The Broadside
Watch hubsRSS →

Watch hub·cmmc · dfars · cui · nist-800-171

CMMC

Rules, assessments, the C3PAO ecosystem, and the road to contract enforcement.

Updated ·RSS ↗

CMMC is the Department of Defense's certification regime for handling Controlled Unclassified Information across the Defense Industrial Base. This hub tracks rule milestones, C3PAO certifications, assessor body decisions, and DIBCAC activity as they happen.

What changed in the last 30 days

  • nist/trade-press

    NIST finder connects small businesses to 83 nonprofit cyber programs

    NIST released a Small Business Cybersecurity Support Programs Finder, an interactive state map and table listing 83 nonprofit programs across all 50 states. The organizations offer local help such as risk assessments, penetration tests, compliance consulting, and incident response; schools and municipal governments can use the directory too. Inclusion is by self-submission, and NIST doesn't certify what any listed program delivers.

  • cisa/trade-press

    GAO third panel finds CIRCIA and SEC rules conflict with sector regs

    GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrecy Act, and others. Participants from energy, financial services, and healthcare and public health each described reporting thresholds, timelines, and definitions that diverge across the rules they're subject to. Most participants said federal harmonization progress over the past year has been limited. The panel floated establishing a single entity with authority over regulatory consistency.

  • cmmc/trade-press

    CMMC pause puts point-in-time assessments on the block

    The Defense Department has frozen new CMMC third-party assessment requirements and launched a reform task force, suspending the Phase 2 ramp that was scheduled to begin November 2026. Phase 1 self-assessment requirements remain in force, but the freeze leaves nearly 2,000 contractors holding Level 2 certifications uncertain about their status. Cyber AB CEO Matt Travis, in a Federal News Network interview, outlined reform proposals that include replacing point-in-time audits with continuous monitoring and reducing assessment teams from three assessors to two for smaller firms, changes he said could be implemented without new rulemaking.

  • cmmc/trade-press

    CMMC Certification Pauses, but 7012 Doesn't

    The Pentagon issued a class deviation suspending CMMC third-party certification requirements (no more C3PAO assessments for Level 2, no Level 3) but left every underlying cybersecurity obligation intact. DFARS 252.204-7012 safeguarding requirements remain. NIST SP 800-171 Revision 2 controls remain. SPRS scoring remains. And contractors must still file annual affirmations of continuous compliance. Contracting officers have been instructed to update active solicitations to reflect the changes. The Phase 2 transition toward mandatory outside assessments, originally set to ramp up, is now on hold while DoD's 60-day top-to-bottom review of the program concludes.

  • cmmc/trade-press

    CMMC self-attestation during Phase Two freeze carries FCA risk

    DoD's July 13 suspension of Phase Two CMMC mandatory third-party assessments has extended the period in which contractors rely on self-attestation. While the department conducts its 60-day review, Phase One self-assessment requirements remain in force. For contractors handling CUI at Level 2, that means senior officials continue signing annual compliance affirmations under DFARS 252.204-7021. The less-visible risk: if a cyber incident later triggers an investigation and documented evidence of continuous control monitoring isn't there, those affirmations can face FCA scrutiny. The Civil Cyber-Fraud Initiative has already yielded settlements where contractors allegedly misrepresented their implementation of NIST SP 800-171 controls.

Open questions

  • 01How will Joint Surveillance Voluntary Assessments transition to Level 2 certifications post-rule effective date?
  • 02When will DoD finalize the second tranche of CMMC contract clauses?
  • 03How are primes flowing CMMC requirements down to subs?

Sources we watch

Related from Deep Fathom

Earlier coverage