00:00:14 --> 00:00:24
Today we discuss the latest CMMC rule. The July 13, 2026 pause is key. What does this mean for contractors?
00:00:24 --> 00:00:33
Phase II deadline suspended, yet Level I persists. Self-assessments still required annually. Contracts must still prove compliance.
00:00:33 --> 00:00:40
So the pause doesn't eliminate security. It simply delays third-party certification. Why is that significant?
00:00:41 --> 00:00:51
Third-party assessments drive cost and timing. C3PAOs are scarce; only 103 authorized. Preparation remains urgent for all.
00:00:51 --> 00:00:58
C3PAOs are distinct from RPOs. Petronella Technology Group is an RPO. What is the difference?
00:00:58 --> 00:01:08
RPOs prepare, but cannot certify. Only C3PAOs issue Level 2 certificates. Petronella maintains independence under Cyber AB.
00:01:08 --> 00:01:16
Level 2 covers 110 NIST controls. All are part of SP 800-171 Rev 2. How many domains support them?
00:01:16 --> 00:01:26
Fourteen domains organize the 110 controls. Each domain addresses specific security aspects. Understanding domains aids scoping.
00:01:26 --> 00:01:32
What about Level 1? Level 1 uses 15 FAR requirements. Do contractors need a third party?
00:01:33 --> 00:01:42
Level 1 requires annual self-assessment only. No third-party assessment is mandatory. This covers Federal Contract Information.
00:01:42 --> 00:01:50
Level 3 adds NIST 800-172 controls. It targets the most sensitive CUI. Who must meet Level 3?
00:01:50 --> 00:01:59
High-risk environments must comply. DCMA assesses Level 3 via DIBCAC. Only Level 2 uses C3PAOs.
00:01:59 --> 00:02:06
The acquisition rule changed the game. It mandates valid certificates before awards. When did it take effect?
00:02:07 --> 00:02:16
Acquisition rule effective November 10, 2025. All contracts now require certification. Compliance is a legal obligation.
00:02:16 --> 00:02:23
What about the program rule? It codified CMMC in CFR Part 170. When was it published?
00:02:24 --> 00:02:33
Program rule published October 15, 2024. Effective December 16, 2024. It simplified the original five levels.
00:02:34 --> 00:02:40
So the timeline is clear. But the July 13 pause throws a wrench. How long is the pause?
00:02:40 --> 00:02:48
The pause extends beyond November 10, 2026. Later milestones remain on hold. Phase I stays active.
00:02:49 --> 00:02:57
In practice, what does this mean? Contractors still perform annual self-assessments. They submit senior official affirmations.
00:02:57 --> 00:03:05
Self-assessments use the 15 FAR controls. affirmations confirm compliance status. The DoD tracks evidence.
00:03:05 --> 00:03:12
What about the 220 entities? Do you have to be one? Is the number meaningful?
00:03:12 --> 00:03:22
220 is the total scope. All defense contractors fall under it. It underscores industry-wide impact.
00:03:23 --> 00:03:30
Authorized C3PAOs number 103. How many Level 2 certificates exist? What does that growth look like?
00:03:31 --> 00:03:44
Level 2 certificates grew from 773 in January 2026. To 1 by May 2026. The ecosystem is expanding rapidly.
00:03:45 --> 00:03:51
So early preparation is a competitive advantage. Do you agree? Let's explore the readiness process.
00:03:51 --> 00:04:01
A typical readiness engagement lasts 12 to 14 weeks. Discovery, gap analysis, remediation, handoff. Plan is structured and measurable.
00:04:01 --> 00:04:07
What does discovery involve? Mapping the CUI environment. Defining the system boundary.
00:04:07 --> 00:04:18
Enclaving CUI into a narrow boundary reduces audit surface. Examples include GCC High or dedicated cloud zones. Scope decisions are critical early.
00:04:18 --> 00:04:24
Gap analysis follows discovery. What does it reveal? Priorities for remediation?
00:04:24 --> 00:04:33
It compares current controls to 110 NIST practices. Outputs a prioritized gap list. Risk and effort guide remediation.
00:04:33 --> 00:04:39
Remediation sprint is the heavy lifting. What technical steps are common? How long does it take?
00:04:40 --> 00:04:48
Implementing FIPS-validated encryption is crucial. Updating access controls and monitoring. Typically spans weeks, not months.
00:04:49 --> 00:04:53
Then comes the mock assessment. What does that simulate? Why is it useful?
00:04:53 --> 00:05:02
It uses the Cyber AB CMMC Assessment Process. Identifies gaps before the real audit. Prepares documentation and evidence.
00:05:02 --> 00:05:09
After the mock, you handoff to a C3PAO. What happens then? Who is responsible?
00:05:09 --> 00:05:17
C3PAO conducts the third-party assessment. Issues the Level 2 certificate. Petronella cannot perform this step.
00:05:17 --> 00:05:23
The certificate goes to eMASS and SPRS. What are these systems? Why are they important?
00:05:24 --> 00:05:31
eMASS tracks security posture. SPRS stores the official certificate. Both are DoD portals.
00:05:31 --> 00:05:39
Compliance is continuous, not one-time. What ongoing tasks are required? How often are controls reviewed?
00:05:39 --> 00:05:46
SSP is a living document. POA&M reviewed at least quarterly. Reassessment occurs every three years.
00:05:47 --> 00:05:52
Incident reporting is a DFARS requirement. What is the reporting window? What portal do you use?
00:05:53 --> 00:06:02
Incidents must be reported within 72 hours. Use the DoD portal at dibnet.dod.mil. A medium assurance certificate is needed.
00:06:03 --> 00:06:10
After reporting, what preservation steps are required? How long do you keep evidence? What about malware submissions?
00:06:10 --> 00:06:19
Preserve images and monitoring data for 90 days. Submit isolated malware to the government. Maintain a 90-day retention policy.
00:06:19 --> 00:06:26
Subcontractor flow-downs are also critical. How do you ensure compliance? What clauses address this?
00:06:26 --> 00:06:39
DFARS 252-7012 flows down to subcontracts. Subcontractors report incidents to DoD. They provide the report number upward.
00:06:39 --> 00:06:45
POA&Ms are allowed for 'not met' items. What is the timeframe? How does that work?
00:06:45 --> 00:06:55
POA&M closeout must occur within 180 days. Each item has a 180-day plan. The system monitors progress.
00:06:55 --> 00:07:02
The DoD CIO FAQ clarifies encryption. Is encrypted CUI still CUI? Do you need FedRAMP?
00:07:02 --> 00:07:10
Encrypted CUI remains CUI. Cloud environments still need FedRAMP Moderate. KVM-only VDI is out of scope.
00:07:10 --> 00:07:17
So the pause gives more time. But it doesn't relax security. What should organizations do now?
00:07:17 --> 00:07:25
Start with a scoped gap assessment. Identify CUI boundaries early. Prioritize remediation based on risk.
00:07:25 --> 00:07:32
Enclosing CUI can reduce audit surface. What are best practices? How do you implement enclaves?
00:07:32 --> 00:07:40
Use dedicated cloud zones or GCC High. Restrict access to authorized users. Document boundaries in the SSP.
00:07:41 --> 00:07:45
The mock assessment is vital. How often should you run it? What does it reveal?
00:07:45 --> 00:07:51
Run a mock before the real audit. It uncovers hidden gaps. It saves time during certification.
00:07:51 --> 00:07:59
Once ready, you hand off to a C3PAO. What criteria choose a C3PAO? Why is authorization important?
00:07:59 --> 00:08:05
Check the Cyber AB marketplace list. Ensure they are authorized. Avoid unapproved assessors.
00:08:05 --> 00:08:11
Petronella Technology Group can help prepare. What services do you offer? How do you maintain independence?
00:08:12 --> 00:08:21
We offer discovery, gap analysis, remediation. We provide mock assessments and SSP drafting. We remain independent under Cyber AB.
00:08:22 --> 00:08:28
Every engineer holds the CMMC-RP credential. Why is that significant? What does it entail?
00:08:28 --> 00:08:35
CMMC-RP ensures deep program knowledge. Engineers understand all levels. They guide clients accurately.
00:08:35 --> 00:08:41
The firm is BBB accredited. How long has it operated? What does that mean for clients?
00:08:41 --> 00:08:51
Founded in 2002, it remains active. BBB A+ rating since 2003. Clients trust our long-term partnership.
00:08:51 --> 00:08:58
The readiness engagement takes 12 to 14 weeks. Is that typical? What influences the timeline?
00:08:59 --> 00:09:05
Scope and complexity drive duration. Enclaving CUI can shorten it. Starting posture also matters.
00:09:05 --> 00:09:13
The plan includes 14 control-family policies. What other deliverables are required? How do you ensure completeness?
00:09:13 --> 00:09:20
Also an incident response plan. An acceptable use policy. A live POA&M and mock assessment.
00:09:20 --> 00:09:26
The mock assessment uses the Cyber AB CAP. What is CAP? Why is it necessary?
00:09:26 --> 00:09:34
CAP simulates the real audit environment. It tests evidence readiness. It identifies gaps before the C3PAO.
00:09:35 --> 00:09:41
After certification, what maintenance is needed? Quarterly reviews? Annual updates?
00:09:41 --> 00:09:47
SSP updated quarterly. POA&M reviewed each quarter. Reassessment every three years.
00:09:48 --> 00:09:54
The article also lists DFARS clauses. Which ones are most important? How do they affect compliance?
00:09:54 --> 00:10:14
DFARS 252-7012 mandates NIST controls. DFARS 252-7019 requires SPRS score. DFARS 252-7021 ties certification to award.
00:10:14 --> 00:10:22
The SPRS score ranges from minus 203 to 110. How do you calculate it? What does a high score mean?
00:10:22 --> 00:10:30
Score reflects control implementation. Higher scores indicate better compliance. It is used for contract eligibility.
00:10:30 --> 00:10:36
The article mentions 180-day closeout. In what context? How does it relate to POA&M?
00:10:37 --> 00:10:46
POA&M items must close within 180 days. This ensures timely remediation. Violations risk penalties.
00:10:46 --> 00:10:53
The pause also affects the 72-hour incident window. How does that adjust? Do organizations still need to meet it?
00:10:54 --> 00:11:02
The 72-hour window remains unchanged. Reporting must occur promptly. The pause only delays certification milestones.
00:11:02 --> 00:11:08
So, the pause on the Phase II deadline-why does that matter for a mid-size contractor?
00:11:09 --> 00:11:19
It means the 2026-11-10 certification deadline is on hold, but the 2025-11-10 acquisition rule is still live.
00:11:19 --> 00:11:23
So the DoD still requires a valid CMMC Level 2 before award?
00:11:23 --> 00:11:30
Exactly. The pause only delays the third-party assessment milestones, not the contractual requirement.
00:11:30 --> 00:11:31
And the self-assessments?
00:11:31 --> 00:11:39
Phase I self-assessments remain active. Every contractor must keep up the annual self-assessment and senior official affirmation.
00:11:40 --> 00:11:43
So the 180-day POA&M closeout still applies?
00:11:43 --> 00:11:52
Yes. Any 'not met' requirement must be wrapped up within 180 days, per 32 CFR Part 170.21.
00:11:53 --> 00:11:54
What does that look like on the ground?
00:11:55 --> 00:12:05
You create a POA&M, assign owners, and track remediation. Review it quarterly; if a gap isn’t closed in 180 days, you risk penalties.
00:12:05 --> 00:12:08
And the 72-hour incident reporting window?
00:12:08 --> 00:12:21
That stays unchanged. DFARS 252-7012 mandates reporting within 72 hours, using the DoD portal at dibnet.dod.mil.
00:12:21 --> 00:12:23
Even with the Phase II pause?
00:12:23 --> 00:12:29
Yes, the pause only affects certification timing, not incident reporting obligations.
00:12:29 --> 00:12:37
Let’s talk numbers. The article mentions 220 entities in scope. Who are we talking to?
00:12:38 --> 00:12:47
All defense contractors that process Federal Contract Information or Controlled Unclassified Information. That’s the entire supply chain.
00:12:47 --> 00:12:49
And the authorized C3PAOs?
00:12:50 --> 00:13:05
There were 103 authorized C3PAOs as of March 2026, and the Level 2 certificate count grew from 773 in January to 1 in May 2026.
00:13:05 --> 00:13:08
So the market is expanding. Does that help companies?
00:13:09 --> 00:13:16
More assessors mean more options, but also more competition. Early preparation gives a strategic advantage.
00:13:16 --> 00:13:19
What is the practical impact of the pause on our project timeline?
00:13:20 --> 00:13:28
You still need to complete the 12 to 14 week readiness engagement: discovery, gap analysis, remediation, mock assessment.
00:13:28 --> 00:13:34
The article says that a typical readiness engagement runs 12 to 14 weeks. How does that break down?
00:13:35 --> 00:13:45
Week 1 is discovery and scoping; weeks 2-4 gap analysis; weeks 5-12 remediation sprint; weeks 13-14 mock assessment and handoff.
00:13:46 --> 00:13:49
And the remediation sprint-what does that entail?
00:13:50 --> 00:13:59
Implement technical controls, draft the System Security Plan, 14 control-family policies, incident response plan, acceptable use policy.
00:13:59 --> 00:14:02
Any particular controls that are especially tricky?
00:14:02 --> 00:14:09
FIPS-validated cryptography for CUI, ensuring the cloud environment meets FedRAMP Moderate or equivalent.
00:14:09 --> 00:14:11
What about the enclave strategy?
00:14:12 --> 00:14:21
Enclaving CUI into a narrow boundary-like a GCC High tenant-reduces audit surface and focuses the 110 NIST controls.
00:14:21 --> 00:14:25
So you avoid applying all 110 controls to the entire network?
00:14:25 --> 00:14:32
Exactly. Only systems that touch CUI need those controls, making remediation faster and cheaper.
00:14:32 --> 00:14:39
Now, the article lists common mistakes. Over-scoping is one. Any other pitfalls?
00:14:39 --> 00:14:51
Ignoring incident reporting, using unvalidated cryptography, misunderstanding the RPO versus C3PAO role, and neglecting subcontractor flow-downs.
00:14:51 --> 00:14:54
Why is the RPO vs C3PAO distinction critical?
00:14:55 --> 00:15:05
An RPO, like Petronella Technology Group, can prepare you but cannot conduct the Level 2 assessment. Only a C3PAO can issue the certificate.
00:15:05 --> 00:15:10
So if a provider promises a 'guaranteed pass', that violates Cyber AB rules?
00:15:10 --> 00:15:15
Yes, that would be an independence violation. They must stay outside the assessment.
00:15:15 --> 00:15:21
What about subcontractors? DFARS requires flow-down. How do companies manage that?
00:15:21 --> 00:15:34
Contracts must include DFARS 252-7012 clauses, and subcontractors must report incidents and provide the DoD report number to the next tier.
00:15:34 --> 00:15:37
And the SPRS score-how is it calculated?
00:15:37 --> 00:15:47
It ranges from minus 203 to 110, with controls weighted 1, 3, or 5 points. A higher score means better compliance.
00:15:47 --> 00:15:49
What score is considered acceptable for award?
00:15:50 --> 00:15:56
Most contracts require a positive score, but the exact threshold varies by solicitation.
00:15:56 --> 00:15:59
What questions do we hear most often from clients?
00:15:59 --> 00:16:10
Do I need a POA&M if I’m not fully compliant? Yes, a POA&M is required for 'not met' items and must have a 180-day closeout.
00:16:10 --> 00:16:12
What about the difference between FCI and CUI?
00:16:13 --> 00:16:21
FCI is covered by Level 1-15 FAR requirements. CUI is covered by Level 2-110 NIST controls.
00:16:22 --> 00:16:26
If we handle only FCI, do we still need to do a Level 2 assessment?
00:16:26 --> 00:16:33
No, Level 1 self-assessment suffices, but you must still submit the annual senior official affirmation.
00:16:33 --> 00:16:36
How do we ensure our cryptography meets the FIPS requirement?
00:16:37 --> 00:16:45
Use validated modules, verify the cryptographic library’s FIPS status, and document the validation in the SSP.
00:16:45 --> 00:16:49
And the incident reporting portal-what’s the medium assurance certificate?
00:16:49 --> 00:16:56
It’s a DoD-approved certificate that allows you to submit incident reports via the portal before an incident occurs.
00:16:57 --> 00:16:59
So we need to obtain that in advance?
00:16:59 --> 00:17:07
Yes, otherwise you can’t report an incident, which would violate DFARS 252-7012.
00:17:08 --> 00:17:11
What about the 72-hour window-does the pause affect that?
00:17:11 --> 00:17:17
No, the window remains 72 hours. The pause only adjusts the certification timeline.
00:17:17 --> 00:17:21
Let’s talk about the mock assessment again. What does the CAP test?
00:17:21 --> 00:17:29
It replicates the C3PAO assessment environment, checking evidence readiness, control documentation, and evidence gaps.
00:17:30 --> 00:17:33
If we pass the mock, does that guarantee the real assessment will pass?
00:17:34 --> 00:17:40
It doesn’t guarantee, but it uncovers hidden gaps early, reducing the risk of a failed real assessment.
00:17:40 --> 00:17:42
What are the steps after the mock assessment?
00:17:43 --> 00:17:53
Finalize the POA&M, ensure all open items have a 180-day plan, hand off to the C3PAO shortlist with warm introductions.
00:17:53 --> 00:17:55
How do we choose a C3PAO?
00:17:56 --> 00:18:04
Look for an authorized C3PAO listed on cyberab.org, confirm they’ve handled similar scopes, and verify their credentialing.
00:18:05 --> 00:18:08
Do we need to engage a C3PAO before the readiness engagement?
00:18:09 --> 00:18:15
It’s best to involve them early, so they can review your SSP and provide realistic feedback on readiness.
00:18:16 --> 00:18:19
And the POA&M-what happens if we miss the 180-day closeout?
00:18:20 --> 00:18:31
You risk penalties under 32 CFR Part 170.21. It can also delay your certification if the C3PAO flags unresolved gaps.
00:18:31 --> 00:18:38
What about the 2026-07-13 pause-does it affect the 2026-11-10 acquisition rule?
00:18:39 --> 00:18:47
The acquisition rule still applies. The pause only delays the Phase II certification deadline, not the requirement to hold a certificate.
00:18:48 --> 00:18:50
So we still need to be ready by the time a contract is awarded?
00:18:51 --> 00:18:57
Yes. You must have a valid Level 2 certificate or be able to demonstrate readiness to the contracting officer.
00:18:58 --> 00:19:00
What if we’re a small business with limited resources?
00:19:01 --> 00:19:10
Focus on enclaving CUI, use a phased remediation plan, and leverage the RPO’s mock assessment to avoid costly surprises.
00:19:10 --> 00:19:14
What if we’re a subcontractor? Do we need to go through the same process?
00:19:15 --> 00:19:26
Yes, if you handle CUI for the prime, you must comply with DFARS 252-7012 and provide a senior official affirmation.
00:19:26 --> 00:19:28
Do we need to report incidents to the prime?
00:19:29 --> 00:19:38
The prime must report incidents to DoD and provide the report number to the next higher tier. Subcontractors must also report directly to DoD.
00:19:38 --> 00:19:44
Let’s recap the key takeaways. First, the Phase II pause-what does that mean for planning?
00:19:45 --> 00:19:51
It gives you more time to remediate gaps but doesn’t eliminate the need for a Level 2 certificate before award.
00:19:51 --> 00:19:57
Second, the self-assessment remains active. And the 180-day POA&M closeout is still required.
00:19:58 --> 00:20:01
Correct. And the 72-hour incident window is unchanged.
00:20:02 --> 00:20:08
Third, the 220 entities in scope-how many of those are actually Level 2?
00:20:09 --> 00:20:17
As of May 2026, 1 Level 2 certificates were issued, but many more are in the pipeline.
00:20:17 --> 00:20:22
Fourth, the mock assessment using CAP is a critical step to avoid surprises.
00:20:22 --> 00:20:28
Yes, it tests evidence readiness and uncovers gaps before the C3PAO assessment.
00:20:29 --> 00:20:41
Fifth, common mistakes: over-scoping, ignoring incident reporting, using unvalidated cryptography, misunderstanding RPO vs C3PAO, neglecting subcontractor flow-downs.
00:20:42 --> 00:20:45
Exactly. Avoiding those saves time and resources.
00:20:45 --> 00:20:55
And the questions we hear most: need for POA&M, difference between FCI and CUI, incident reporting requirements, and how to choose a C3PAO.
00:20:55 --> 00:20:58
Those are the core concerns for most defense contractors.
00:20:58 --> 00:21:01
What’s the next step for a contractor ready to start the journey?
00:21:02 --> 00:21:09
Begin with a discovery and scoping call to map your CUI environment, then schedule a 12-to-14 week readiness engagement.
00:21:10 --> 00:21:11
And after the readiness engagement?
00:21:12 --> 00:21:20
You’ll have a live SSP, POA&M, mock assessment, and a shortlist of authorized C3PAOs ready for the formal assessment.
00:21:21 --> 00:21:22
What about ongoing maintenance?
00:21:22 --> 00:21:30
Quarterly SSP reviews, quarterly POA&M updates, and a three-year reassessment cycle keep you compliant.
00:21:30 --> 00:21:33
Any final thoughts on the pause and its implications?
00:21:33 --> 00:21:40
The pause gives breathing room, but the legal obligations remain. Plan, scope, and execute-don’t wait to react.
00:21:41 --> 00:21:42
Thank you for walking us through all of that.
