Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / CMMC Rule News Today: Secure Your Defense Contract Path

Transcript

CMMC Rule News Today: Secure Your Defense Contract Path · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:14
  Host: Today we discuss the latest CMMC rule. The July 13, 2026 pause is key. What does this mean for contractors?
• 0:24
  Analyst: Phase II deadline suspended, yet Level I persists. Self-assessments still required annually. Contracts must still prove compliance.
• 0:33
  Host: So the pause doesn't eliminate security. It simply delays third-party certification. Why is that significant?
• 0:41
  Analyst: Third-party assessments drive cost and timing. C3PAOs are scarce; only 103 authorized. Preparation remains urgent for all.
• 0:51
  Host: C3PAOs are distinct from RPOs. Petronella Technology Group is an RPO. What is the difference?
• 0:58
  Analyst: RPOs prepare, but cannot certify. Only C3PAOs issue Level 2 certificates. Petronella maintains independence under Cyber AB.
• 1:08
  Host: Level 2 covers 110 NIST controls. All are part of SP 800-171 Rev 2. How many domains support them?
• 1:16
  Analyst: Fourteen domains organize the 110 controls. Each domain addresses specific security aspects. Understanding domains aids scoping.
• 1:26
  Host: What about Level 1? Level 1 uses 15 FAR requirements. Do contractors need a third party?
• 1:33
  Analyst: Level 1 requires annual self-assessment only. No third-party assessment is mandatory. This covers Federal Contract Information.
• 1:42
  Host: Level 3 adds NIST 800-172 controls. It targets the most sensitive CUI. Who must meet Level 3?
• 1:50
  Analyst: High-risk environments must comply. DCMA assesses Level 3 via DIBCAC. Only Level 2 uses C3PAOs.
• 1:59
  Host: The acquisition rule changed the game. It mandates valid certificates before awards. When did it take effect?
• 2:07
  Analyst: Acquisition rule effective November 10, 2025. All contracts now require certification. Compliance is a legal obligation.
• 2:16
  Host: What about the program rule? It codified CMMC in CFR Part 170. When was it published?
• 2:24
  Analyst: Program rule published October 15, 2024. Effective December 16, 2024. It simplified the original five levels.
• 2:34
  Host: So the timeline is clear. But the July 13 pause throws a wrench. How long is the pause?
• 2:40
  Analyst: The pause extends beyond November 10, 2026. Later milestones remain on hold. Phase I stays active.
• 2:49
  Host: In practice, what does this mean? Contractors still perform annual self-assessments. They submit senior official affirmations.
• 2:57
  Analyst: Self-assessments use the 15 FAR controls. affirmations confirm compliance status. The DoD tracks evidence.
• 3:05
  Host: What about the 220,966 entities? Do you have to be one? Is the number meaningful?
• 3:12
  Analyst: 220,966 is the total scope. All defense contractors fall under it. It underscores industry-wide impact.
• 3:23
  Host: Authorized C3PAOs number 103. How many Level 2 certificates exist? What does that growth look like?
• 3:31
  Analyst: Level 2 certificates grew from 773 in January 2026. To 1,391 by May 2026. The ecosystem is expanding rapidly.
• 3:45
  Host: So early preparation is a competitive advantage. Do you agree? Let's explore the readiness process.
• 3:51
  Analyst: A typical readiness engagement lasts 12 to 14 weeks. Discovery, gap analysis, remediation, handoff. Plan is structured and measurable.
• 4:01
  Host: What does discovery involve? Mapping the CUI environment. Defining the system boundary.
• 4:07
  Analyst: Enclaving CUI into a narrow boundary reduces audit surface. Examples include GCC High or dedicated cloud zones. Scope decisions are critical early.
• 4:18
  Host: Gap analysis follows discovery. What does it reveal? Priorities for remediation?
• 4:24
  Analyst: It compares current controls to 110 NIST practices. Outputs a prioritized gap list. Risk and effort guide remediation.
• 4:33
  Host: Remediation sprint is the heavy lifting. What technical steps are common? How long does it take?
• 4:40
  Analyst: Implementing FIPS-validated encryption is crucial. Updating access controls and monitoring. Typically spans weeks, not months.
• 4:49
  Host: Then comes the mock assessment. What does that simulate? Why is it useful?
• 4:53
  Analyst: It uses the Cyber AB CMMC Assessment Process. Identifies gaps before the real audit. Prepares documentation and evidence.
• 5:02
  Host: After the mock, you handoff to a C3PAO. What happens then? Who is responsible?
• 5:09
  Analyst: C3PAO conducts the third-party assessment. Issues the Level 2 certificate. Petronella cannot perform this step.
• 5:17
  Host: The certificate goes to eMASS and SPRS. What are these systems? Why are they important?
• 5:24
  Analyst: eMASS tracks security posture. SPRS stores the official certificate. Both are DoD portals.
• 5:31
  Host: Compliance is continuous, not one-time. What ongoing tasks are required? How often are controls reviewed?
• 5:39
  Analyst: SSP is a living document. POA&M reviewed at least quarterly. Reassessment occurs every three years.
• 5:47
  Host: Incident reporting is a DFARS requirement. What is the reporting window? What portal do you use?
• 5:53
  Analyst: Incidents must be reported within 72 hours. Use the DoD portal at dibnet.dod.mil. A medium assurance certificate is needed.
• 6:03
  Host: After reporting, what preservation steps are required? How long do you keep evidence? What about malware submissions?
• 6:10
  Analyst: Preserve images and monitoring data for 90 days. Submit isolated malware to the government. Maintain a 90-day retention policy.
• 6:19
  Host: Subcontractor flow-downs are also critical. How do you ensure compliance? What clauses address this?
• 6:26
  Analyst: DFARS 252.204-7012 flows down to subcontracts. Subcontractors report incidents to DoD. They provide the report number upward.
• 6:39
  Host: POA&Ms are allowed for 'not met' items. What is the timeframe? How does that work?
• 6:45
  Analyst: POA&M closeout must occur within 180 days. Each item has a 180-day plan. The system monitors progress.
• 6:55
  Host: The DoD CIO FAQ clarifies encryption. Is encrypted CUI still CUI? Do you need FedRAMP?
• 7:02
  Analyst: Encrypted CUI remains CUI. Cloud environments still need FedRAMP Moderate. KVM-only VDI is out of scope.
• 7:10
  Host: So the pause gives more time. But it doesn't relax security. What should organizations do now?
• 7:17
  Analyst: Start with a scoped gap assessment. Identify CUI boundaries early. Prioritize remediation based on risk.
• 7:25
  Host: Enclosing CUI can reduce audit surface. What are best practices? How do you implement enclaves?
• 7:32
  Analyst: Use dedicated cloud zones or GCC High. Restrict access to authorized users. Document boundaries in the SSP.
• 7:41
  Host: The mock assessment is vital. How often should you run it? What does it reveal?
• 7:45
  Analyst: Run a mock before the real audit. It uncovers hidden gaps. It saves time during certification.
• 7:51
  Host: Once ready, you hand off to a C3PAO. What criteria choose a C3PAO? Why is authorization important?
• 7:59
  Analyst: Check the Cyber AB marketplace list. Ensure they are authorized. Avoid unapproved assessors.
• 8:05
  Host: Petronella Technology Group can help prepare. What services do you offer? How do you maintain independence?
• 8:12
  Analyst: We offer discovery, gap analysis, remediation. We provide mock assessments and SSP drafting. We remain independent under Cyber AB.
• 8:22
  Host: Every engineer holds the CMMC-RP credential. Why is that significant? What does it entail?
• 8:28
  Analyst: CMMC-RP ensures deep program knowledge. Engineers understand all levels. They guide clients accurately.
• 8:35
  Host: The firm is BBB accredited. How long has it operated? What does that mean for clients?
• 8:41
  Analyst: Founded in 2002, it remains active. BBB A+ rating since 2003. Clients trust our long-term partnership.
• 8:51
  Host: The readiness engagement takes 12 to 14 weeks. Is that typical? What influences the timeline?
• 8:59
  Analyst: Scope and complexity drive duration. Enclaving CUI can shorten it. Starting posture also matters.
• 9:05
  Host: The plan includes 14 control-family policies. What other deliverables are required? How do you ensure completeness?
• 9:13
  Analyst: Also an incident response plan. An acceptable use policy. A live POA&M and mock assessment.
• 9:20
  Host: The mock assessment uses the Cyber AB CAP. What is CAP? Why is it necessary?
• 9:26
  Analyst: CAP simulates the real audit environment. It tests evidence readiness. It identifies gaps before the C3PAO.
• 9:35
  Host: After certification, what maintenance is needed? Quarterly reviews? Annual updates?
• 9:41
  Analyst: SSP updated quarterly. POA&M reviewed each quarter. Reassessment every three years.
• 9:48
  Host: The article also lists DFARS clauses. Which ones are most important? How do they affect compliance?
• 9:54
  Analyst: DFARS 252.204-7012 mandates NIST controls. DFARS 252.204-7019 requires SPRS score. DFARS 252.204-7021 ties certification to award.
• 10:14
  Host: The SPRS score ranges from minus 203 to 110. How do you calculate it? What does a high score mean?
• 10:22
  Analyst: Score reflects control implementation. Higher scores indicate better compliance. It is used for contract eligibility.
• 10:30
  Host: The article mentions 180-day closeout. In what context? How does it relate to POA&M?
• 10:37
  Analyst: POA&M items must close within 180 days. This ensures timely remediation. Violations risk penalties.
• 10:46
  Host: The pause also affects the 72-hour incident window. How does that adjust? Do organizations still need to meet it?
• 10:54
  Analyst: The 72-hour window remains unchanged. Reporting must occur promptly. The pause only delays certification milestones.
• 11:02
  Host: So, the pause on the Phase II deadline-why does that matter for a mid-size contractor?
• 11:09
  Analyst: It means the 2026-11-10 certification deadline is on hold, but the 2025-11-10 acquisition rule is still live.
• 11:19
  Host: So the DoD still requires a valid CMMC Level 2 before award?
• 11:23
  Analyst: Exactly. The pause only delays the third-party assessment milestones, not the contractual requirement.
• 11:30
  Host: And the self-assessments?
• 11:31
  Analyst: Phase I self-assessments remain active. Every contractor must keep up the annual self-assessment and senior official affirmation.
• 11:40
  Host: So the 180-day POA&M closeout still applies?
• 11:43
  Analyst: Yes. Any 'not met' requirement must be wrapped up within 180 days, per 32 CFR Part 170.21.
• 11:53
  Host: What does that look like on the ground?
• 11:55
  Analyst: You create a POA&M, assign owners, and track remediation. Review it quarterly; if a gap isn’t closed in 180 days, you risk penalties.
• 12:05
  Host: And the 72-hour incident reporting window?
• 12:08
  Analyst: That stays unchanged. DFARS 252.204-7012 mandates reporting within 72 hours, using the DoD portal at dibnet.dod.mil.
• 12:21
  Host: Even with the Phase II pause?
• 12:23
  Analyst: Yes, the pause only affects certification timing, not incident reporting obligations.
• 12:29
  Host: Let’s talk numbers. The article mentions 220,966 entities in scope. Who are we talking to?
• 12:38
  Analyst: All defense contractors that process Federal Contract Information or Controlled Unclassified Information. That’s the entire supply chain.
• 12:47
  Host: And the authorized C3PAOs?
• 12:50
  Analyst: There were 103 authorized C3PAOs as of March 2026, and the Level 2 certificate count grew from 773 in January to 1,391 in May 2026.
• 13:05
  Host: So the market is expanding. Does that help companies?
• 13:09
  Analyst: More assessors mean more options, but also more competition. Early preparation gives a strategic advantage.
• 13:16
  Host: What is the practical impact of the pause on our project timeline?
• 13:20
  Analyst: You still need to complete the 12 to 14 week readiness engagement: discovery, gap analysis, remediation, mock assessment.
• 13:28
  Host: The article says that a typical readiness engagement runs 12 to 14 weeks. How does that break down?
• 13:35
  Analyst: Week 1 is discovery and scoping; weeks 2-4 gap analysis; weeks 5-12 remediation sprint; weeks 13-14 mock assessment and handoff.
• 13:46
  Host: And the remediation sprint-what does that entail?
• 13:50
  Analyst: Implement technical controls, draft the System Security Plan, 14 control-family policies, incident response plan, acceptable use policy.
• 13:59
  Host: Any particular controls that are especially tricky?
• 14:02
  Analyst: FIPS-validated cryptography for CUI, ensuring the cloud environment meets FedRAMP Moderate or equivalent.
• 14:09
  Host: What about the enclave strategy?
• 14:12
  Analyst: Enclaving CUI into a narrow boundary-like a GCC High tenant-reduces audit surface and focuses the 110 NIST controls.
• 14:21
  Host: So you avoid applying all 110 controls to the entire network?
• 14:25
  Analyst: Exactly. Only systems that touch CUI need those controls, making remediation faster and cheaper.
• 14:32
  Host: Now, the article lists common mistakes. Over-scoping is one. Any other pitfalls?
• 14:39
  Analyst: Ignoring incident reporting, using unvalidated cryptography, misunderstanding the RPO versus C3PAO role, and neglecting subcontractor flow-downs.
• 14:51
  Host: Why is the RPO vs C3PAO distinction critical?
• 14:55
  Analyst: An RPO, like Petronella Technology Group, can prepare you but cannot conduct the Level 2 assessment. Only a C3PAO can issue the certificate.
• 15:05
  Host: So if a provider promises a 'guaranteed pass', that violates Cyber AB rules?
• 15:10
  Analyst: Yes, that would be an independence violation. They must stay outside the assessment.
• 15:15
  Host: What about subcontractors? DFARS requires flow-down. How do companies manage that?
• 15:21
  Analyst: Contracts must include DFARS 252.204-7012 clauses, and subcontractors must report incidents and provide the DoD report number to the next tier.
• 15:34
  Host: And the SPRS score-how is it calculated?
• 15:37
  Analyst: It ranges from minus 203 to 110, with controls weighted 1, 3, or 5 points. A higher score means better compliance.
• 15:47
  Host: What score is considered acceptable for award?
• 15:50
  Analyst: Most contracts require a positive score, but the exact threshold varies by solicitation.
• 15:56
  Host: What questions do we hear most often from clients?
• 15:59
  Analyst: Do I need a POA&M if I’m not fully compliant? Yes, a POA&M is required for 'not met' items and must have a 180-day closeout.
• 16:10
  Host: What about the difference between FCI and CUI?
• 16:13
  Analyst: FCI is covered by Level 1-15 FAR requirements. CUI is covered by Level 2-110 NIST controls.
• 16:22
  Host: If we handle only FCI, do we still need to do a Level 2 assessment?
• 16:26
  Analyst: No, Level 1 self-assessment suffices, but you must still submit the annual senior official affirmation.
• 16:33
  Host: How do we ensure our cryptography meets the FIPS requirement?
• 16:37
  Analyst: Use validated modules, verify the cryptographic library’s FIPS status, and document the validation in the SSP.
• 16:45
  Host: And the incident reporting portal-what’s the medium assurance certificate?
• 16:49
  Analyst: It’s a DoD-approved certificate that allows you to submit incident reports via the portal before an incident occurs.
• 16:57
  Host: So we need to obtain that in advance?
• 16:59
  Analyst: Yes, otherwise you can’t report an incident, which would violate DFARS 252.204-7012.
• 17:08
  Host: What about the 72-hour window-does the pause affect that?
• 17:11
  Analyst: No, the window remains 72 hours. The pause only adjusts the certification timeline.
• 17:17
  Host: Let’s talk about the mock assessment again. What does the CAP test?
• 17:21
  Analyst: It replicates the C3PAO assessment environment, checking evidence readiness, control documentation, and evidence gaps.
• 17:30
  Host: If we pass the mock, does that guarantee the real assessment will pass?
• 17:34
  Analyst: It doesn’t guarantee, but it uncovers hidden gaps early, reducing the risk of a failed real assessment.
• 17:40
  Host: What are the steps after the mock assessment?
• 17:43
  Analyst: Finalize the POA&M, ensure all open items have a 180-day plan, hand off to the C3PAO shortlist with warm introductions.
• 17:53
  Host: How do we choose a C3PAO?
• 17:56
  Analyst: Look for an authorized C3PAO listed on cyberab.org, confirm they’ve handled similar scopes, and verify their credentialing.
• 18:05
  Host: Do we need to engage a C3PAO before the readiness engagement?
• 18:09
  Analyst: It’s best to involve them early, so they can review your SSP and provide realistic feedback on readiness.
• 18:16
  Host: And the POA&M-what happens if we miss the 180-day closeout?
• 18:20
  Analyst: You risk penalties under 32 CFR Part 170.21. It can also delay your certification if the C3PAO flags unresolved gaps.
• 18:31
  Host: What about the 2026-07-13 pause-does it affect the 2026-11-10 acquisition rule?
• 18:39
  Analyst: The acquisition rule still applies. The pause only delays the Phase II certification deadline, not the requirement to hold a certificate.
• 18:48
  Host: So we still need to be ready by the time a contract is awarded?
• 18:51
  Analyst: Yes. You must have a valid Level 2 certificate or be able to demonstrate readiness to the contracting officer.
• 18:58
  Host: What if we’re a small business with limited resources?
• 19:01
  Analyst: Focus on enclaving CUI, use a phased remediation plan, and leverage the RPO’s mock assessment to avoid costly surprises.
• 19:10
  Host: What if we’re a subcontractor? Do we need to go through the same process?
• 19:15
  Analyst: Yes, if you handle CUI for the prime, you must comply with DFARS 252.204-7012 and provide a senior official affirmation.
• 19:26
  Host: Do we need to report incidents to the prime?
• 19:29
  Analyst: The prime must report incidents to DoD and provide the report number to the next higher tier. Subcontractors must also report directly to DoD.
• 19:38
  Host: Let’s recap the key takeaways. First, the Phase II pause-what does that mean for planning?
• 19:45
  Analyst: It gives you more time to remediate gaps but doesn’t eliminate the need for a Level 2 certificate before award.
• 19:51
  Host: Second, the self-assessment remains active. And the 180-day POA&M closeout is still required.
• 19:58
  Analyst: Correct. And the 72-hour incident window is unchanged.
• 20:02
  Host: Third, the 220,966 entities in scope-how many of those are actually Level 2?
• 20:09
  Analyst: As of May 2026, 1,391 Level 2 certificates were issued, but many more are in the pipeline.
• 20:17
  Host: Fourth, the mock assessment using CAP is a critical step to avoid surprises.
• 20:22
  Analyst: Yes, it tests evidence readiness and uncovers gaps before the C3PAO assessment.
• 20:29
  Host: Fifth, common mistakes: over-scoping, ignoring incident reporting, using unvalidated cryptography, misunderstanding RPO vs C3PAO, neglecting subcontractor flow-downs.
• 20:42
  Analyst: Exactly. Avoiding those saves time and resources.
• 20:45
  Host: And the questions we hear most: need for POA&M, difference between FCI and CUI, incident reporting requirements, and how to choose a C3PAO.
• 20:55
  Analyst: Those are the core concerns for most defense contractors.
• 20:58
  Host: What’s the next step for a contractor ready to start the journey?
• 21:02
  Analyst: Begin with a discovery and scoping call to map your CUI environment, then schedule a 12-to-14 week readiness engagement.
• 21:10
  Host: And after the readiness engagement?
• 21:12
  Analyst: You’ll have a live SSP, POA&M, mock assessment, and a shortlist of authorized C3PAOs ready for the formal assessment.
• 21:21
  Host: What about ongoing maintenance?
• 21:22
  Analyst: Quarterly SSP reviews, quarterly POA&M updates, and a three-year reassessment cycle keep you compliant.
• 21:30
  Host: Any final thoughts on the pause and its implications?
• 21:33
  Analyst: The pause gives breathing room, but the legal obligations remain. Plan, scope, and execute-don’t wait to react.
• 21:41
  Host: Thank you for walking us through all of that.