Advertise on podcast: CUI Hotline: Live CMMC Q&A

NDIA data shows that 30% - 40% of defense contractors have no FTEs working on IT/security.Despite the ongoing CMMC Program Review, there simply isn't a way that the government can rewrite cyber requirements such that a company with zero staff would suddenly understand what needs to get done.ITAR? NIST? DFARS? PQC? MFA? CMMC?People need more help than the government is willing or capable of providing.That's why we go live every Friday at 10am PST.All questions welcome.

Over the course 100 livestreams we have answered thousands of questions about everything from CMMC to DFARS to ITAR to NIST.Scoping, configuration, policy predictions, you name it.During that time it's been hard not to notice the bigger picture:- On the one hand the DoD is taking their sweet time to let contractors know what the plan is for cyber requirements moving forward. - On the other, the DoD is also the first one who will decide to cut off your work when you don't meet requirements.- Meanwhile, the number of official DoD resources to help people understand, implement, and verify all of the cyber requirements other than CMMC remains at zero."Hurry up and wait" for CMMC updates doesn't help anyone meet their existing requirements and that's pretty unfair.That's why our weekly livestream is free every Friday.

The recent rumor of a change in CMMC policy to include an extension to 2028 is another reason why you should like, subscribe, and tune in every Friday for the CUI Hotline.There hasn't been any extension. Unfortunately, people are unaware of what the CMMC regulation has said since September 2025.Discovering that information for the first time while looking for updates regarding the Phase 2 suspension causes a lot of confidently incorrect takes everywhere from social media to marketing campaigns to actual reporting in industry publications.Bad information makes it hard to plan and strategize.That's why we host a livestream every Friday at 1pm EST.NIST, DFARS, CMMC, ITAR, FedRAMP, policy, technical, you name it.Don't let bad information put you on the wrong path.

Between now and the end of the year defense contractors will need to wrestle with at least 3 major cyber regulation updates:CIRCIA: a new cyber incident reporting regime for many defense contractors that is broader than DFARS 252.204-7012, with different triggers, report contents, system scope, ransomware requirements, supplemental reporting, and two-year data preservation.The FAR CUI rule: government-wide contractual requirements for CUI protection including NIST SP 800-171 rev. 3, SP 800-172, cloud, subcontractor flowdowns and more.Post-Review CMMC: the "3.0" rule expected in July contained a transition plan from 171r2 to 171r3 and claimed to affect 20% fewer companies. The DoD has suspended that transition in lieu of a program review and signaled a general desire to increase requirements.If you extend the timeline further, defense contractors will also need to wrestle with DFARS 7012 (3.0) and Post-Quantum Crypto rulemaking.Have questions about any of that? We sit down every Friday at 10am PST to answer them all.

Not so long ago people started asking what we would talk about after CMMC rulemaking was done.Looking ahead, there are more and larger questions than there ever were before:- How will the DoD handle a discrepancy between the FAR and DFARS requiring different NIST SP 800-171 baselines for the same data on the same contractor systems?The department specifically avoided this problem in 2024 only to reintroduce it as a very real puzzle for contractors with the Phase 2 suspension.- How will the DoD explain scoping for their future requirements? The department has spent the last month and a half saying that CUI-centric requirements "don't go far enough" and that OT security is desperately needed.But most important of all: how should contractors navigate this mess to protect themselves and get back to business?That's why we sit down every Friday to answer your questions live.10 am PST / 1 pm EST.

Safe to say the CMMC Review RFI responses have converged on one major topic:CUI marking and identification.The problem: Neither the DoD CIO nor the CMMC program controls CUI governance inside the Department.In fact, many of the issues raised in the RFI responses are outside the scope of the CMMC program and its ability to fix them.Whatever comes out of the program review, it's unlikely that the biggest issues will be resolved.Which means people are going to have a lot of questions about what to do next.That's why we host the CMMC Hotline every Friday.Live Q&A. 10am PT / 1pm ET.

July 2026 marks the 9th month in a row where most CMMC assessment capacity went completely unused. Conservatively, the CMMC ecosystem was able to support at least 432 Level 2 assessments in July. 207 companies achieved CMMC Level 2 status.The DoD says they suspended CMMC Phase 2 because there isn't enough assessment capacity.Meanwhile, Congress has language in the upcoming NDAA urging DoD to increase the number of assessors.Assessment capacity isn't the problem. Never has been. Implementation and compliance with DFARS 252.204-7012 is the problem.That's why we do a live Q&A every Friday.NIST, DFARS, ITAR, FedRAMP. Those are the hurdles you need to deal with long before your assessment. The number of assessors is the least of people's problems.The upcoming re-launch of assessments is what people should be preparing for.

Thanks to technical difficulties we had to re-post the stream link. Sorry about that!

Can't make it to BlackHat for the CMMC listening session? Join us on Friday for the CMMC Hotline.We answer your toughest questions about CMMC, NIST SP 800-171, FedRAMP, and the latest developments impacting the Defense Industrial Base. No sales pitch. Just practical guidance and live Q&A with the community.

We're back from CS5 so this week we'll be stepping through a ton of questions we got from the event and, like always, anything that comes up during the livestream.

The Summit 7 Compliance Team has helped more than 90 companies achieve CMMC Level 2 certification.This week on a special edition of the hotline you'll get a chance to ask them anything.- Best indicators of success?- Craziest thing to ever come out of an assessor's mouth?- Pineapple on pizza?See you Friday at 1pm EST.

There are no deadlines in the CMMC Phased Roll-out."When do I need CMMC?" depends entirely on your customer and the data you'll be handling.NAVFAC SW says November 2026.PCS JTF says Spring 2027.Some SOCOM support contracts say you don't need to achieve status until six months *after* award.That's blatantly against policy, but the DoD isn't a monolith.It all depends on your specific situation.If you have questions about your specific situation, come hang out with us Fridays at 10am PST when we answer your questions live.

Just because something sounds like it should be CUI doesn't make it so.Unclassified data is only controlled if a law, regulation, or government-wide policy specifically says that data must be, well, controlled.Sometimes there are dozens of "authorities" related to the same type of data so the CUI Registry summarizes and describes each category very broadly.Even though those descriptions might talk about "vulnerability information" in general, the summary doesn't make all vulnerability information controlled.You have to read the specific details of the laws and regulations to know what's what.It's tedious, but it can save you a ton of time and money when you find out that your customer is just being lazy and only reading category descriptions.We answer CUI questions on the hotline every week.Come hang out.

If you think November 2026 is the deadline for every defense contractor to achieve CMMC Level 2, then the weekly CUI hotline is for you.November could be the deadline depending on your specific customer.November isn't the deadline based on any general policy from the department of defense.For a lot of people who have already received CMMC status level requirements, they wish they another 7+ months.There are a lot of variables at play and we sit down every week to answer questions about all of them (live!)

The CUI Hotline continues this Friday at 10am EST.Questions about DFARS cyber requirements? NIST? CMMC? We sit down for an hour every week and answer your questions live!