Adam Vincent

Breaking Updates from the August CyberAB Town Hall Colleagues, this month’s CyberAB Town Hall delivered significant updates that will shape the path ahead for CMMC adoption across the Defense Industrial Base. A few highlights stood out: 🔹 Rulemaking Progress: The long-awaited Title 48 rule is under OMB review. While October 1, 2025 has circulated as a possible “go-live” date, DoD clarified that this was a holdover from CMMC 1.0 rulemaking. The official date is still pending, but all indications point to implementation before year’s end. 🔹 Certification Growth: To date, 270 Level 2 certifications have been issued. Nine conditional certifications are in place, and 91 assessments remain in progress. The ecosystem continues to grow: 79 Authorized C3PAOs (with #80 on the horizon) 500+ Certified Assessors (CCA) 351 RPOs supporting organizations with readiness 🔹 False Claims Act Reminder: DOJ announced a $1.75M settlement with AeroTurbine, underscoring the risks of non-compliance with NIST 800-171. The message was clear: self-attestation without implementation is a liability. 🔹 Tier 3 Vetting Changes: All personnel associated with the CMMC ecosystem will now be enrolled in continuous vetting under Trusted Workforce 2.0. Clearance verification letters are no longer accepted—packages must include OF306, Tier 3 nomination, and a resume. 🔹 C3PAO Advisory Council: A new 11-member body was introduced to strengthen assessor consistency, reduce costs for SMBs, and provide authoritative feedback on assessment guidance. 🔹 Events & Engagements: CS5 (October, National Harbor) will feature new contractor roundtables and vertical breakouts for architecture, construction, aerospace, and defense. Notably, Katie Arrington and Stacey Bostjanik are confirmed keynote speakers. Q&A Spotlight The Town Hall wrapped with a robust Q&A session. A few themes worth noting: MSP Certifications: An MSP holding a CMMC Level 2 certification can present this as part of a client’s body of evidence during their own assessment. Beyond DoD: Questions surfaced on whether non-DoD agencies will require CMMC. While no official mandates yet, the proposed FAR CUI rule suggests NIST 800-171 may become the unifying baseline across federal agencies. Guidance Consistency: The new C3PAO Advisory Council will review ambiguous scenarios (e.g., stalled assessments, shared responsibility matrices) and provide recommended guidance to improve consistency in application. Transparency in Vetting: For those in Tier 3 adjudication, timelines remain ~6 months on average, but continuous vetting enrollment will now be mandatory moving forward. ✅ Takeaway: The CMMC program is moving from “anticipated” to “operational.” Ecosystem numbers are climbing, rulemaking is on track, and oversight is tightening. Contractors—large and small—must be ready to demonstrate real compliance, not just paper compliance.

3

𝗧𝗵𝗲 𝗗𝗼𝗗 𝗜𝘀 𝗢𝘃𝗲𝗿𝗵𝗮𝘂𝗹𝗶𝗻𝗴 𝗜𝘁𝘀 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 Last week's RFI from the US Department of Defense marks the beginning of its "blow up" of its current Risk Management Framework (RMF). 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗶𝘀𝘀𝘂𝗲? The RMF (as it stands) is slow, redundant, and overly compliance-driven. It burdens cyber and acquisition teams with overwhelming amounts of paperwork and static checklists, often producing risk outputs that obscure actual mission readiness. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: It's a dated framework built for an obsolete era in which software deployments don't happen weekly and adversaries don't exploit zero-day vulnerabilities at an industrial scale. 𝗪𝗵𝘆 𝗻𝗼𝘄? The operational environment has shifted and is continuing to do so at a dramatic pace. The volume of vulnerabilities is skyrocketing, threat actors are faster and more adaptive and mission systems, especially those built on modern DevSecOps pipelines, require near real-time visibility into cyber risk. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: The current RMF isn't keeping up, and the toll that this is taking has become too much for leadership to bear. 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗽𝗹𝗮𝗻? The DoD is exploring a much-needed streamlined approach with fewer control redundancies, greater automation, and continuous security assessments embedded in the software development lifecycle. Rather than certifying systems and solutions at a single point in time, the new approach would rely on control inheritance, platform security baselines, and threat-informed updates. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: Adopt an assessment approach that's designed from the beginning to reduce overhead and move faster. 𝗧𝗵𝗲 𝗯𝗲𝗻𝗲𝗳𝗶𝘁𝘀? - More timely insights into rapidly evolving cyber risks - Fewer bottlenecks for innovation and implementation - Better alignment between security assurance and operational needs 𝗧𝗵𝗲 𝘂𝗹𝘁𝗶𝗺𝗮𝘁𝗲 𝗴𝗼𝗮𝗹: Help commanders understand how cyber risks could directly impact mission readiness and operational outcomes. 𝗕𝗿𝗼𝗮𝗱𝗲𝗿 𝘀𝗼𝗰𝗶𝗲𝘁𝗮𝗹 𝗶𝗺𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀? This shift isn't only about the DoD. It signals a more widespread truth for any organization that needs to manage cyber risk at scale (so, nearly all entities). Nowadays, we need frameworks and assessment processes that can reflect the swiftly evolving cyber risk landscape. Static approaches won't cut it. Stakeholders need real-time visibility and credible, contextualized quantification that helps them make decisions based on impact. That's the future the DoD is trying to build: an environment where cyber risk is continuously assessed and directly tied to business outcomes. 𝘐𝘵'𝘴 𝘵𝘩𝘦 𝘴𝘢𝘮𝘦 𝘧𝘶𝘵𝘶𝘳𝘦 𝘵𝘩𝘢𝘵 𝘮𝘰𝘥𝘦𝘳𝘯, 𝘰𝘯-𝘥𝘦𝘮𝘢𝘯𝘥 𝘤𝘺𝘣𝘦𝘳 𝘳𝘪𝘴𝘬 𝘱𝘭𝘢𝘵𝘧𝘰𝘳𝘮𝘴 𝘢𝘳𝘦 𝘦𝘯𝘢𝘣𝘭𝘪𝘯𝘨. https://lnkd.in/dGCPWgd6 

27

4 Comments

DISA’s update reinforces a fundamental shift in mobile security. MDM was never designed to stop active threats. That’s why Mobile Threat Defense is now required across federal environments.

53

1 Comment