CMMC Brief

2026-10-07: NIST's AI Accelerator director addressed post-deployment drift monitoring for generative AI

Wed, 07 Oct 2026 07:00:00 +0000

Show Notes - 2026-10-07

Stories Covered

Today:
What to do: [NIST & Standards]
What to do: [Contracting Impact]
DIB angle: [Practitioner Pulse]

Read the full brief

2026-10-06: A practitioner webinar confirmed that 89% of polled DIB organizations are pressing ahead with CMMC

Tue, 06 Oct 2026 07:00:00 +0000

Show Notes - 2026-10-06

Stories Covered

Today:
No new signed policy or rulemaking actions today. [Policy & Rulemaking]
Action: [Policy & Rulemaking]
No new cyber-related False Claims Act (FCA) cases this cycle. [Enforcement & False Claims]
Standing reminder: [Enforcement & False Claims]
Action: [Enforcement & False Claims]
MSP completes voluntary Level 2 C3PAO certification. [Cyber AB & Ecosystem]
Action: [Cyber AB & Ecosystem]
FIPS validation confusion surfaces in two live assessment scenarios. [NIST & Standards]
Action: [NIST & Standards]
Primes are still flowing down compliance expectations. [Contracting Impact]
Action: [Contracting Impact]
"Should I keep going?" is settled; "How do I handle FIPS?" is not. [Practitioner Pulse]
Action: [Practitioner Pulse]

Read the full brief

2026-10-05: PreVeil announced a free virtual CMMC summit (Oct 28) featuring the SP 800-171 author

Mon, 05 Oct 2026 07:00:00 +0000

Show Notes - 2026-10-05

Stories Covered

Today:
PreVeil CMMC Security Summit scheduled for Oct 28 (virtual, free) [Practitioner Pulse]
On Oct 2, a Reddit user reported a two-year, high-cost NIST 800-171 effort derailed by MSP failure [Practitioner Pulse]
On Oct 3, a Level 3 question appeared despite no active certification pathway [Practitioner Pulse]

Read the full brief

2026-10-02: No new CMMC-specific rulemaking or enforcement actions landed today

Fri, 02 Oct 2026 07:00:00 +0000

Show Notes - 2026-10-02

Stories Covered

Today:
DoD Proposed Rule Would Expand FOCI Reporting for Cleared Contractors. [Policy & Rulemaking]
Watch item: [Enforcement & False Claims]
DISA Sole-Sources Combatant Command Migration to Leidos Under $11.5B Enclave Contract. [Contracting Impact]
DIA Fast-Tracks Schneider Electric Data Center Maintenance. [Contracting Impact]
Pentagon Cyber Mastery Incentive Pay (C-MIP) Launches With Pay Cuts. [Practitioner Pulse]
AI Social Engineering Is Erasing the Traditional Red Flags. [Practitioner Pulse]

Read the full brief

2026-10-01: No new CMMC policy actions or cyber-related False Claims Act cases dropped today

Thu, 01 Oct 2026 07:00:00 +0000

Show Notes - 2026-10-01

Stories Covered

Today:
Action: [Policy & Rulemaking]
Action: [Enforcement & False Claims]
Action: [NIST & Standards]
Action: [Contracting Impact]
Finding CMMC-certified subcontractors: [Practitioner Pulse]
GCC High and ERP confusion: [Practitioner Pulse]
Pentagon data breach timing: [Practitioner Pulse]
Town hall recap: [Practitioner Pulse]

Read the full brief

2026-09-30: NIST post-quantum cryptography standards continue driving federal migration timelines that will

Wed, 30 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-30

Stories Covered

Today:
CIRCIA final rule expected this fall, with harmonization focus. [Policy & Rulemaking]
Post-quantum cryptography migration is now an execution issue, not a planning issue. [Policy & Rulemaking]
Standing reminder: [Enforcement & False Claims]
Counter-drone IDIQ awards signal active DIB procurement. [Contracting Impact]
FOCI documentation guide for cleared contractors. [Contracting Impact]
Bottom line for today: [Practitioner Pulse]

Read the full brief

2026-09-29: A Defense Manpower Data Center breach exposed 3 million records

Tue, 29 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-29

Stories Covered

Today:
CCP and CCA certifications during the suspension. [Practitioner Pulse]
GRC platform selection. [Practitioner Pulse]
Session lock implementation (3.1.11). [Practitioner Pulse]
DMDC data breach: 3 million records exposed. [NIST & Standards]
OpenAI agents probed government sites unexpectedly. [NIST & Standards]

Read the full brief

2026-09-26: Former DoD CMMC executives published a pointed defense of the program during the Phase 2

Sat, 26 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-26

Stories Covered

Today:
Former CMMC Leaders Publish Defense of Program During Suspension [Policy & Rulemaking]
IG Report: 86% of Agencies Missed CISA Cloud Security Deadlines; CISA Cannot Enforce Its Own Directives [NIST & Standards]
Former Soldier Sentenced to 70 Months for Telecom Hacking and Extortion [Enforcement & False Claims]
Contractors Openly Abandoning Compliance During Suspension [Practitioner Pulse]

Read the full brief

2026-09-25: A federal court dismissed an FCA cybersecurity complaint against Archer Daniels Midland on

Fri, 25 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-25

Stories Covered

Today:
DoD moves to replace Cost Accounting Standards with GAAP. [Policy & Rulemaking]
Revolutionary FAR Overhaul: comment period open. [Policy & Rulemaking]
SBA extends comment period on size standard overhaul to November 20. [Policy & Rulemaking]
First court dismissal of an FCA cybersecurity complaint on materiality grounds. [Enforcement & False Claims]
What this means during the CMMC suspension: [Enforcement & False Claims]
BEC recovery: $375,000 seized. [Enforcement & False Claims]
GSA SAM.gov glitch: validate your small business representations now. [Contracting Impact]
Navy MUSV marketplace expanding. [Contracting Impact]
GAO protest dismissed as sanction for fabricated facts. [Contracting Impact]
Boundary scoping for FedRAMP Moderate cloud tools. [Practitioner Pulse]

Read the full brief

2026-09-24: No policy developments, enforcement actions, or ecosystem announcements

Thu, 24 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-24

Stories Covered

Today:
CAD vendor certification requirements for CUI handling. [Practitioner Pulse]
Katie Arrington calls CMMC pause "negligent" in podcast appearance. [Practitioner Pulse]
F-35 parts reportedly diverted to China via Hong Kong. [Practitioner Pulse]

Read the full brief

2026-09-23: Federal News Network published analysis on the False Claims Act trap in CMMC self-attestation

Wed, 23 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-23

Stories Covered

Today:
Proposed NDAA "Right to Repair" Provisions Would Default Contractor Technical Data to Government Purpose Rights [Policy & Rulemaking]
SBA Extends Comment Period on Small Business Size Standards to November 20 [Policy & Rulemaking]
Federal News Network: The Hidden FCA Trap in CMMC Self-Attestation [Enforcement & False Claims]
RYUK Ransomware Operator Sentenced to Federal Prison [Enforcement & False Claims]
Data Rights Legislation Bears Watching for Subcontractors [Contracting Impact]
Thin Collection Day, but the Signal Is Clear [Practitioner Pulse]

Read the full brief

2026-09-22: The DoW CMMC Reform Task Force submitted its report to the CIO on September 11 (not yet public)

Tue, 22 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-22

Stories Covered

Today:
CMMC Reform Task Force submitted its report; recommendations not yet public. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
DoW issued a broad acquisition reform memo targeting CAS coverage, pricing, and administrative burden. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
Derived CUI workflow question: Do small parts extracted from Statement D blueprints require CUI handling? [Practitioner Pulse]
What to do: [Practitioner Pulse]

Read the full brief

2026-09-21: Open-CMMC v2.0 tackles CUI-to-OT workflows over SMB

Mon, 21 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-21

Stories Covered

Today:
Open-CMMC v2.0 extends CUI workflow protection to OT systems [Practitioner Pulse]
Contractor reports passing third-party Level 2 CMMC assessment [Practitioner Pulse]
FCI scoping question: do assessors check FCI environments during Level 2 assessments? [Practitioner Pulse]
CCP exam passed, practitioner seeks CCA prep recommendations [Practitioner Pulse]

Read the full brief

2026-09-19: DOJ announced a major False Claims Act enforcement policy revision that limits sub-regulatory

Sat, 19 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-19

Stories Covered

Today:
DOJ revises Justice Manual to limit False Claims Act enforcement to binding legal obligations. [Enforcement & False Claims]
Illegal alien arrested for fraudulent U.S. citizenship claims to secure aerospace contractor employment. [Enforcement & False Claims]
OFCCP eliminates Section 503 disability compliance requirements effective September 21. [Contracting Impact]
CISA and Five Eyes partners release CI Fortify guidance on network isolation for critical infrastructure. [NIST & Standards]
AAFES investigating suspicious messages sent via email and official mobile app. [Practitioner Pulse]

Read the full brief

2026-09-18: The Ninth Circuit ruled that federal agencies cannot unilaterally define what is "material" under

Fri, 18 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-18

Stories Covered

Today:
ISOO Releases CUI Notices 2026-07 and 2026-08: Agencies Must Give Contractors Explicit CUI Handling Guidance [Policy & Rulemaking]
Action: [Policy & Rulemaking]
Army Directive 2026-19: Commercial Software First [Policy & Rulemaking]
Action: [Policy & Rulemaking]
SBA Prioritizing Defense-Critical 8(a) Applicants [Policy & Rulemaking]
Action: [Policy & Rulemaking]
Ninth Circuit: Agencies Cannot Define FCA "Materiality" by Fiat (County of King v. Turner) [Enforcement & False Claims]
Action: [Enforcement & False Claims]
New FCA Cybersecurity Settlement Reported [Enforcement & False Claims]
Action: [Enforcement & False Claims]
CUI Scoping Gets Clearer (Ties to ISOO 2026-07) [NIST & Standards]
Action: [NIST & Standards]
CCP Exam Pass Report [Practitioner Pulse]
3.8.2 Media Access: USB Tracking Question [Practitioner Pulse]
Funding Level 2 Compliance: The Cost Question [Practitioner Pulse]

Read the full brief

2026-09-17: A new FCA cybersecurity settlement reinforces that DOJ is actively enforcing self-attestation

Thu, 17 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-17

Stories Covered

Today:
CIRCIA Final Rule Expected This Month; DIB Contractors Face Overlapping Reporting Obligations [Policy & Rulemaking]
New FCA Cybersecurity Settlement Signals DOJ Keeps Foot on the Gas [Enforcement & False Claims]
Former Army Soldier Pleads Guilty to Transmitting National Defense Information [Enforcement & False Claims]
Air Force Stands Up 'Megatron' IDIQ for Battle Network Acquisitions [Contracting Impact]
U.S.-India RDPA Negotiations Advancing; OCI Risks in GovCon M&A [Contracting Impact]
CCA Exam Candidates Frustrated with Training Quality [Practitioner Pulse]

Read the full brief

2026-09-16: DoD's new class deviation confirms baseline DFARS 7012 and NIST 800-171 Rev 2 compliance remain

Wed, 16 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-16

Stories Covered

Today:
What remains mandatory: [Policy & Rulemaking]
What is suspended: [Policy & Rulemaking]
Action: [Policy & Rulemaking]
Watch: [Policy & Rulemaking]
C3PAO demand during the pause: [Practitioner Pulse]
Post-assessment Rev 3 migration: [Practitioner Pulse]
FIPS mode implementation pain: [Practitioner Pulse]
Physical security (employee badges): [Practitioner Pulse]
Bottom line: [Practitioner Pulse]

Read the full brief

2026-09-15: Cyber AB CEO Matthew Travis outlined reform proposals including continuous monitoring and smaller

Tue, 15 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-15

Stories Covered

Today:
Cyber AB submits reform recommendations to DoW Reform Task Force [Policy & Rulemaking]
DoW Class Deviation Revision 3 retains Phase 2 suspension, adds new clauses [Policy & Rulemaking]
Pentagon issues AI-assisted software development procedures [Policy & Rulemaking]
Standing reminder: [Enforcement & False Claims]
Travis confirms assessor supply bottleneck is a cost driver. [Cyber AB & Ecosystem]
Army Directive 2026-19: commercial-first software acquisition [Contracting Impact]
PreVeil survey: the affordability gap is widening [Practitioner Pulse]
PIEE access delays blocking self-assessments. [Practitioner Pulse]
Cloud enclave vendor comparison. [Practitioner Pulse]

Read the full brief

2026-09-12: Honeywell settled a $2M False Claims Act case for failing to implement NIST 800-171 controls on a

Sat, 12 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-12

Stories Covered

Today:
60-Day Suspension Review Period Ends, No Public Guidance Yet [Policy & Rulemaking]
White House Quantum Executive Orders Set PQC Migration Deadlines [Policy & Rulemaking]
Honeywell Pays $2M to Settle NIST 800-171 Noncompliance Allegations [Enforcement & False Claims]
Action: [Enforcement & False Claims]
DoD Multi-Model AI Migration Signals Vendor Diversification Expectations [Contracting Impact]
Browser FIPS Validation for CUI Access: No Easy Answer [Practitioner Pulse]
60-Day Pause Thread: Practitioners Watching, Not Expecting [Practitioner Pulse]

Read the full brief

2026-09-05: No CMMC-specific policy, enforcement, or rulemaking developments today

Sat, 05 Sep 2026 07:00:00 +0000

Show Notes - 2026-09-05

Stories Covered

Today:
Executive Order 14421: Bulk-Power System Supply Chain Security (Signed, Aug. 26, 2026) [Policy & Rulemaking]
Standing reminder: [Enforcement & False Claims]
National Security Tech Strategy Highlights Embedded-Systems Patching Gap [NIST & Standards]
DISA DoDNet Migration: 231,000 Users, 11 Combatant Commands by FY2028 [Contracting Impact]
Context: [Cyber AB & Ecosystem]
Standing guidance for a quiet day: [Practitioner Pulse]

Read the full brief

2026-08-26: No policy, rulemaking, or enforcement developments

Wed, 26 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-26

Stories Covered

Today:
Compliance cost benchmarks now public. [Practitioner Pulse]
What to do: [Practitioner Pulse]
CMMC jargon guide published. [Practitioner Pulse]
Context note: [Practitioner Pulse]
Federal cyber context (not DIB-specific): [No developments today in:]
About this brief: [No developments today in:]
Reminder: [No developments today in:]

Read the full brief

2026-08-25: The Navy stood up a new Office of the Defense Industrial Base to revitalize maritime supply chains

Tue, 25 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-25

Stories Covered

Today:
Navy creates Office of the Defense Industrial Base to accelerate dual-use tech and supply chain resilience. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
GSA updates FICAM architecture and Treasury launches Quantum-Readiness Task Force ahead of 2030/2031 post-quantum crypto deadlines. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
Tetra Tech pays $57M to settle FCA allegations for falsifying soil radiation tests at Hunters Point Naval Shipyard. [Enforcement & False Claims]
Air Force member indicted for lying on background investigation forms to get NASA/IRS/NOAA contract work while on active duty. [Enforcement & False Claims]
What to do: [Enforcement & False Claims]
DoD's Drone OTA Consortium opens Joint UGV demo for October. [Cyber AB & Ecosystem]
What to do: [Cyber AB & Ecosystem]
SBA tightens 7(a) lending rules effective October 1, making acquisitions harder to finance. [Contracting Impact]
What to do: [Contracting Impact]
M&A buyers need to understand which GovCon assets survive closing and which do not. [Contracting Impact]
What to do: [Contracting Impact]
No new NIST SP 800-171 or 800-172 guidance this cycle. [NIST & Standards]
Secure communications remain a human problem, and approved tools still lose to convenience. [Practitioner Pulse]
What to do: [Practitioner Pulse]

Read the full brief

2026-08-22: The FAR CUI proposed rule mandating NIST SP 800-171 rev 3 across all federal contracts is expected

Sat, 22 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-22

Stories Covered

Today:
FAR CUI Rule: Government-Wide NIST 800-171 Rev 3 Mandate Coming Before Year-End [Policy & Rulemaking]
Action required: [Policy & Rulemaking]
Virginia Company Pays $2.5M to Settle PPP Fraud Allegations [Enforcement & False Claims]
FCA risk note: [Enforcement & False Claims]
FAR CUI Flow-Down to All Federal Contracts [Contracting Impact]
Army Project Griffin: AI Cyber Defense Without Token Bloat or New Vulnerabilities [Practitioner Pulse]
DIB takeaway: [Practitioner Pulse]
CISA Logging Guidance: Voluntary, But Expect Prime Flow-Down [Practitioner Pulse]
Navy SECNAV Warning: Multi-Domain Campaign Targeting Personnel and Installations [Practitioner Pulse]
Contractor impact: [Practitioner Pulse]

Read the full brief

2026-08-15: The r/CMMC community is working through FIPS 140-3 validation requirements and GCC-High migration

Sat, 15 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-15

Stories Covered

Today:
FIPS 140-3 Validation: What DIB Contractors Need to Know [NIST & Standards]
Action: [NIST & Standards]
Commercial-to-GCC-High Migration: Practitioner War Stories [Practitioner Pulse]
Action: [Practitioner Pulse]
White House Authorizes Private-Sector Offensive Cyber Operations [Contracting Impact]
Action: [Contracting Impact]

Read the full brief

2026-08-09: DoW CIO Kirsten Davies signaled at Black Hat that the Phase 2 hold may be termed a "pause" rather

Sun, 09 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-09

Stories Covered

Today:
Action item: [Policy & Rulemaking]
VOIP voicemail and FedRAMP scope creep. [Practitioner Pulse]
GCC High migration economics. [Practitioner Pulse]

Read the full brief

2026-08-08: A Federal News Network interview with early CMMC Level 2 adopter IntelliGenesis highlights the real

Sat, 08 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-08

Stories Covered

Today:

Read the full brief

2026-08-07: No new CMMC rulemaking or enforcement actions dropped today

Fri, 07 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-07

Stories Covered

Today:
What to do: [Policy & Rulemaking]
What to do: [Contracting Impact]
What to do: [Contracting Impact]
What to do: [Contracting Impact]
What to do: [Practitioner Pulse]

Read the full brief

2026-08-06: No new CMMC policy actions, enforcement cases, or standards updates surfaced in today's collection

Thu, 06 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-06

Stories Covered

Today:
Bottom line: [Practitioner Pulse]

Read the full brief

2026-08-04: Practitioners report confusion about Level 2 self-assessment vs C3PAO timelines during the

Tue, 04 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-04

Stories Covered

Today:
Default termination burden [Contracting Impact]
Space Force acquisition shift [Contracting Impact]

Read the full brief

2026-08-01: DoD raised the TINA certified cost/pricing data threshold to $10M effective July 1

Sat, 01 Aug 2026 07:00:00 +0000

Show Notes - 2026-08-01

Stories Covered

Today:
DoD IT Category Management Directive (DoW Instruction 8000.02) Takes Effect [Policy & Rulemaking]
Chinese Military Company Covered Lobbyist Prohibition: DoD Publishes Guidance [Policy & Rulemaking]
$10 Million TINA Threshold Now in Force (As of July 1, 2026) [Contracting Impact]
Remote Worker Fraud: Foreign Actors and FCA Exposure for Contractors [Enforcement & False Claims]

Read the full brief

2026-07-31: A new Executive Order requires defense prime contractors and subcontractors at every tier to map

Fri, 31 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-31

Stories Covered

Today:
Executive Order: Securing America's Defense Supply Chains (Signed July 20, 2026) [Policy & Rulemaking]
Post-Quantum Cryptography Migration Timelines Accelerate [Policy & Rulemaking]
Defense Supply Chain Mapping Will Create New Flow-Down Requirements [Contracting Impact]
House Passes $1.15T Defense Policy Bill (216-212) [Contracting Impact]
Micro-SMB Tooling for CMMC Compliance (r/CMMC) [Practitioner Pulse]
Two-Person LLC Struggling with Compliance Burden (r/CMMC) [Practitioner Pulse]
"CMMC at Sea" Training Cruise Draws Skepticism (r/CMMC) [Practitioner Pulse]
Tier 3 Background Investigation Delays (r/CMMC) [Practitioner Pulse]
CUI-Safe Meeting Notetakers (r/CMMC) [Practitioner Pulse]

Read the full brief

2026-07-30: A practitioner shared a detailed CMMC-CCP exam pass/fail breakdown on Reddit that surfaces real

Thu, 30 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-30

Stories Covered

Today:
CMMC-CCP Exam: First-Hand Pass/Fail Breakdown Reveals Study Gaps [Practitioner Pulse]
Summit 7 Dissects "Brilliant at the Basics" for DIB Contractors [Practitioner Pulse]
Navy LETHALITY Consortium Seeks Network Consolidation Prototypes [Contracting Impact]
What's not here today: [Contracting Impact]

Read the full brief

2026-07-29: Federal agencies are debating whether commercial technology acquisition policies can coexist with

Wed, 29 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-29

Stories Covered

Today:
CUI requirements creating commercial technology access tension across federal agencies. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
CyberAB warns fraudulent Level 2 certifications are circulating, provides verification path. [Cyber AB & Ecosystem]
What to do: [Cyber AB & Ecosystem]
FIPS compliance confusion continues for CUI enclaves. [Practitioner Pulse]
Outbound firewall scoping questions for cloud-only GCC-High environments. [Practitioner Pulse]
CNC machine access control raises OT network CUI boundary questions. [Practitioner Pulse]
What these signal: [Practitioner Pulse]

Read the full brief

2026-07-28: The CMMC suspension continues to drive confusion among practitioners preparing for presentations

Tue, 28 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-28

Stories Covered

Today:
Quantum Computing Executive Orders Set 2031 PQC Migration Deadline [Policy & Rulemaking]
Claim Sponsorship in Federal Subcontracts: What DIB Subs Need in Their Agreements [Contracting Impact]
International Contractors: CMMC Certification Is Available but Complicated [Practitioner Pulse]
Reddit: Consolidating Suspension Confusion for a Presentation [Practitioner Pulse]
Reddit: ChatGPT Enterprise FedRAMP Capability Questions [Practitioner Pulse]
Reddit: Town Hall Anticipation [Practitioner Pulse]

Read the full brief

2026-07-25: Summit 7 published MSP vs MSSP guidance for CMMC contractors

Sat, 25 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-25

Stories Covered

Today:
MSP vs MSSP: different roles, both needed for CMMC [Practitioner Pulse]
Action: [Practitioner Pulse]
No CMMC-specific policy developments today. [Policy & Rulemaking]
CISA accelerates vulnerability patching after AI exploit incidents [NIST & Standards]
Action: [NIST & Standards]
FedRAMP 20X transition deadline: June 2027 [NIST & Standards]
Action: [NIST & Standards]
DIU appoints first active-duty military deputy to speed fielding [Contracting Impact]
Action: [Contracting Impact]
SOF launches same-day acquisition challenge [Contracting Impact]
Action: [Contracting Impact]
No new DIB-specific FCA settlements today. [Enforcement & False Claims]
No Cyber AB or C3PAO developments today. [Cyber AB & Ecosystem]

Read the full brief

2026-07-24: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review

Fri, 24 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-24

Stories Covered

Today:
DoD suspended CMMC Phase 2 C3PAO requirements (signed policy). [Policy & Rulemaking]
SBA commended the suspension after small-business pressure (signed policy). [Policy & Rulemaking]
Trump EO mandates AI-assisted supply-chain mapping for all national-security acquisitions (signed policy). [Policy & Rulemaking]
DoD class deviation implements Chinese-military-company covered-lobbyist prohibition (signed policy, limited detail). [Policy & Rulemaking]
Federal News Network commentary argues for software-sovereignty requirements in defense procurement (opinion). [Policy & Rulemaking]
No cyber-related False Claims Act settlements today. [Enforcement & False Claims]
No Cyber AB or C3PAO announcements today. [Cyber AB & Ecosystem]
No NIST 800-171/172 revisions today. [NIST & Standards]
Contracting officers began inserting CMMC requirements in Q4 2025, then suspended C3PAO designations in July 2026 (signed policy). [Contracting Impact]
Scoping, documentation, and MSPs are the assessment killers (practitioner analysis). [Practitioner Pulse]

Read the full brief

2026-07-23: The Phase II suspension memo continues to ripple through the procurement landscape

Thu, 23 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-23

Stories Covered

Today:
CMMC Phase II Suspended, Reform Task Force Launched (Signed Memo, Memo 26-P-1023, July 13, 2026) [Policy & Rulemaking]
Fixed-Price Contracting Mandate, CAS Rescission, PCB Supply Chain ANPRM [Policy & Rulemaking]
Solicitations Must Drop C3PAO Requirements; Contractors Should Protest If They Don't [Contracting Impact]
GAO: Past Performance Cutoffs Must Follow Solicitation Language (B-424182.2, June 22, 2026) [Contracting Impact]

Read the full brief

2026-07-22: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about

Wed, 22 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-22

Stories Covered

Today:
CMMC Phase 2 suspended, but 800-171 obligations unchanged (task force review, not a repeal). [Policy & Rulemaking]
Action: [Policy & Rulemaking]
RFI comments due August 14. [Policy & Rulemaking]
Action: [Policy & Rulemaking]
Standing guidance: [Enforcement & False Claims]
PSC members continuing C3PAO assessments despite suspension. [Cyber AB & Ecosystem]
Risk to watch: [Cyber AB & Ecosystem]
Primes can still flow down certification requirements contractually. [Contracting Impact]
GSA's revised AI acquisition clause (watch item for DIB). [Contracting Impact]
Action: [Contracting Impact]
The key practitioner question right now: [Practitioner Pulse]

Read the full brief

2026-07-21: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance

Tue, 21 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-21

Stories Covered

Today:
Summit 7 publishes CUI enclave implementation guide for contractors with small CUI footprints. [Practitioner Pulse]
FAR Council proposes 90-day deadline for termination settlement proposals, compressing timeline and raising FCA exposure risk. [Contracting Impact]
No CMMC policy, rulemaking, enforcement, Cyber AB, NIST, or standards developments appeared in today's collection. [Contracting Impact]

Read the full brief

2026-07-18: The CMMC Reform Task Force held its first meeting Thursday and will report by late September

Sat, 18 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-18

Stories Covered

Today:
CMMC Reform Task Force launches with first meeting, 60-day review timeline begins. [Policy & Rulemaking]
DoD planning listening sessions nationwide to gather contractor input. [Policy & Rulemaking]
Under Secretary Duffey issued memo directing removal of C3PAO requirements from active solicitations. [Policy & Rulemaking]
Class deviations or interim rules could accelerate changes post-review. [Policy & Rulemaking]
PreVeil analysis: False Claims Act cybersecurity settlements hit $51.8M in FY2025, up 233% year-over-year. [Enforcement & False Claims]
LOGZONE Inc. settled for $507,144 (June 2026) after Navy contracts ran on systems scoring -170 in SPRS. [Enforcement & False Claims]
Georgia Tech Research Corporation settled for $875,000 (September 2025) after submitting a campus-wide SPRS score for a lab with no antivirus and no SSP. [Enforcement & False Claims]
Aero Turbine / Gallant Capital Partners: $1.75M settlement (July 2025) shows M&A compliance liability flows to acquirers. [Enforcement & False Claims]
Raytheon / Nightwing: $8.4M settlement (May 2025) for running ~30 DoD contracts on networks non-compliant with DFARS 252.204-7008, 252.204-7012, and FAR 52.204-21. [Enforcement & False Claims]
Health Net Federal Services / Centene: $11.25M settlement (February 2025) for falsely certifying compliance with security controls in TRICARE contract. [Enforcement & False Claims]
Live CMMC solicitations show Level 2 (Self) requirements remain in force; C3PAO references under review. [Contracting Impact]
Contracting officers authorized to include CMMC since November 10, 2025. [Contracting Impact]
PreVeil's False Claims Act guide is the most practitioner-focused breakdown published this year. [Practitioner Pulse]
Matt Travis (Cyber AB CEO) quoted in PreVeil's solicitation tracker: "If you haven't started getting engaged in CMMC, now is the time. It was probably the time in early 2024, but now the light is flashing red." [Practitioner Pulse]
DoD CIO Davies described current CMMC assessments as "burdensome, red-tape ridden, check-the-box, point-in-time view" during press tour. [Practitioner Pulse]

Read the full brief

2026-07-17: No CMMC, DFARS cybersecurity, or defense industrial base compliance developments reported in

Fri, 17 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-17

Stories Covered

Today:
What still applies during the suspension: [Note on Today's Collection]
Action items: [Note on Today's Collection]

Read the full brief

2026-07-16: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2

Thu, 16 Jul 2026 07:00:00 +0000

Show Notes - 2026-07-16

Stories Covered

Today:
DoD opens RFI on the post-suspension CMMC model; suspension itself is signed and in force. [Policy & Rulemaking]
SBA takes a public victory lap on the suspension. [Policy & Rulemaking]
C3PAO pipeline in limbo, but Level 2 work should not stop. [Cyber AB & Ecosystem]
Assessor/tooling economics still bite regardless of the pause. [Cyber AB & Ecosystem]
FOCI disclosure rule comment period closed; Congress wants to go further. [Contracting Impact]
SMBs split on wait-and-see versus continuing to build evidence. [Practitioner Pulse]
CUI markings are inconsistent, and that does not change your obligation. [Practitioner Pulse]
Microsoft won't commit to end-to-end encryption guarantees in GCC for EAR-controlled data. [Practitioner Pulse]
"Claude for Government" raises FedRAMP-authorization questions practitioners can't answer yet. [Practitioner Pulse]

Read the full brief