Sum IT Up: CMMC News Roundup

Register for Secure The DIB: https://www.summit7.us/secure-the-dib-2025 The final rule that allows DoD to include CMMC requirements in defense contracts and solicitations has officially moved into regulatory review. This is the last milestone before official publication and the start of the CMMC “phased roll-out". Because this final rule simply implements CMMC policy that went into effect in...

Register for Secure The DIB 2025: https://www.summit7.us/secure-the-dib-2025 When it comes to cyber incident reporting requirements people are always concerned with how well the government will protect a company's breach information. When the DoD overhauled contractor cyber requirements in 2016 to focus on incident reporting they included a clause that specifically addresses those concerns: DFARS...

An industry event for DoD Contractors & Higher Education Institutions: https://www.summit7.us/secure-the-dib-2025 Lockheed Martin wants their suppliers to know two things. First, suppliers should be fully and confidently compliant with existing DFARS cybersecurity requirements. Second, suppliers should be fully transitioned to the “Cybersecurity Compliance and Risk Assessment” tool...

Continuing our back-to-basics series of the “DFARS Cyber Series” of provisions and clauses brings us to clause 252.204-7020. This clause applies to defense contractors who are required to comply with DFARS clause 252.204-7012. Through DFARS 7020 the DoD reserves the right to conduct a higher-level assessment of a contractor's cybersecurity compliance. Additionally, defense contractors...

The Cyber AB brought the CMMC Ecosystem together once again for the June 2025 installment of their monthly Town Hall series. Join us for this week's show as we discuss all the information distributed during the meeting that you need to know; answers to questions like: Is the Ecosystem growing? How many certifications were awarded this month? Does Microsoft have to be at my assessment? And so much...

System Security Plans are the single most fundamental documents underpinning cybersecurity compliance for defense contractors. But even after nearly 40 years of using SSPs for federal information systems there are essentially zero examples of what good looks like. Thankfully NIST is revising SP 800-18 guidance on developing SSPs and wants your comments. This is a crash course on SSPs so you can ge...

The CMMC program has been in-effect for six months and hundreds of early adopters have achieved CMMC Level 2 status. Today we speak with Fernando Machado, managing principal at Cybersec Investments, an authorized C3PAO. Fernando has completed 25 CMMC Level 2 assessments and he has a ton of valuable takeaways to share. Pathfinder 101: https://www.summit7.us/pathfinder Pathfinder Demo: https://youtu...

We're back to basics this week with DFARS provision 252.204-7019. SPRS scores? DIBCAC High assessments? DoD Assessment Methodology? It all started in 2020 with a humble four paragraph provision that was overshadowed by CMMC 1.0. These days the Department of Justice is settling False Claims Act lawsuits for millions and defense contracts aren't getting renewed all thanks to the DFARS cyber provisio...

The Cyber AB has once again convened the CMMC ecosystem to deliver the monthly Town Hall covering the latest news and information about the CMMC Program. Join Jason and Joy as they talk about the latest ecosystem happening for the month of May. There has been another branding change, an event filled week in Vegas, more conversations around 10-day re-evaluation periods for CMMC assessments, stats o...

The CMMC program regulation went into effect in December 2024, but the DoD can't insert CMMC requirements in contracts until they finish revising regulatory contract clause language. The window for the long-awaited contract clause final rule is opening next month. We predict that CMMC will start showing up in defense contracts between June – October 2025. Episode Links: Pathfinder 101: https...

Katie Arrington is the architect of the CMMC program, currently performing the duties of the DoD CIO, and she is ultra pissed that defense contractors haven't improved their cybersecurity posture while she was gone for 3 short years. This week we dive into Katie's keynote at AFCEA TechNet Cyber 2025 where she didn't mince words about CMMC, the DIB, and the coming storm. Register for CEIC West: htt...

The Cyber AB has once again convened the CMMC ecosystem to deliver the monthly Town Hall covering the latest news and information about the CMMC Program; and Joy has once again joined the show so we can talk about the latest ecosystem happening for the month of April. A change in CAICO leadership, stats on completed assessments, another audit, a “ESP, not a CSP” MythBusters/Ecosystem e...

It's that time of year again and this time CS2 is coming to Reston, VA. This week we walk through the agenda adn talk about the sessions we're most excited for. Whistleblower attorneys? C3PAO lessons learned? Real world defense contractors who have completed CMMC Level 2? Prime contractor perspectives on upcoming requirements? CS2 has it all. Register for CS2 Reston: https://cs2.cloud/reston Pathf...

DoD has officially released their parameters for NIST SP 800-171 revision 3 requirements. Defense contractors now have a clear picture of their future compliance requirements and what assessors will ask for under “CMMC 3.0”. But if SP 800-171r3 won't be required for some time, why did the DoD publish their organizationally defined values? In this episode we dive into the basics of &ldq...

Most people mistaken believe that their cybersecurity requirements stem from the Cybersecurity Maturity Model Certification Program (CMMC). CMMC is simply a verification program that proves if you have implemented the requirements imposed by DFARS clause 252.204-7012. Ultimately, DFARS clause 252.204-7012 is the center of gravity for all the cybersecurity stuff that comes with being a defense cont...

After 100 episodes diving into every possible rabbit hole to help illuminate the bigger picture around CMMC we're starting over at square zero: the “DFARS Cyber Series” of contract clauses. First up: the solicitation provision 252.204-7008. Although 7008 doesn't have the notoriety of it's big brother DFARS 252.204-7012, it is the first domino that triggers the cascade of cybersecurity...

The Department of Justice finally did it: they went after a small defense contractor for failure to comply with their contractually obligated cybersecurity requirements. This case has it all from fake SPRS scores to whistleblowers getting paid hundreds of thousands of dollars to contractors paying millions in fines. All thanks to the same set of contract clauses in every DoD contract and the same...

The Cyber AB is back with their monthly Town Hall meeting which can only mean one thing; Joy is here to co-host the show, and we are gonna break down the information distributed during the meeting. The ecosystem is growing, CMMC is going international, and so much more! Tune in to see what we have to say! Register for CS2 Reston: https://cs2.cloud/reston Pathfinder 101: https://www.summit7.us/path...

The Canadian Program for Cyber Security Certification (CPCSC) requires defense contractors to undergo assessment against NIST SP 800-171 revision 3. That's a big problem for contractors who also do work for the U.S. Department of Defense because CMMC currently evaluates NIST SP 800-171 revision 2 and will for quite some time. In this episode we dive into what we know about Canada's version of CMMC...

At long last we've come to the fourth and final episode covering every finding and allegation in the DoD Inspector General Report on the CMMC process for authorizing 3rd-party assessment organizations. So far none of the 10 findings come anywhere close spelling doom for the CMMC program. Perhaps the juiciest scandals were saved for last? Register for CS2 Reston: https://cs2.cloud/reston Pathfinder...

We're almost done with our exploration of DoD Inspector General audit of the CMMC C3PAO authorization process. The last two recommendations might be the most perplexing of all. Maybe the Inspector General saved the best for last? Register for CS2 Reston: https://cs2.cloud/reston Pathfinder 101: https://www.summit7.us/pathfinder Pathfinder Demo: https://youtu.be/JiDTCchfCa0?si=JJFplxSfvkaRVhRo DoD...

The Cyber AB is back with their monthly Town Hall meeting. This week we dive into “what's new” with the CMMC Program for the month of February covering things like: What do the ecosystem numbers look like right now? What's up with T3 suitability? Can people announce if they're certified yet? And so much more! Register for CS2 Reston: https://cs2.cloud/reston Register for S7 Live: https...

The DoD has released guidance to the contracting workforce that implements the 32 CFR CMMC final rule. This week we discuss the two big takeaways for defense contractors. 1) Level 2 self-assessments are unlikely for 99% of companies. 2) CMMC waivers will be even more rare. Register for CS2 Reston: https://cs2.cloud/reston Pathfinder 101: https://www.summit7.us/pathfinder Pathfinder Demo: https://y...

This week we continue our exploration of DoD Inspector General audit of the CMMC C3PAO authorization process. The majority of the recommendations pertain to the Cyber AB, but are all of the recommendations even actionable? We think you'll be surprised at the disparity between the headlines and what the report actually says. Register for CS2 Reston: https://cs2.cloud/reston Pathfinder 101: https://...

The DoD Inspector General's report on the C3PAO authorization process is out and people haven't been shy with their takes on the findings. This week we dive into the first set of recommendations to see if there really is a smoking gun. We think you'll be surprised at the disparity between the headlines and what the report actually says. Register for CS2 Reston: https://cs2.cloud/reston Pathfinder...