42
CMMC Hit Pause, the FAR Council Hit Play
DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.
The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.
62
55
57
57
55
42
42
45
55
30
55
30
57
42
55
42
42
55
55
55
30
55
30
55
42
55
57
42
US Defense Contractors Admit Their Rising CMMC Scores May Not Be Accurate
US defense contractors report rising self-assessed CMMC Phase I scores while doubting the accuracy of those self-evaluations.
Self-assessment scores under the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) Phase I have reportedly reached an all-time high. Contractors themselves doubt whether these self-reported scores accurately reflect their real security maturity. The uncertainty highlights concerns about the reliability of self-assessments in the program's initial phase.
25
42
30
Optiv announces new capabilities to help clients navigate Cybersecurity Maturity Model Certification
50
42
55
42
60
60
60
30