CMMC Regulatory Watch
A running read on CMMC and DFARS rulemaking, cyber enforcement, and the assessment ecosystem, written for small and mid-size manufacturers.
- A genuinely quiet week. No Federal Register activity on Part 170, no new DFARS case, no new DOJ cyber-fraud action between Aug 21 and Aug 28. One item of real substance: Kirsten Davies at DIBX on Aug 26.
- We are sitting in the trough before the decision. The 60-day review clock started July 13 and runs to roughly Sept 11, with the Task Force report expected late September or early October. Expect the next real movement in two to five weeks.
- Davies telegraphed the direction on Aug 26: operational technology security over paperwork, roughly 1,100 RFI responses totaling 11,000-plus pages, and explicit resistance to a long study. Read this as reform that lands sooner and cuts administrative artifacts rather than technical floor.
- CUI marking is being named as the top cost driver (Aug 21). If the government-wide FAR CUI rule advances, that is the change with the biggest practical effect on how we scope Level 2 enclaves.
- Nothing about the pause reduces liability. DFARS 252.204-7012, NIST SP 800-171 Rev. 2, SPRS scores, and annual affirmations are all untouched and all still False Claims Act surfaces. LOGZONE is the proof case.
Rule & guidance changes
Davies signals the shape of CMMC reform at DIBX 2026: OT security, not paperwork
Speaking at DIBX in Philadelphia, DoW CIO Kirsten Davies framed the reform direction as "We want results, not red tape. We want performance, not paperwork," and called protection of federal data "table stakes" while pushing attention toward operational technology and production-floor resilience. She disclosed that the Reform Task Force RFI drew roughly 1,100 responses totaling more than 11,000 pages, with over half supportive of reform. She put small-business certification cost at $250,000 to $500,000 across three years and cited a ten-person veteran-owned shipbuilding supplier whose CEO was spending half his time on compliance.
The timeline signal matters as much as the content: she pushed back on a drawn-out process, saying "We don't want this to be a six- to twelve-month study." That is consistent with recommendations landing late September or early October rather than slipping into 2027.
Inconsistent CUI marking named as a primary cost driver in the CMMC review
Reporting on the reform review identifies uncertainty around CUI identification, over-marking, and inconsistent flow-down as a leading source of avoidable compliance cost, with the burden concentrated on small businesses that respond to ambiguity by over-applying controls. Alexander W. Major of McCarter & English argues the fix is contractual clarity on what CUI is actually being sent, which would let contractors scope assessments accurately instead of defensively.
Major points to the proposed government-wide CUI acquisition rule as the vehicle. That rule is real: FAR Case 2026-001 was published as a proposed rule on June 23, 2026, with comments closed July 23. It standardizes 72-hour incident reporting and introduces a standard form for communicating CUI safeguarding requirements.
Reform Task Force: RFI closed Aug 14, recommendations due within weeks
The RFI issued July 20 closed at noon ET on Aug 14. It ran on SAM.gov rather than in the Federal Register, which means the public record going into the decision is thinner than a normal rulemaking. The 60-day review that began July 13 runs to roughly Sept 11, with an additional stretch to synthesize recommendations for the CIO.
Watch which instrument DoW reaches for. The options are a class deviation, a new DFARS case, or an amendment to 32 CFR Part 170. That choice tells you how durable the change is and how fast it binds.
The suspension was executed by memoranda, not a class deviation, and that distinction is load-bearing
The pause runs through two July 13 memoranda: the DoW CIO memo (publication case 26-P-1023) and the implementing memo from the Under Secretary for Acquisition and Sustainment. Because neither 32 CFR Part 170 nor DFARS 252.204-7021 was amended, the regulations remain legally in force and only the acquisition instruction changed. The implementing memo directs contracting officers to amend active solicitations carrying C3PAO Level 2 or DIBCAC Level 3 requirements and states that no waivers shall be granted during the review.
A great deal of secondary commentary describes this as a "class deviation." It is not, and the difference matters: an instruction reversed by memo can be reinstated by memo, without notice and comment.
Unified Agenda confirms no pending Part 170 rulemaking; NIST family also static
The 2026 Unified Agenda published Aug 14 (91 FR 52984) lists the CMMC acquisition rule, DFARS Case 2019-D041, as a completed action and shows no new pending Part 170 action. On the NIST side, SP 800-172 Rev. 3 and 800-172A Rev. 3 went final May 13, 2026; there was no 800-171, 800-171A, or CUI publication activity in July or August.
The standing tension is unresolved: DFARS 252.204-7012 still points at 800-171 Rev. 2, while Rev. 3 has been final since May 2024. The RFI explicitly asked about Rev. 2 burden, so a Rev. 2 to Rev. 3 transition decision is plausibly inside the September report.
Enforcement & litigation
No new Civil Cyber-Fraud Initiative action was announced between Aug 21 and Aug 28. DOJ Fraud Section and Office of Public Affairs listings were checked directly.
AiNET and former CEO pay $1.8M over falsely certified data center tier rating
AiNET Corp. and former CEO Deepak Jain settled False Claims Act allegations that they falsely certified their data center met TIA-942 Tier III standards and claimed a nonexistent entity, the "UpTime Council," had inspected and rated the facility Tier IV. The customer was the SEC, not DoD.
This is worth stating clearly, because it is already being miscounted: the release does not mention cybersecurity, NIST, DFARS, CMMC, or the Civil Cyber-Fraud Initiative. Its only relevance is as a same-week illustration of the false technical certification theory, a contractor asserting conformance to a standard it had not met.
LOGZONE remains the case that defines exposure during the pause
The Huntsville defense contractor paid $507,144 to resolve FCA liability for failing to implement NIST SP 800-171 controls on Navy contracts from May 2021 to March 2025. The fact pattern is the one the pause leaves completely intact: LOGZONE posted a perfect self-assessment score of 110 in October 2021, and a 2024 DIBCAC review found the true score was negative 170, against a range of -203 to 110.
Every source reviewed since the July suspension agrees the underlying obligations survive it. Wiley notes DoW will continue enforcing 800-171 Rev. 2 through self-assessments and government-led assessments during the pause, and that DOJ's commitment to FCA cases on non-paused requirements is unaffected. DLA Piper puts it plainly: the suspension does not pause or excuse the underlying cybersecurity obligations.
DOJ posture: cyber enforcement described as on a "significant upward trajectory"
Deputy Assistant Attorney General Brenna Jenny, speaking at the ACI False Claims and Qui Tam forum, stressed these cases are "not about data breaches" but are "premised on misrepresentations," and said DOJ expects qui tam filings to keep increasing. Figures attributed to her remarks: roughly $52 million recovered across nine cyber FCA settlements in the fiscal year ending September 2025, and 15 civil cyber-fraud cases settled since October 2021, more than half announced under the current administration.
Attribution caveat: these figures come from law firm write-ups of live remarks. DOJ's own FY2025 statistics release reports a record $6.8 billion in total FCA recoveries but gives no cyber-specific breakout.
Ecosystem & C3PAO news
Assessors report contract cancellations and layoffs following the pause
National Defense Magazine reported that C3PAOs and assessors are seeing cancelled engagements and staff reductions following the Phase 2 suspension. It landed just before this period and has not been widely picked up, which is why it is included here.
We have not been able to independently confirm the specifics, so no firm names, headcounts, or cancellation counts are stated here. The direction of travel is supported on its own: assessor capacity was already underused before the pause. Treat any figures circulating on this with caution.
Cyber AB holds its position: voluntary C3PAO assessments remain available and valid
CEO Matthew Travis called the suspension "yet another momentary pause to this original and vital Trump Administration program" and argued that a Level 2 certification by a C3PAO "remains a compelling calling card for subcontracting viability to primes and the best insurance policy against False Claims Act risk." C3PAOs remain authorized and voluntary certification assessments are still being conducted. No Cyber AB announcement, leadership change, or fee change surfaced in the Aug 21 to Aug 28 window.
Two structural items to keep in view: the CAICO function transitioned to ISACA, completing in April 2026, so training, examination, and credentialing now run through ISACA while the Cyber AB retains investigations and background-check adjudication. And DIBCAC has posted nothing about the pause, continuing Medium and High assessments as though nothing changed.
CMMC PMO leadership remains unsettled going into the decision
Stacy Bostjanick, longtime Chief of DIB Cybersecurity and the program's most visible public voice, retired from DoD effective April 30, 2026. Buddy Dees, director of the CMMC PMO, was expected to take over the DIB cybersecurity program on an interim basis. No permanent successor has been confirmed.
Worth tracking because the reform recommendations will land on a program office without settled permanent leadership, which tends to favor decisions made at the CIO level rather than the PMO level.
| Date | Item | Confidence |
|---|---|---|
| ~Sept 11, 2026 | 60-day review clock closes; Task Force recommendations to DoW CIO | High |
| Sept 22, 2026 | CMMC in Practice Forum | Verified |
| Sept 22 to 24 | National Cyber Summit | Verified |
| Late Sept / early Oct | Reform report expected public | Davies commitment |
| Oct 1 to 2, 2026 | CMMC Midwest Conference | Verified |
| ~Mid-Oct 2026 | Earliest realistic formal DoW determinations | Analyst estimate |
Some information could not be verified
Everything above is linked to a source. These are the points where we could not get to a primary document, and we would rather say so than round them off.
- The specifics behind the August 17 report of assessor layoffs and cancelled engagements. No firm names or headcounts have been confirmed.
- The current number of authorized C3PAOs. The Cyber AB has not published an August figure. The most recent available is roughly 110 from late July, from a single source.
- The total number of Level 2 certifications issued to date. The last figure published by the Cyber AB was 932 (896 final plus 36 conditional) in late February. A widely repeated "nearly 2,000" figure comes from one source and does not reconcile with it.
- Whether a class deviation has been issued since July 13. The evidence strongly indicates none has, but we were not able to confirm it against the official index.
- Any 2026 debarment or suspension tied specifically to cyber noncompliance. We found none, though confirming that definitively would take a direct check of the SAM.gov exclusions list.