CMMC Brief

CMMC Brief

By Carolina Clear Tech, LLCGovernment
Download on the App Store

CMMC Brief episodes

  • 2026-07-23: The Phase II suspension memo continues to ripple through the procurement landscape
    Show Notes - 2026-07-23
    Stories Covered
    • Today:
    • CMMC Phase II Suspended, Reform Task Force Launched (Signed Memo, Memo 26-P-1023, July 13, 2026) [Policy & Rulemaking]
    • Fixed-Price Contracting Mandate, CAS Rescission, PCB Supply Chain ANPRM [Policy & Rulemaking]
    • Solicitations Must Drop C3PAO Requirements; Contractors Should Protest If They Don't [Contracting Impact]
    • GAO: Past Performance Cutoffs Must Follow Solicitation Language (B-424182.2, June 22, 2026) [Contracting Impact]

      • Read the full brief

      8 min
    • 2026-07-22: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about
      Show Notes - 2026-07-22
      Stories Covered
      • Today:
      • CMMC Phase 2 suspended, but 800-171 obligations unchanged (task force review, not a repeal). [Policy & Rulemaking]
      • Action: [Policy & Rulemaking]
      • RFI comments due August 14. [Policy & Rulemaking]
      • Action: [Policy & Rulemaking]
      • Standing guidance: [Enforcement & False Claims]
      • PSC members continuing C3PAO assessments despite suspension. [Cyber AB & Ecosystem]
      • Risk to watch: [Cyber AB & Ecosystem]
      • Primes can still flow down certification requirements contractually. [Contracting Impact]
      • GSA's revised AI acquisition clause (watch item for DIB). [Contracting Impact]
      • Action: [Contracting Impact]
      • The key practitioner question right now: [Practitioner Pulse]

        • Read the full brief

        7 min
      • 2026-07-21: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance
        Show Notes - 2026-07-21
        Stories Covered
        • Today:
        • Summit 7 publishes CUI enclave implementation guide for contractors with small CUI footprints. [Practitioner Pulse]
        • FAR Council proposes 90-day deadline for termination settlement proposals, compressing timeline and raising FCA exposure risk. [Contracting Impact]
        • No CMMC policy, rulemaking, enforcement, Cyber AB, NIST, or standards developments appeared in today's collection. [Contracting Impact]

          • Read the full brief

          5 min
        • 2026-07-18: The CMMC Reform Task Force held its first meeting Thursday and will report by late September
          Show Notes - 2026-07-18
          Stories Covered
          • Today:
          • CMMC Reform Task Force launches with first meeting, 60-day review timeline begins. [Policy & Rulemaking]
          • DoD planning listening sessions nationwide to gather contractor input. [Policy & Rulemaking]
          • Under Secretary Duffey issued memo directing removal of C3PAO requirements from active solicitations. [Policy & Rulemaking]
          • Class deviations or interim rules could accelerate changes post-review. [Policy & Rulemaking]
          • PreVeil analysis: False Claims Act cybersecurity settlements hit $51.8M in FY2025, up 233% year-over-year. [Enforcement & False Claims]
          • LOGZONE Inc. settled for $507,144 (June 2026) after Navy contracts ran on systems scoring -170 in SPRS. [Enforcement & False Claims]
          • Georgia Tech Research Corporation settled for $875,000 (September 2025) after submitting a campus-wide SPRS score for a lab with no antivirus and no SSP. [Enforcement & False Claims]
          • Aero Turbine / Gallant Capital Partners: $1.75M settlement (July 2025) shows M&A compliance liability flows to acquirers. [Enforcement & False Claims]
          • Raytheon / Nightwing: $8.4M settlement (May 2025) for running ~30 DoD contracts on networks non-compliant with DFARS 252.204-7008, 252.204-7012, and FAR 52.204-21. [Enforcement & False Claims]
          • Health Net Federal Services / Centene: $11.25M settlement (February 2025) for falsely certifying compliance with security controls in TRICARE contract. [Enforcement & False Claims]
          • Live CMMC solicitations show Level 2 (Self) requirements remain in force; C3PAO references under review. [Contracting Impact]
          • Contracting officers authorized to include CMMC since November 10, 2025. [Contracting Impact]
          • PreVeil's False Claims Act guide is the most practitioner-focused breakdown published this year. [Practitioner Pulse]
          • Matt Travis (Cyber AB CEO) quoted in PreVeil's solicitation tracker: "If you haven't started getting engaged in CMMC, now is the time. It was probably the time in early 2024, but now the light is flashing red." [Practitioner Pulse]
          • DoD CIO Davies described current CMMC assessments as "burdensome, red-tape ridden, check-the-box, point-in-time view" during press tour. [Practitioner Pulse]

            • Read the full brief

            12 min
          • 2026-07-16: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2
            Show Notes - 2026-07-16
            Stories Covered
            • Today:
            • DoD opens RFI on the post-suspension CMMC model; suspension itself is signed and in force. [Policy & Rulemaking]
            • SBA takes a public victory lap on the suspension. [Policy & Rulemaking]
            • C3PAO pipeline in limbo, but Level 2 work should not stop. [Cyber AB & Ecosystem]
            • Assessor/tooling economics still bite regardless of the pause. [Cyber AB & Ecosystem]
            • FOCI disclosure rule comment period closed; Congress wants to go further. [Contracting Impact]
            • SMBs split on wait-and-see versus continuing to build evidence. [Practitioner Pulse]
            • CUI markings are inconsistent, and that does not change your obligation. [Practitioner Pulse]
            • Microsoft won't commit to end-to-end encryption guarantees in GCC for EAR-controlled data. [Practitioner Pulse]
            • "Claude for Government" raises FedRAMP-authorization questions practitioners can't answer yet. [Practitioner Pulse]

              • Read the full brief

              9 min

            About CMMC Brief

            From the publisher's feed

            Daily CMMC and defense industrial base compliance briefing. DoD policy and rulemaking, False Claims Act cyber enforcement, Cyber AB and C3PAO developments, NIST 800-171 updates, and contracting impact…