Advertise on podcast: CUI Hotline: Live CMMC Q&A

The FAR CUI rule will require federal contractors to implement NIST SP 800-171 rev. 3Want to know how to scope those requirements to reduce cost, burden, and impact?This is all you get: "The security requirements [...] are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components."Specialized Assets? Security Protection Assets?Contractor Risk Managed Assets? Those are CMMC categories that NIST has nothing to do with.Will agencies reciprocate scoping guidance that DoD spent years developing in collaboration with industry?Will the DoD even keep the scoping guidance that provides some of the most effective ways to reduce cost and burden?How should you strategize moving forward when you have federal and defense customers with different NIST baselines and different scoping interpretations for the same data types?Tune in every Friday at 10am PST when we answer questions just like this.

New reporting from Federal News Network shows that the average cost of a CMMC assessment is $47k.A far cry from the hundreds of thousands of dollars people claimed and used to justify the suspension of Phase 2.Over more than 100 weekly Hotlines we have addressed the cost of assessment and implementation (and the difference) every other week on average.We've helped nearly 150 companies pass CMMC Level 2 third-party assessments.$47k lines up with everything we've seen on the ground.We put out the facts for free every Friday at 10am PST.See you then.

Despite popular belief there was never, ever a DoD policy that said November 2026 was a deadline for achieving CMMC Level 2 certification.That's not what the 32 CFR CMMC final rule said.That's not what the 48 CFR CMMC final rule said.There's no DoD memo to the contract workforce creating that deadline.DoD policy was always that November 2026 was when they would BEGIN inserting CMMC Level 2 cert requirements into NEW solicitations.The mega primes took that policy and told everyone in their supply chains to achieve Level 2 status by November 2026.That behavior is outside of the DoD's control.So when the DoD inevitably restarts the CMMC program, what lever will they have to prevent the same thing from happening again? Change the policy to say that Level 2 certs will begin showing up in November 2027?Primes will convert it into a "deadline" despite department policy.Contractors who understand the bigger know that this extra time to prepare is a gift.That's why we go live every Friday to answer your questions: technical, policy, NIST, CMMC, ITAR, you name it.

NDIA data shows that 30% - 40% of defense contractors have no FTEs working on IT/security.Despite the ongoing CMMC Program Review, there simply isn't a way that the government can rewrite cyber requirements such that a company with zero staff would suddenly understand what needs to get done.ITAR? NIST? DFARS? PQC? MFA? CMMC?People need more help than the government is willing or capable of providing.That's why we go live every Friday at 10am PST.All questions welcome.

Over the course 100 livestreams we have answered thousands of questions about everything from CMMC to DFARS to ITAR to NIST.Scoping, configuration, policy predictions, you name it.During that time it's been hard not to notice the bigger picture:- On the one hand the DoD is taking their sweet time to let contractors know what the plan is for cyber requirements moving forward. - On the other, the DoD is also the first one who will decide to cut off your work when you don't meet requirements.- Meanwhile, the number of official DoD resources to help people understand, implement, and verify all of the cyber requirements other than CMMC remains at zero."Hurry up and wait" for CMMC updates doesn't help anyone meet their existing requirements and that's pretty unfair.That's why our weekly livestream is free every Friday.

The recent rumor of a change in CMMC policy to include an extension to 2028 is another reason why you should like, subscribe, and tune in every Friday for the CUI Hotline.There hasn't been any extension. Unfortunately, people are unaware of what the CMMC regulation has said since September 2025.Discovering that information for the first time while looking for updates regarding the Phase 2 suspension causes a lot of confidently incorrect takes everywhere from social media to marketing campaigns to actual reporting in industry publications.Bad information makes it hard to plan and strategize.That's why we host a livestream every Friday at 1pm EST.NIST, DFARS, CMMC, ITAR, FedRAMP, policy, technical, you name it.Don't let bad information put you on the wrong path.

Between now and the end of the year defense contractors will need to wrestle with at least 3 major cyber regulation updates:CIRCIA: a new cyber incident reporting regime for many defense contractors that is broader than DFARS 252.204-7012, with different triggers, report contents, system scope, ransomware requirements, supplemental reporting, and two-year data preservation.The FAR CUI rule: government-wide contractual requirements for CUI protection including NIST SP 800-171 rev. 3, SP 800-172, cloud, subcontractor flowdowns and more.Post-Review CMMC: the "3.0" rule expected in July contained a transition plan from 171r2 to 171r3 and claimed to affect 20% fewer companies. The DoD has suspended that transition in lieu of a program review and signaled a general desire to increase requirements.If you extend the timeline further, defense contractors will also need to wrestle with DFARS 7012 (3.0) and Post-Quantum Crypto rulemaking.Have questions about any of that? We sit down every Friday at 10am PST to answer them all.

Not so long ago people started asking what we would talk about after CMMC rulemaking was done.Looking ahead, there are more and larger questions than there ever were before:- How will the DoD handle a discrepancy between the FAR and DFARS requiring different NIST SP 800-171 baselines for the same data on the same contractor systems?The department specifically avoided this problem in 2024 only to reintroduce it as a very real puzzle for contractors with the Phase 2 suspension.- How will the DoD explain scoping for their future requirements? The department has spent the last month and a half saying that CUI-centric requirements "don't go far enough" and that OT security is desperately needed.But most important of all: how should contractors navigate this mess to protect themselves and get back to business?That's why we sit down every Friday to answer your questions live.10 am PST / 1 pm EST.

Safe to say the CMMC Review RFI responses have converged on one major topic:CUI marking and identification.The problem: Neither the DoD CIO nor the CMMC program controls CUI governance inside the Department.In fact, many of the issues raised in the RFI responses are outside the scope of the CMMC program and its ability to fix them.Whatever comes out of the program review, it's unlikely that the biggest issues will be resolved.Which means people are going to have a lot of questions about what to do next.That's why we host the CMMC Hotline every Friday.Live Q&A. 10am PT / 1pm ET.

July 2026 marks the 9th month in a row where most CMMC assessment capacity went completely unused. Conservatively, the CMMC ecosystem was able to support at least 432 Level 2 assessments in July. 207 companies achieved CMMC Level 2 status.The DoD says they suspended CMMC Phase 2 because there isn't enough assessment capacity.Meanwhile, Congress has language in the upcoming NDAA urging DoD to increase the number of assessors.Assessment capacity isn't the problem. Never has been. Implementation and compliance with DFARS 252.204-7012 is the problem.That's why we do a live Q&A every Friday.NIST, DFARS, ITAR, FedRAMP. Those are the hurdles you need to deal with long before your assessment. The number of assessors is the least of people's problems.The upcoming re-launch of assessments is what people should be preparing for.

Thanks to technical difficulties we had to re-post the stream link. Sorry about that!

Can't make it to BlackHat for the CMMC listening session? Join us on Friday for the CMMC Hotline.We answer your toughest questions about CMMC, NIST SP 800-171, FedRAMP, and the latest developments impacting the Defense Industrial Base. No sales pitch. Just practical guidance and live Q&A with the community.

We're back from CS5 so this week we'll be stepping through a ton of questions we got from the event and, like always, anything that comes up during the livestream.

The Summit 7 Compliance Team has helped more than 90 companies achieve CMMC Level 2 certification.This week on a special edition of the hotline you'll get a chance to ask them anything.- Best indicators of success?- Craziest thing to ever come out of an assessor's mouth?- Pineapple on pizza?See you Friday at 1pm EST.

There are no deadlines in the CMMC Phased Roll-out."When do I need CMMC?" depends entirely on your customer and the data you'll be handling.NAVFAC SW says November 2026.PCS JTF says Spring 2027.Some SOCOM support contracts say you don't need to achieve status until six months *after* award.That's blatantly against policy, but the DoD isn't a monolith.It all depends on your specific situation.If you have questions about your specific situation, come hang out with us Fridays at 10am PST when we answer your questions live.