CUI Hotline: Live CMMC Q&A

NDIA data shows that 30% - 40% of defense contractors have no FTEs working on IT/security.Despite the ongoing CMMC Program Review, there simply isn't a way that the government can rewrite cyber requirements such that a company with zero staff would suddenly understand what needs to get done.ITAR? NIST? DFARS? PQC? MFA? CMMC?People need more help than the government is willing or capable of providing.That's why we go live every Friday at 10am PST.All questions welcome.

Over the course 100 livestreams we have answered thousands of questions about everything from CMMC to DFARS to ITAR to NIST.Scoping, configuration, policy predictions, you name it.During that time it's been hard not to notice the bigger picture:- On the one hand the DoD is taking their sweet time to let contractors know what the plan is for cyber requirements moving forward. - On the other, the DoD is also the first one who will decide to cut off your work when you don't meet requirements.- Meanwhile, the number of official DoD resources to help people understand, implement, and verify all of the cyber requirements other than CMMC remains at zero."Hurry up and wait" for CMMC updates doesn't help anyone meet their existing requirements and that's pretty unfair.That's why our weekly livestream is free every Friday.

The recent rumor of a change in CMMC policy to include an extension to 2028 is another reason why you should like, subscribe, and tune in every Friday for the CUI Hotline.There hasn't been any extension. Unfortunately, people are unaware of what the CMMC regulation has said since September 2025.Discovering that information for the first time while looking for updates regarding the Phase 2 suspension causes a lot of confidently incorrect takes everywhere from social media to marketing campaigns to actual reporting in industry publications.Bad information makes it hard to plan and strategize.That's why we host a livestream every Friday at 1pm EST.NIST, DFARS, CMMC, ITAR, FedRAMP, policy, technical, you name it.Don't let bad information put you on the wrong path.

Between now and the end of the year defense contractors will need to wrestle with at least 3 major cyber regulation updates:CIRCIA: a new cyber incident reporting regime for many defense contractors that is broader than DFARS 252.204-7012, with different triggers, report contents, system scope, ransomware requirements, supplemental reporting, and two-year data preservation.The FAR CUI rule: government-wide contractual requirements for CUI protection including NIST SP 800-171 rev. 3, SP 800-172, cloud, subcontractor flowdowns and more.Post-Review CMMC: the "3.0" rule expected in July contained a transition plan from 171r2 to 171r3 and claimed to affect 20% fewer companies. The DoD has suspended that transition in lieu of a program review and signaled a general desire to increase requirements.If you extend the timeline further, defense contractors will also need to wrestle with DFARS 7012 (3.0) and Post-Quantum Crypto rulemaking.Have questions about any of that? We sit down every Friday at 10am PST to answer them all.

Not so long ago people started asking what we would talk about after CMMC rulemaking was done.Looking ahead, there are more and larger questions than there ever were before:- How will the DoD handle a discrepancy between the FAR and DFARS requiring different NIST SP 800-171 baselines for the same data on the same contractor systems?The department specifically avoided this problem in 2024 only to reintroduce it as a very real puzzle for contractors with the Phase 2 suspension.- How will the DoD explain scoping for their future requirements? The department has spent the last month and a half saying that CUI-centric requirements "don't go far enough" and that OT security is desperately needed.But most important of all: how should contractors navigate this mess to protect themselves and get back to business?That's why we sit down every Friday to answer your questions live.10 am PST / 1 pm EST.

Safe to say the CMMC Review RFI responses have converged on one major topic:CUI marking and identification.The problem: Neither the DoD CIO nor the CMMC program controls CUI governance inside the Department.In fact, many of the issues raised in the RFI responses are outside the scope of the CMMC program and its ability to fix them.Whatever comes out of the program review, it's unlikely that the biggest issues will be resolved.Which means people are going to have a lot of questions about what to do next.That's why we host the CMMC Hotline every Friday.Live Q&A. 10am PT / 1pm ET.

July 2026 marks the 9th month in a row where most CMMC assessment capacity went completely unused. Conservatively, the CMMC ecosystem was able to support at least 432 Level 2 assessments in July. 207 companies achieved CMMC Level 2 status.The DoD says they suspended CMMC Phase 2 because there isn't enough assessment capacity.Meanwhile, Congress has language in the upcoming NDAA urging DoD to increase the number of assessors.Assessment capacity isn't the problem. Never has been. Implementation and compliance with DFARS 252.204-7012 is the problem.That's why we do a live Q&A every Friday.NIST, DFARS, ITAR, FedRAMP. Those are the hurdles you need to deal with long before your assessment. The number of assessors is the least of people's problems.The upcoming re-launch of assessments is what people should be preparing for.

Thanks to technical difficulties we had to re-post the stream link. Sorry about that!

Can't make it to BlackHat for the CMMC listening session? Join us on Friday for the CMMC Hotline.We answer your toughest questions about CMMC, NIST SP 800-171, FedRAMP, and the latest developments impacting the Defense Industrial Base. No sales pitch. Just practical guidance and live Q&A with the community.

We're back from CS5 so this week we'll be stepping through a ton of questions we got from the event and, like always, anything that comes up during the livestream.