View Top 200 Chart

Back to Rankings Page

Government

CMMC Brief

Daily CMMC and defense industrial base compliance briefing. DoD policy and rulemaking, False Claims Act cyber enforcement, Cyber AB and C3PAO developments, NIST 800-171 updates, and contracting impact for DIB contractors, compliance managers, and the MSPs and consultants who support them. From Carolina Clear Tech.

Latest Episodes:

2026-07-29: Federal agencies are debating whether commercial technology acquisition policies can coexist with Jul 29, 2026

Show notes

Show Notes - 2026-07-29

Stories Covered

Today:
CUI requirements creating commercial technology access tension across federal agencies. [Policy & Rulemaking]
What to do: [Policy & Rulemaking]
CyberAB warns fraudulent Level 2 certifications are circulating, provides verification path. [Cyber AB & Ecosystem]
What to do: [Cyber AB & Ecosystem]
FIPS compliance confusion continues for CUI enclaves. [Practitioner Pulse]
Outbound firewall scoping questions for cloud-only GCC-High environments. [Practitioner Pulse]
CNC machine access control raises OT network CUI boundary questions. [Practitioner Pulse]
What these signal: [Practitioner Pulse]

Read the full brief

2026-07-28: The CMMC suspension continues to drive confusion among practitioners preparing for presentations Jul 28, 2026

Show notes

Show Notes - 2026-07-28

Stories Covered

Today:
Quantum Computing Executive Orders Set 2031 PQC Migration Deadline [Policy & Rulemaking]
Claim Sponsorship in Federal Subcontracts: What DIB Subs Need in Their Agreements [Contracting Impact]
International Contractors: CMMC Certification Is Available but Complicated [Practitioner Pulse]
Reddit: Consolidating Suspension Confusion for a Presentation [Practitioner Pulse]
Reddit: ChatGPT Enterprise FedRAMP Capability Questions [Practitioner Pulse]
Reddit: Town Hall Anticipation [Practitioner Pulse]

Read the full brief

2026-07-25: Summit 7 published MSP vs MSSP guidance for CMMC contractors Jul 25, 2026

Show notes

Show Notes - 2026-07-25

Stories Covered

Today:
MSP vs MSSP: different roles, both needed for CMMC [Practitioner Pulse]
Action: [Practitioner Pulse]
No CMMC-specific policy developments today. [Policy & Rulemaking]
CISA accelerates vulnerability patching after AI exploit incidents [NIST & Standards]
Action: [NIST & Standards]
FedRAMP 20X transition deadline: June 2027 [NIST & Standards]
Action: [NIST & Standards]
DIU appoints first active-duty military deputy to speed fielding [Contracting Impact]
Action: [Contracting Impact]
SOF launches same-day acquisition challenge [Contracting Impact]
Action: [Contracting Impact]
No new DIB-specific FCA settlements today. [Enforcement & False Claims]
No Cyber AB or C3PAO developments today. [Cyber AB & Ecosystem]

Read the full brief

2026-07-24: DoD suspended CMMC Phase 2 third-party assessment requirements pending a Reform Task Force review Jul 24, 2026

Show notes

Show Notes - 2026-07-24

Stories Covered

Today:
DoD suspended CMMC Phase 2 C3PAO requirements (signed policy). [Policy & Rulemaking]
SBA commended the suspension after small-business pressure (signed policy). [Policy & Rulemaking]
Trump EO mandates AI-assisted supply-chain mapping for all national-security acquisitions (signed policy). [Policy & Rulemaking]
DoD class deviation implements Chinese-military-company covered-lobbyist prohibition (signed policy, limited detail). [Policy & Rulemaking]
Federal News Network commentary argues for software-sovereignty requirements in defense procurement (opinion). [Policy & Rulemaking]
No cyber-related False Claims Act settlements today. [Enforcement & False Claims]
No Cyber AB or C3PAO announcements today. [Cyber AB & Ecosystem]
No NIST 800-171/172 revisions today. [NIST & Standards]
Contracting officers began inserting CMMC requirements in Q4 2025, then suspended C3PAO designations in July 2026 (signed policy). [Contracting Impact]
Scoping, documentation, and MSPs are the assessment killers (practitioner analysis). [Practitioner Pulse]

Read the full brief

2026-07-23: The Phase II suspension memo continues to ripple through the procurement landscape Jul 23, 2026

Show notes

Show Notes - 2026-07-23

Stories Covered

Today:
CMMC Phase II Suspended, Reform Task Force Launched (Signed Memo, Memo 26-P-1023, July 13, 2026) [Policy & Rulemaking]
Fixed-Price Contracting Mandate, CAS Rescission, PCB Supply Chain ANPRM [Policy & Rulemaking]
Solicitations Must Drop C3PAO Requirements; Contractors Should Protest If They Don't [Contracting Impact]
GAO: Past Performance Cutoffs Must Follow Solicitation Language (B-424182.2, June 22, 2026) [Contracting Impact]

Read the full brief

2026-07-22: Federal News Network interviews confirm DoD's CMMC Phase 2 suspension changes nothing about Jul 22, 2026

Show notes

Show Notes - 2026-07-22

Stories Covered

Today:
CMMC Phase 2 suspended, but 800-171 obligations unchanged (task force review, not a repeal). [Policy & Rulemaking]
Action: [Policy & Rulemaking]
RFI comments due August 14. [Policy & Rulemaking]
Action: [Policy & Rulemaking]
Standing guidance: [Enforcement & False Claims]
PSC members continuing C3PAO assessments despite suspension. [Cyber AB & Ecosystem]
Risk to watch: [Cyber AB & Ecosystem]
Primes can still flow down certification requirements contractually. [Contracting Impact]
GSA's revised AI acquisition clause (watch item for DIB). [Contracting Impact]
Action: [Contracting Impact]
The key practitioner question right now: [Practitioner Pulse]

Read the full brief

2026-07-21: Summit 7 released implementation guidance on managed CUI enclaves as the fastest CMMC compliance Jul 21, 2026

Show notes

Show Notes - 2026-07-21

Stories Covered

Today:
Summit 7 publishes CUI enclave implementation guide for contractors with small CUI footprints. [Practitioner Pulse]
FAR Council proposes 90-day deadline for termination settlement proposals, compressing timeline and raising FCA exposure risk. [Contracting Impact]
No CMMC policy, rulemaking, enforcement, Cyber AB, NIST, or standards developments appeared in today's collection. [Contracting Impact]

Read the full brief

2026-07-18: The CMMC Reform Task Force held its first meeting Thursday and will report by late September Jul 18, 2026

Show notes

Show Notes - 2026-07-18

Stories Covered

Today:
CMMC Reform Task Force launches with first meeting, 60-day review timeline begins. [Policy & Rulemaking]
DoD planning listening sessions nationwide to gather contractor input. [Policy & Rulemaking]
Under Secretary Duffey issued memo directing removal of C3PAO requirements from active solicitations. [Policy & Rulemaking]
Class deviations or interim rules could accelerate changes post-review. [Policy & Rulemaking]
PreVeil analysis: False Claims Act cybersecurity settlements hit $51.8M in FY2025, up 233% year-over-year. [Enforcement & False Claims]
LOGZONE Inc. settled for $507,144 (June 2026) after Navy contracts ran on systems scoring -170 in SPRS. [Enforcement & False Claims]
Georgia Tech Research Corporation settled for $875,000 (September 2025) after submitting a campus-wide SPRS score for a lab with no antivirus and no SSP. [Enforcement & False Claims]
Aero Turbine / Gallant Capital Partners: $1.75M settlement (July 2025) shows M&A compliance liability flows to acquirers. [Enforcement & False Claims]
Raytheon / Nightwing: $8.4M settlement (May 2025) for running ~30 DoD contracts on networks non-compliant with DFARS 252.204-7008, 252.204-7012, and FAR 52.204-21. [Enforcement & False Claims]
Health Net Federal Services / Centene: $11.25M settlement (February 2025) for falsely certifying compliance with security controls in TRICARE contract. [Enforcement & False Claims]
Live CMMC solicitations show Level 2 (Self) requirements remain in force; C3PAO references under review. [Contracting Impact]
Contracting officers authorized to include CMMC since November 10, 2025. [Contracting Impact]
PreVeil's False Claims Act guide is the most practitioner-focused breakdown published this year. [Practitioner Pulse]
Matt Travis (Cyber AB CEO) quoted in PreVeil's solicitation tracker: "If you haven't started getting engaged in CMMC, now is the time. It was probably the time in early 2024, but now the light is flashing red." [Practitioner Pulse]
DoD CIO Davies described current CMMC assessments as "burdensome, red-tape ridden, check-the-box, point-in-time view" during press tour. [Practitioner Pulse]

Read the full brief

2026-07-17: No CMMC, DFARS cybersecurity, or defense industrial base compliance developments reported in Jul 17, 2026

Show notes

Show Notes - 2026-07-17

Stories Covered

Today:
What still applies during the suspension: [Note on Today's Collection]
Action items: [Note on Today's Collection]

Read the full brief

2026-07-16: DoD issued a formal RFI on SAM.gov seeking industry input on what replaces the paused CMMC Phase 2 Jul 16, 2026

Show notes

Show Notes - 2026-07-16

Stories Covered

Today:
DoD opens RFI on the post-suspension CMMC model; suspension itself is signed and in force. [Policy & Rulemaking]
SBA takes a public victory lap on the suspension. [Policy & Rulemaking]
C3PAO pipeline in limbo, but Level 2 work should not stop. [Cyber AB & Ecosystem]
Assessor/tooling economics still bite regardless of the pause. [Cyber AB & Ecosystem]
FOCI disclosure rule comment period closed; Congress wants to go further. [Contracting Impact]
SMBs split on wait-and-see versus continuing to build evidence. [Practitioner Pulse]
CUI markings are inconsistent, and that does not change your obligation. [Practitioner Pulse]
Microsoft won't commit to end-to-end encryption guarantees in GCC for EAR-controlled data. [Practitioner Pulse]
"Claude for Government" raises FedRAMP-authorization questions practitioners can't answer yet. [Practitioner Pulse]

Read the full brief

Related Podcasts