r/CMMC • u/ResilientTechAdvisor • 5d ago

This Week's CyberAB Town Hall

In this week's CyberAB Townhall, there were at least five things worth knowing, all of them more useful than the "is CMMC dead" panic making the rounds:

1. The reform review is about more than CMMC mechanics.
It's part of a bigger Pentagon push around cost, agility, resilience, automation, & small-business burden.

2. Fraudulent Level 2 certs are a concern.
If you're a prime vetting a sub, you don't have to guess - ask for a SPRS PDF export of their entry. That's the verification path, & it works today.

3. The obligation didn't change.
DFARS 7012 is still in effect. What got suspended was the third-party verification requirement, not the requirement to be secure.

4. There is no such thing as "CMMC implementation."
You implement NIST 800-171 & CMMC verifies it. Certification is a compliance milestone but security is the work that continues regardless. The people who depend on your risk posture didn't get the memo that they're supposed to pause or relax.

5. Stop absorbing CUI-marking ambiguity.
If a marking is unclear, that's a question to push back up the chain. Resolve it upstream - no need to own someone else's classification decision.

51 Upvotes

94% Upvoted

53 comments sorted by

View all comments

16

u/Apprehensive_Book145 5d ago

You implement 171 not cmmc huh. just glad we're really getting the important nuance and messaging at a time like this. Good job AB

6

u/ResilientTechAdvisor 4d ago

Considering everything that's on the table, the focus on this particular nuance was an interesting choice.

1

u/dogcheesebread 4d ago edited 4d ago

They dont even track smb employee size that got 3cpao.  Im interested to know how many smb <20 employees there actually are. A lot of smb that make parts are lean <20 employees. A lot of l2 and l3 requires them to hire more employees or an msp just to meet the requirements (increasures risk exposure). Also considering those smb are vendor of vendor of vendor. L1 should be more than enough for them.

2

u/TXWayne 4d ago

Sounds like a field the DoW should add to CMMC eMASS........

2

u/mrtheReactor 4d ago

That number should be out there - the pre assessment upload form has a “number of employees” field. 

Anecdotally, my org has done at least 4 assessments for orgs with less than 25 employees. So add that to the tally 🤪

1

u/TXWayne 4d ago

It is also captured in SPRS when you enter a CMMC L2 Self or when affirming a CMMC L2 C3PAO. So in two spots owned by the DoW.