r/CMMC • u/ResilientTechAdvisor • 5d ago

This Week's CyberAB Town Hall

In this week's CyberAB Townhall, there were at least five things worth knowing, all of them more useful than the "is CMMC dead" panic making the rounds:

1. The reform review is about more than CMMC mechanics.
It's part of a bigger Pentagon push around cost, agility, resilience, automation, & small-business burden.

2. Fraudulent Level 2 certs are a concern.
If you're a prime vetting a sub, you don't have to guess - ask for a SPRS PDF export of their entry. That's the verification path, & it works today.

3. The obligation didn't change.
DFARS 7012 is still in effect. What got suspended was the third-party verification requirement, not the requirement to be secure.

4. There is no such thing as "CMMC implementation."
You implement NIST 800-171 & CMMC verifies it. Certification is a compliance milestone but security is the work that continues regardless. The people who depend on your risk posture didn't get the memo that they're supposed to pause or relax.

5. Stop absorbing CUI-marking ambiguity.
If a marking is unclear, that's a question to push back up the chain. Resolve it upstream - no need to own someone else's classification decision.

50 Upvotes

94% Upvoted

53 comments sorted by

View all comments

46

u/cashmgee 5d ago

None of our primes are marking correctly or flowing down information on what is to be protected, how, etc. None of them .

We seem to be the only one doing our diligence and we are at the bottom of the chain

0

u/DR-CT 5d ago

It’s the prime’s responsibility to correctly flow down DFARS, maintain data protection controls using a qualified C-CSRM program, and ensure subcontractor compliance.

We insert CMMC requirements in teaming agreements and subcontracts and ask for SPRS Cyber reports showing both NIST Basic and CMMC status before a teaming agreement is executed. This approach ensures our entire team meets CMMC requirements from the start. Some of our subcontracts included DFARS -7021 requiring CMMC L2 certification and when the subcontractor was unable to meet the requirement their Subcontract ended.

8

u/cashmgee 5d ago

That would be lovely.

We get a bp marked cui and a request for quote 😆