycod/microsoft_gcc_and_gcch/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>) "Claude for Government" raises FedRAMP-authorization questions practitioners can't answer yet. A thread asks whether Anthropic is an approved entity for CMMC Level 2 environments, referencing marketing claims tied to a FedRAMP High boundary via Palantir's cloud. No one in the thread had a definitive answer. Do: before letting any team member near an LLM tool inside a CUI boundary, confirm the actual FedRAMP authorization (not marketing language) and whether the specific deployment model, not just the vendor name, carries that authorization. (opinion/discussion) (<a href="https://www.reddit.com/r/CMMC/comments/1uxomlh/claude_for_government/" target="_blank" rel="noopener noreferrer">Reddit r/CMMC</a>)