Hi all
Anyone can send an example how policy an implementation should be written for example
For 3.1.1
3.4.1
Thanks 🙏🏻

...during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 selfassessment and select Government-led assessments. The cybersecurity requirements outlined in the clause at DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, remain in effect. https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf

Hi everyone,

I am the internal IT Lead for a small defense manufacturing contractor (around 30-40 endpoints, with a mix of on-prem infrastructure and M365 (GCC High)). We are actively working toward CMMC Level 2 compliance and need to bring in an MSP to help us bridge the gap, handle daily user support, and act as a true co-managed IT partner.

Our current state: We aren't starting from scratch, our SPRS score is currently over 100. The foundational security architecture and policies are in place. We don't need a heavy-lifting compliance overhaul. We need an operational partner who can maintain that baseline daily. One of the things we are trying to remediate is, a separation of duties. With a one man IT crew - it is a hard one to fix.

Here is the absolute baseline requirement: Your MSP must be CMMC Level 2 compliant/certified themselves. If you don't practice what you preach or you can't hand over your own shared-responsibility documentation/evidence for your remote management tools (RMM/PSA) so I can plug it into our SSP, we cannot look at you.

Additionally, we are explicitly NOT looking for an enclave solution.

We have operational realities (on-prem engineering software, local domain controllers, file servers) that mean we need to make our actual, primary corporate environment compliant. We cannot just shove everyone into a locked-down virtual desktop enclave and call it a day.

We need a partner that:

Understands Co-Managed IT: I handle the high-level architecture and security administration, but I need a reliable team to handle the day-to-day helpdesk, endpoint onboarding, and ticket queues without stepping on my toes.

Knows CMMC natively: You should know how to manage a compliant environment using native features (Intune/Entra policies, proper ACL hygiene, tracking evidence logs) rather than just selling a proprietary pre-packaged framework.

Is reasonable to work with: No snake oil, no "compliance guarantees," and no forcing us into a massive, rigid tech stack rewrite just because it's easier for your sales team to invoice. We need practical, defensible security architecture.

If you are a CMMC L2 compliant MSP operating in this space (or if you are a fellow internal IT person who has found a great certified partner they actually trust), please drop a comment or slide into my DMs.

Bonus points if you have experience dealing with manufacturing/engineering environments and mixed on-prem/cloud architectures.

Bonus points if I can sit in on a few CMMC assessments to get my own CCA.

Thanks!

So, with the DoW officially freezing Phase II and standing up a 60day reform task force, things in our office got weird almost overnight.

For context, Phase 2 was set to trigger mandatory C3PAO audits this November, but the DoW pulled the emergency brake citing high costs for small businesses and the obvious assessor bottleneck 100,000 +companies vs 100 assessors

I’m curious how everyone else is handling this internally or with your clients. Are your higher ups using this pause as an excuse to freeze security budgets and hold off on technical remediation, or are you pushing ahead to stay compliant with DFARS and NIST 800 171 regardless?

What's the vibe at your org right now?

So we are an open core model company. We support an open source project which then we also sell support, orchestration, etc., of commercially. I'd be very interested to hear from assessors or others with experience on how a community support forum fits into AC.L2-3.1.22. We're putting review processes in place on all our company owned channels, but this one is tricky, to say the least. In the end, our company pays the bill, so I can see it as a channel requiring a review process, but at the same time, our posts are 95% responses to technical questions and 5% feature and release announcements for the project.

Any way to wiggle out of a full moderation flow?

AI capability is roughly doubling every few months. The practical effect is that whatever tools an organization had in scope at its L2 assessment fall behind quickly, and the gap keeps growing across a 3-year cycle.

Adding newer, more capable tools generally means a reassessment, and the cost makes that impractical to do often. But leaving the toolset frozen for the full cycle is its own problem when the technology is moving this fast.

So how are people handling this? Is there a way to bring in a newer tool without a full reassessment? When a reassessment is unavoidable, can it be scoped to just the affected controls instead of starting over? And with Phase 2 suspended and L2 back to self-assessment, is anyone using that window to update their environment?

Interested in how others are approaching this.

We decided to base our baselines off STIGS, how do you guys monitor this easily across the fleet and document differences?

Good afternoon! I’m active duty military looking to transition into cyber security career field-specifically CMMC (CCP and later CCA opportunities)

Through skillsbridge I am able to bridge my military experience straight into the civilian sector. I’ve had my eyes on a few CMMC Skillsbridges but wondering if this is still a good choice given the current posture. Any and all input is appreciated

Thanks!

so I'm 31 years old I've worked a lot of different jobs with varying fields and now I'm trying the to join the cybersecurity role my goal was to start with joining into cybersecurity analytics i didn't know how to start but now i have completed and earned a certificate in cybersecurity from google and I'm going to be taking my CompTIA security+ test next week. I'm curious to know if there is something else i should be going for before looking for a job or after my CompTIA test if I'm eligible for any job. also i have 0 experience in cyber security the help would be greatly appreciated! Thank you!

In an effort to ensure that those of you who are on the OSC side know about it, the DoW issued an RFI seeking the pain points of the program. If this is redundant apologies in advance.

Most of the time these RFIs are not somthing that anyone responds to as it doesn't add any value to the daily business. I would stress that this is the most important one to date this year, and urgent the relevant members of your companies to submit an honest response. To say nothing is to accept the unbridled firms running fast and loose, and effectively charging whatever they want to your organizations because they know that the government requires it. They will certainly be answering in numbers as it impacts their bottom line and a key revenue stream.

I was on a call recently where the C3PAO gave a quote for a 65k assessment and an optional 35k mock assessment. This right here is one of the most echoed problems with this monopoly they call CMMC.

The fact is that in IT we have methods to automate most of these controls already, and should be able to piggy back off the machine readable format the 20x program (FedRAMP) is aligning with. Dont get me wrong that the honor system did not work, and there should be a system in place to keep everyone honest, but not from a private entity with skin in the game and this program as a revenue stream (irregardless of non-profit status).

In addition to this the government needs to do their job of labeling the data correctly, and not rubber stamping everything as CUI. When everything is critical - no one believes it, and the cycle repeats. With proper sensitivity labeling from the government, and a tiered system where this stringent program is appropriately applied to the DIB, we could have the best of both worlds. There are good auditors out there who hate this program, and I dont mean to outcast all of them as a whole, but there are a lot of bad ones and businesses who prey on the small and medium businesses in this pickle.

As with anything of this caliber, be certain that all of the lawyers are gearing up to stomp their feet to get their way and maintain the status quo. I hope that this is helpful (and not too much of a rant), and at the very least you take it as a serious opportunity to have your voice heard.

Sam.gov rfi: https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view

Wishing the best outcome for all of you!

Am I the only one that thinks it's ridiculous that there are two certifications required to do these assessments? Let's be honest, the exams are not hard. It's more that the information is gate kept by the ecosystem by design.

Being forced to take ridiculously expensive training courses and then take ridiculously expensive exams. You could get all of the information you need to pass these exams from a book or a course on YouTube. All the instructors are doing is reading information that has been provided to them by NIST and the Cyber AB.

I feel like people who go through these training courses and exams feel like they have to charge insane prices just to recoup the cost of getting certified.

I welcome all kinds of critical takes on the following. I was kinda thinking about the implications of the C3PAO pause and realized that it just took away your witness and increased your liability.

The Department of War suspended the CMMC Level 2 third-party assessment on July 13, and a lot of contractors read it as relief.

Maybe we need to look at it  another way: The independent check that was your proof of compliance just receded — and your SPRS score now stands on one signature instead.

The C3PAO assessment is on hold, pending a 60-day review, however, DFARS 252.204-7012, NIST 800-171 are all unchanged. If you handle CUI, nothing about your obligations moved.

Your liability is not in the audit. It's in the attestation. The False Claims Act turns on "knowing," and the government has spent three years targeting self-attestation. In June, LOGZONE settled for $507,144 over a self-assessed score. Aerojet set the marker at $9 million in 2022; and a whistleblower was incentivized by collecting $2.61M of it. Both were self-assessment cases — and self-assessment is now the only game in town.

I'm not a defender of the high cost-point for C3PAO assessments. The FCA damages are far greater than the certification costs quoted frequently.

At least a C3PAO gave you corroboration. Now the score is just your word. If SPRS says 105 but MFA (3.5.3) isn't enforced on every system touching CUI, that gap is yours alone to explain.

Reposting this;

I do a lot of CMMC work, and this comes up constantly: if you handle CUI, you can't really use Copilot, Cursor, Claude Code, or Codex, since they send your code and prompts off to commercial endpoints. There wasn't a good option for that crowd, so I made one for one of my clients and decided to put it out for free.

It's a VS Code extension, pretty much the same idea as Claude Code and Codex (chat, agent modes, inline diffs, running commands, cost tracking). The only real difference is where it runs: the model is Azure OpenAI (gpt-5.1 / gpt-4.1) inside Azure US Government, without storing any context to AOAI, just local memory, so no CUI/ sensitive data stays in the service. The tools run locally, so your code stays on your machine and only the model call leaves, and it stays inside the Gov boundary.

It is an open-source tool with the option for you to implement it, run a POC or customize it as you see fit. Let me know what you all think, thanks.

Link to repo: https://github.com/jadenentropex/AzureGov-IDE-Coding-Assistant.git

One thing that came up today in a client discussion that I figure other small contractors are confused by as well, so I'm sharing in the hopes its helpful to people out there.

This contractor read that CMMC Phase II is paused while under 60-day review, and assumed that meant that CMMC Level 2 is paused. They were under the impression that, due to the pause, they now only need to meet Level 1 controls.

The Levels and the Phases are two different things (I know, it's confusing 😅). Setting the record straight (as I understand it).

The current version of CMMC has three levels (1, 2, and 3). If your contract requires CMMC Level 1, you're expected to implement the 15 basic safeguarding requirements for Federal Contract Information (FCI). If your contract requires CMMC Level 2 because you handle Controlled Unclassified Information (CUI), you're expected to implement the 110 security requirements of NIST SP 800-171.

The requirements were being rolled out in phases. We are currently in Phase I, where Level 2 contractors continue using self-assessments where applicable.

Phase II was scheduled to begin on November 10, 2026 and would have required many Level 2 contractors to obtain a third-party assessment from a C3PAO. That transition has now been paused while the Department conducts a 60-day review.

So what's the takeaway? Phase II is paused. CMMC Level 2 is not.

Of course, we'll all be watching closely to see what comes out of the Department's review over the next 60 days.

The recent buzz surrounding the Department of War (DoW) decision to delay the CMMC Phase II rollout has sparked a flurry of commentary. Most of the discourse centers on the potential impact for organizations pursuing certification and the C3PAO community at large. Having navigated the cybersecurity compliance landscape for over two decades, I’ve learned to view shifts in validation frameworks with a measured perspective; we have witnessed these cycles before and will undoubtedly encounter them again. My primary recommendation to those following these developments is to maintain your composure—resist the urge to adopt a "sky-is-falling" mentality. 

Generating cybersecurity requirements is relatively straightforward; however, the actual implementation of programs to verify adherence is, and will always remain, a complex challenge. If a governing body like the DoW could simply issue security standards and trust every organization to comply out of a sense of duty, there would be no need for formal validation. Unfortunately, human nature and business realities don’t work that way. While the core CMMC standards are not new, the official framework for validating them is still relatively new and will naturally require fine-tuning over time. Does this signify the demise of CMMC? I would argue a definitive no—the underlying threats remain constant, ensuring the standard’s continued relevance in our industry.

What has really changed then? Only one thing, effective immediately the DoW has paused the phase that would require a Level 2 entity to get an assessment from a 3rd party C3PAO. And they are forming a task force to investigate the validation program for the next 60 days. That's it and that's all. All of Phase I validation requirements are still in place (Self Assessments), protecting CUI/FCI is still in place, SPRS registration is still in place, flow-down compliance tracking for primes is still in place, etc. 

The next path in this ongoing process rests entirely with you. If your company handles sensitive data, the mandate to safeguard that information remains unchanged. While you could opt to pause and speculate on the eventual validation program—make no mistake, it is inevitable—the wiser course is to maintain your current momentum. These standards are fundamentally sound; they represent the same core security principles being embraced across every major sector, from finance to healthcare, and they are certainly here to stay.

Investing in cybersecurity is never a cheap endeavor, and when you introduce a formal validation mechanism, the price tag inevitably climbs. Human nature being what it is, organizations rarely prioritize selfless compliance; they typically require a stiff push to verify their security status. Currently, the DoW is attempting to navigate the complexities of a validation framework that doesn't inadvertently stifle the DIB—a noble objective, to be sure. I actually have to give some credit to the leadership at the DoW for making the difficult choice to hit the brakes. They likely recognized that the original phase rollout was going to be difficult on the DIB at this time and acted, despite the shockwaves it sent through the industry. We can only speculate about any higher-level government discussions occurring behind the scenes, but perhaps they are seeking a broader approach that allows the CMMC cybersecurity standards to be adopted across other agencies. I'm choosing to remain optimistic and I'll reserve my final judgment until this 60-day review concludes.

So what should your approach be over the next 60 days?

Level 1 Entity
No change for you at all, keep working towards getting your systems in order so you can confidently complete your Level 1 self assessment.

Level 2 Entity
As previously noted, the fundamental CMMC security standards remain entirely intact; only the mechanism for verifying adherence has shifted. For the time being, the benchmark remains a comprehensive Level 2 Self Assessment—a task that should already be underway for any organization that hasn't completed a formal C3PAO review. This is certainly not an invitation to slacken your pace. The DoW's goal isn't to stall progress while they refine the validation framework, so I strongly urge you to keep your momentum going.

• What if you are a Level 2 entity that is in the middle of a C3PAO assessment process?
  • Push forward and finish that work. It will take more time to stop and restart this later if required in the future
• How should I feel now if I just finished a CMMC Level 2 assessment with a C3PAO?
  • You should feel great and ahead of the game, it is inevitable that a high level of validation will be required at some point in the future. Additionally your risk to a prime contractor is very low and that represents a market advantage for you.
  • In my two decades of conducting cybersecurity compliance assessments, I have never seen an organization regret completing the journey. They invariably emerge with a stronger security posture and genuine peace of mind regarding their system security.
• What should I do if I am just starting my Level 2 validation process?
  • For now you have more choices, self assessment only, self assessment with a CCA/C3PAO review of your work, self assessment with CCA guidance and a full CMMC Mock Audit by a C3PAO to give you the highest level of assurance.
  • A key benefit of the Phase I self-assessment guidelines is the flexibility they provide, allowing you to align your compliance efforts with your specific risk tolerance and choose the precise level of assurance you want to present to your prime contractor.
  • Remember, there are still big positives to working with a C3PAO during this process

Prime Contractors
Whether you are a top-tier or mid-tier prime contractor, the duty of managing CMMC supply chain compliance has not disappeared with this announcement. This is actually the perfect moment to double down on your supply chain security. You must evaluate: what level of flow-down risk is your organization truly willing to accept? To prevent cybersecurity complacency from setting in, actively communicating with and tracking your subcontractors' CMMC progress is more crucial than ever. Do not neglect this essential responsibility simply because a C3PAO assessment may not be required for a period of time.

Summing Up
While this announcement offers a brief moment of relief regarding the upcoming 2027 Level 2 C3PAO validation deadlines, it is certainly not an invitation to procrastinate. A validation framework will inevitably be established, and halting your preparations now will only create a difficult bottleneck for your organization down the road. Our adversaries remain highly active, persistently seeking to compromise the DIB and its projects. Continue leveraging the CMMC guidelines to fortify your overall cybersecurity posture. Do your part to help navigate this transition successfully, this can happen if we all work together to protect sensitive defense industry data.

Trust me, it's better to be secure than to be compelled to be secure after a compromise.

What’s the deal with this? Anthropic seems to be claiming it’s good for CMMC level 2. I don’t even know if Anthropic is an approved entity. FedRAMP High boundary via Palantir’s Cloud. Vibe coding finally coming over the wall?

Which of the 3-point and 5-point assessment items have you found to be the most challenging or costly to implement? Also, when it comes to managing and protecting CUI, do you generally prefer deploying a cloud-based solution, or do you lean toward keeping it on-premises?

We are working towards L2 with our consultant. One of the things that I was looking at forever ago was RMM solutions. I love NinjaOne and they have a FedRamp version etc.

Talked with them and literally they just have a "FedRamp Charge" of $15K/yr. above and beyond what they charge for the platform. That was a hard thing to swallow and I moved on because having an on-prem solution is far cheaper and its an RMM and we are <50 endpoints.

Well last Monday out of the blue... I haven't talked to NinjaOne in months at this point in time. They call me and sent an email and now they are looking to drop the price and give me 5 months free.

Maybe it is just a coincidence but it does now seem strange that after so long of nothing, exactly one week before the announcement was made, they sent me an email trying to get me to come back and sign a contract.

Maybe the major players in the game have been given a heads up on what may be coming and so they were trying to lock people into contracts right before the announcement?

Anyone else have some very generous offers suddenly appear last week or the week before?

We’re designing a CMMC/GCC environment and want every file stored in a SharePoint CUI library to require Microsoft Purview authentication before it can be opened, even if it’s somehow copied or downloaded outside the environment.

Yes. USB is restricted, and policies are in place to ensure users don’t save or send externally, but everyone knows to never trust the end-user.

Office files and PDFs appear to work well, but I’m interested in real-world experience with other files such as:

AutoCAD (.dwg)
Revit (.rvt)
SolidWorks
STEP/IGES
Bluebeam
ZIP files
Other engineering file types

After reading the DOW CIO memorandum that suspends CMMC Phase 6 to perform a 60-day program review, seeing the different Reddit and LinkedIn posts, and hopefully talked with an RPO or C3PAO, what are SMBs planning?

Taking a 60-day to wait and see?

Continue working to document your SSP and collecting evidence that support NIST reporting?

Do the work yourselves or hire a RPO or C3PAO to assist with compliance?

It's really interesting that Microsoft won't endorse putting EAR data into GCC. They claim they can't commit to end to end encryption of customer data even with customer lockbox and customer key management enabled. That makes me nervous just being in a commercial tenant with no CUI.

I guess it wasn't too much of a shock about yesterdays news. But I'm curious as to how this affects consultants in this area.

The requirements for FUI/CUI are still there and if you need L2, you'll still need to implement all controls and have documentation. So, how are you or your org discussing this change and what changes will you make or not make???

From the various press releases, it looks to me that (at least until the 60day review period is up) that 800-171 requirements are still in place. But the Phase 2 (Nov 10th deadline) for C3PAO goes away.

- Press release calls out “It is critical to note that this action does not eliminate the requirement for companies to protect federal data. All defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012”

- “the number of available assessors is not large enough to conduct all the evaluations needed in time for the upcoming November deadline.”

- L2 C3PAO deadline & listing have been removed from the Overview of Assessments

I am getting employees stoked that all the controls will be pulled, but I don’t see that as the outcome here.
We still need data security, this just gives some breathing room while standards are re-evaluated.

I joined the CyberAB back in 2021 when it was still The CMMC Accreditation Body, Inc. The RP cert I got at the time was a little silly, but it helped my boss realize that we could get through the L2 self-assessment process. Which we did.

When that contract ended in 2024, I restarted my consultancy. I took the CISSP test cold and had the resume to qualify as a full member out of the gate. I picked up CompTIA Sec+ and Net+ because I got some free test coupons while I debated whether to make the investment.

My RP was essentially worthless in the market, but I never really cared about it as a serious cert. As I researched the costs and benefits of pursuing the CCP, I realized a few things.

The CyberAB won a zero-dollar contract to stand up an entire certification infrastructure on the back of its members. If you had a company paying for their mandatory training and tests, it probably wouldn't be that big of a deal to me. Paying for it as an individual while chasing consulting work in a rancid sea of CMMC snakeoil salesmen... no. Just no.

I completed the CCP training right before I got a contract doing RMF compliance (NIST SP 800-53) with a big contractor. My CISSP was plenty good enough for that, and all it cost me was the test.

The decision to pause the CMMC rollout based on the "paralyzing costs" pisses me off. The DoD/DoW decided to push the costs of this program onto the practitioners and assessors. Then they have the gall to complain about costs they never even paid.

I've personally paid thousands of dollars in fees to the CyberAB since 2021. Annual fees, training and testing fees, materials fees, all paid by me to serve the DiB. The decision to eliminate the requirement for third-party certifications has real impacts on proactive members of the cybersecurity market.

When the DoD/DoW decided to create a compliance program without funding the organization and then canceled it because of the costs, they lost all credibility with me. So pay me back for funding your compliance program. Instead of letting me take a qualifying test to participate in the marketplace, you forced me to pay for expensive training to help fund your program and build infrastructure.

I've got an itemized invoice showing how much I've spent since 2021 on a certification that has no value outside the DiB marketplace. Anyone interested in forming a class action? I sure am.

Just say no more CUI outside of Government-authorized environments. Let us, as a condition of contract award, purchase seats in your environment. Many of us do this already but you eat the cost.

1. Better control over your data.
   
2. Massively subsidize the cost of maintaining the environment for your civilian workforce.
   
3. Reduced overall contract costs due to companies not having to absorb ridiculous certification costs into their indirect rates.
   
4. Improved comms and collaboration (well, the opportunity for it anyway) since we’d all literally be in the same environment.

Maintaining your environments are already a sunk cost. Letting the DIB use it instead of duplicating infinite instances of it should be a no brainer.