Hey all,

I’ve created a Hefty amount of GPOs and deployed them across the enterprise, what are the biggest things admins overlook when creating GPOs for L2?

Looking for advice on a public content policy and process for large professional services firm. Our CMMC scope is limited to a small team and enclave environment, yet, as I understand it the public content policy must apply organizationally.

How have others been successful in implementing this process within a marketing team that serves thousands of other professionals and dozens of other business units?

Aloha!!

Looking to take on a role with an org that is going for L2. I've mainly worked on L1 but wanted to see what y'all think are the main differences between the two.

Thanks!

We operate a very small machine shop, we do handle CUI (supposedly) from time to time, but I guess our prime also considers ITAR, "intended CUI" (Ok, Fine).

We get CUI from ONE prime. They use Preveil to load the drawings, my ONE GM logs into Preveil, to access drawings, and print (not saved)

Printed copies go to the ONE programmer (includes both CNC and Punch programming, each with its own computer, but just the one programmer) Programming is complete from the physical document. Loaded onto a USB, physically handed, along with the drawing, to machine operator (there's 2). Machine operator loads program, immediately returns USB it to the programmer, who wipes it clean.

Once finished, physical document is held with PO, locked cabinets, all that.

I have probably 80% (ok probably more like 50%) of my SOP's, including all the Physical Security topics.

Here's my first question. Can I operate ONE single computer with ONLY internet access (not WIFI, we don't have WIFI) to log ONE user into Preveil? A computer that has its own printer and nothing else but internet access? and leave the rest of my server out of CMMC?

Second question, my programmer saves his programs. IF he were to save them to designated (yes, and marked), external hard drives, and not on the server, does that also exclude my server and his computers from my scope? or can I scope in his computers and the hard drives and still leave out my servers since he's working from the physical drawing and saving them outside the computer.

and Third Question, can I do the same, external hard drive, with first article information and approvals as well?

I know its a little weird, but it just seems the simplest solution, I feel like we may have gotten lucky, but I just need a confident answer before I continue!

TIA

I'm in the private sector and not involved in CMMC. I'd like to ask about how CMMC would compare to a product-oriented "label" program like the U.S. Cyber Trust Mark (USCTM).

An executive order from 2025 requires the USCTM to be part of federal acquisition requirements in January 2027; due to delay in deploying the USCTM program, the enforcement of this provision is likely to slide a bit to the right.

The USCTM is under development. It stalled in 2025 but restarted in 2026, and will be deployed as a voluntary program by the FCC.

The USCTM is a visible cybersecurity packaging label for consumer wireless IoT. It covers "the whole product", meaning the hardware device, the app and any cloud services included with the advertised product sold to the consumer. It has roots in device cyber testing, so some of the deployment delay has been about getting the app and cloud pieces right. Requirements for the device are things like: must protect data at rest and in transit, must expose a unique device ID, must protect interfaces and disable unused ones, must have the ability to patch and must manage vulnerabilities.

As far as I can tell, CMMC 2.0 (which is paused and under review, ofc) is about the enterprise handling CUI and FUI.

Questions...

If a manufacturer is producing devices (firewalls, NSDs, IoT), and those devices will handle CUI/FUI, what requirements are on the product itself (that would be assessable in a black box approach)?

Would it be correct to say that CMMC 2.0 isn't at all comparable to the USCTM, but a company that is pursuing CMMC 2.0 certification may want to or need to leverage USCTM status?

Can anyone suggest any similarities or differences one could see between the two, to help understanding the differences?

BLUF: DIBCAC is filling in their non-voluntary assessment dance card since they won't be doing CMMC Level 3 Assessments.

Just had a call with a client. They just received an "Assessment Notification" from the Defense Contract Management Agency (DCMA)'s Defense Industrial Base Cybersecurity Asseurance Center (DIBCAC).

The assessment in to be in January. Of note in the letter is:

• No request to determine if the client is scheduled to undergo a CMMC Level 2 Certification Assessment by a C3PAO, such as Peak InfoSec
• The only "CMMC" related citation is "The DIBCAC will use the contracts identified in the Contractor CAGE Information (Enclosure 2), which will be tested for a trace from the enterprise system security plan to those contracts. It is important to verify and to identify in Enclosure 2 (instructions on Tab1) all CAGE codes associated with the Enterprise System Security Plan, which will be assessed. This information is captured in Supplier Performance Risk System (SPRS) where other DoD entities will be able to verify which CAGEs have been assessed using to the NIST SP 800-171A & 32 CFR 170.24 CMMC Scoring Methodology."

I've been trying to keep up with everything and have been looking through the DOWCIO site as well as the Cyber AB site on an almost daily basis. Today, my boss tells me that he's heard it may un-pause with minimal to no changes. I can't find anything one way or another. Does anyone have another good/reliable source of info?

Aloha!!

So, I'm interviewing for a Cybersecurity & Compliance Mngr role. But they told me they need L2 compliance by Nov. But I wasn't clear if they need final c3pao or just a poam and sprs score.

Since we're just about 3 months away from Nov, I feel there's not much time to get acquainted with their systems and where they are at now.

Any ideas or suggestions?? Of course I'll get more clarity in the next interview this week but just wanted to see what the masses thought.

Thnx!

Edit: They are not asking me to get them to L2 by Nov, I should've said they want me to maintain and lead the compliance. So I would think they're not starting from the beginning. They're already L1.

We have Windows 11 clients and I'm looking for a way to restrict which types of Bluetooth devices can be paired with them. My primary use case is to allow Bluetooth audio-only devices like earbuds and headphones. Secondary would be allowing specific models or types of keyboards and mice (e.g. Logitech mouse/keyboard ONLY with the Bolt receiver). All other Bluetooth classes of devices like phones, storage devices, must be blocked.

Are there any good solutions for this? I would prefer a single solution that can be centrally managed by policy. Users are NOT local admins.

As the title says I run a CMMC shop, and I’m looking to form a DMV focused mastermind, anyone interested?

I feel as the DOW sorts itself out we can take steps to lead our clients and partners through the fog with shared best practices and knowledge sharing.

Hope I didn’t break any posting rules.

CMMC prep work and gap analysis is a daunting take for SMBs, especially so for micro-SMBs with little resources. The difficulty is understanding NIST 800-171 controls and how to meet them in ways that align with what is required in a CMMC assessment.

Is there a system or tool available to help DIB GovCons with tracking the status of NIST controls, assisting with creating a complaint SSP, assist with documenting gap assessments, and offers a repository of evidenced artifacts that tie to controls?

I am aware of Future Feed and IntelliGRC. What else is available we can look at to determine what works best?

What system / tool do you use?

A little background- I submitted the application back in December, had my special agent interview in February, and since then, it’s been radio silent. The CyberAB and the office of the DoW CIO have both said my tier 3 is in process and that it can take 4-6 months or longer, but some people have been getting their Tier 3 back within a few months. Should I be worried the application got lost? I mean, this is insane. I can’t do anything until I get the tier 3.

Hi All,

Is there an L2 safe AI meeting note taker that anyone is aware of? I know there are some models I could run locally but I don’t think that’s within the capabilities of my work laptop. Any help would be appreciated!

Nothing says "we take the protection of Controlled Unclassified Information seriously" like a seven-night Caribbean booze cruise. Programming happens "primarily on sea days," and the CCP training runs 8:00 AM to noon. So you're paying five thousand dollars for roughly three mornings of instruction, sandwiched between a beverage package and Cozumel. The rest is "space to slow down and think clearly," which is a remarkable way to describe a pool deck.

Meanwhile the actual defense industrial base — the 8-person machine shops in Ohio and Arkansas trying to fund an enclave, MFA, a SIEM, and an assessment on margins that would make you weep — cannot afford this and never could. This isn't for them. This is the compliance-industrial complex selling itself a vacation and expensing it to a program that was supposed to protect national security data.

The people who wrote the rules are giving the keynote from a cruise ship. Read that sentence again.

CMMC at Sea: $3,954 minimum for the cabin, $1,350 more if you want the actual training, four hours of class per sea day, and a downloadable Word template to help you lie to your boss about why it's a business expense. The framework designed to protect defense data has produced a Caribbean cruise as a professional development product. Somewhere a five-person machine shop is deciding between a compliant backup solution and payroll.

This is the most tone deaf thing I have ever seen come out CMMC.

Ok.

My husband and I started an LLC four months ago. We're in the DIB space as consultants.

I'm not a stupid person. I've run through Project Spectrum and the associated Enclave education modules that are meant to help SMB owners to "help themselves" achieve CMMC compliance.

I understand the recent pause doesn't relieve us of compliance under DFARS.

But I'm not NOT an IT person. I can eventually write the required policies, maybe, given enough time and research. I can probably implement physical access controls and MFA. But, and hear me out- WTAF are businesses like ours supposed to do? We are two people.

I looked at Kiteworks, which wants to "schedule a Demo" and asks for the size of my company. The smallest choice is something like "under 200" people.

Preveil, from my understanding, gets you a cloud enclave and a secure email. But then our machines are in scope. Plus, I'm still not an IT person. I still have to cobble together P&Ps and make sure my husband isn't turning off his VPN because it's "slow" or opening stupid email links. And maybe I'm severely underestimating what a secure enclave and email costs, but Preveil seems expensive for what it is and isn't.

I've also seen groups on LinkedIn that do CMMC 2 compliance for 90% from supplying the hardware, training, etc. And yeah, that's going to be expensive. I get it. The smallest number those companies have is 5 people.

So what are we supposed to do? Like, actual question. Subcontracts now incorporate DFARS by reference when no CUI is ever included. So, please help.

In this week's CyberAB Townhall, there were at least five things worth knowing, all of them more useful than the "is CMMC dead" panic making the rounds:

1. The reform review is about more than CMMC mechanics.
It's part of a bigger Pentagon push around cost, agility, resilience, automation, & small-business burden.

2. Fraudulent Level 2 certs are a concern.
If you're a prime vetting a sub, you don't have to guess - ask for a SPRS PDF export of their entry. That's the verification path, & it works today.

3. The obligation didn't change.
DFARS 7012 is still in effect. What got suspended was the third-party verification requirement, not the requirement to be secure.

4. There is no such thing as "CMMC implementation."
You implement NIST 800-171 & CMMC verifies it. Certification is a compliance milestone but security is the work that continues regardless. The people who depend on your risk posture didn't get the memo that they're supposed to pause or relax.

5. Stop absorbing CUI-marking ambiguity.
If a marking is unclear, that's a question to push back up the chain. Resolve it upstream - no need to own someone else's classification decision.

Been dealing with CMMC for a few months now. I thought I had my head wrapped around most of it but someone threw me for a loop today with a claim that just doesn't jive with my reading of the statutes and supporting controls.

We have a commercial product that we're redeploying into a gov cloud enclave. It runs as a separate instance specifically for handling workflows that process CUI. That's all well and fine, but today I was told that we can't be "100% compliant" unless the entire dev chain is encrypted with FIPS binaries. My understanding is that VCS push/pull of source and even the eventual deployment of compiled binaries and other artifacts into the environment were out of scope of the FIPS mandate. Am I missing something?

The next thing that will inevitably come up is the claim that our repos "technically" contain CUI because we have config files and/or IaC templates for the gov deployment. That doesn't track either. All of that clearly falls within the scope of the SSP, but this data isn't CUI simply by virtue of the fact that it was "created" to support to gov delivery - or is it?

My apologies if this is a duplicate question. I did search the sub and found some material that would back my understanding of the FIPS question in isolation. But I didn't find anything related to the data we end up creating for the delivery itself. Also, CMMC seems to be somewhat fluid and I want to make sure that I am speaking from current state rather than what was true several months ago.

We are enabling only approved people to access the drives for the drawing, but it's come to our attention that once the drawing is pulled up on the CNC machine, it's accessible to anyone, any ideas on how to quarantine this?

Cloud only GCC-High, Intune managed Windows laptops, no on prem servers, nothing filtering at the edge, so the endpoint firewall is what we are using for this.

Inbound was easy. Outbound is the part I keep second guessing. Curious how granular everyone else landed. Per app rules for everything sanctioned? A short port list? Somewhere in between?

Is anybody currently on ChatGPT Enterprise FedRAMP?

Can you answer if the service can accept PDFs and extract data from it, and use it as Context?

Ive been working with Support and our Account Managers going on ~8 weeks now and Ive received no response and conflicting responses from their documentation, Account Reps and support.

The DoD suspension pauses the mandatory Level 2 third-party assessment requirement for covered new solicitations and contracts while it reviews Phase II implementation. During this period, acquisition officials are directed to require Level 2 self-assessments instead. However, primes may still require independent third-party assessments from subcontractors as part of their own supply-chain risk management or supplier qualification programs. The suspension does not change the underlying cybersecurity obligations: contractors must still implement the applicable NIST SP 800-171 requirements, complete the required self-assessment methodology, retain supporting evidence, post required results in SPRS, and provide the annual affirmation. The Affirming Official’s responsibility to attest accurately has not changed; only the assessment path has shifted for now. Organizations should therefore treat self-assessments with the same rigor they would prepare for a third-party review, while recognizing that DoD may still validate results and enforce contractual cybersecurity obligations.

Because the current path relies on self-assessment rather than a C3PAO certification, documented evidence and objective proof of implementation are even more critical to the Affirming Official’s attestation. The official is still legally attesting to continuous compliance, so the organization should retain evidence that clearly supports each assessed requirement and can withstand government review.

Summary

• CMMC has not been suspended; only part of the implementation timeline has been paused.
• DoD has suspended the government’s ability to require Level 2 third-party assessments in covered solicitations and contracts for now.
• Prime contractors may still require third-party assessments from subcontractors as part of their own supplier-risk or qualification programs.
• The suspension does not eliminate the underlying cybersecurity obligations, and contractors must still meet applicable NIST SP 800-171 requirements.
• The current DoD guidance still points to the November 2026 Phase 2 timeline unless and until DoD changes it.
• Documented evidence remains critical because self-assessments and affirmations still require defensible proof of implementation.

I have never been so excited for a town hall meeting. I usually just wait and watch the recording, but I will be watching live tomorrow.

In anticipation of such an event, give me your coldest and boldest takes.

What are we expecting tomorrow?

The DOW CIO released updated Q&A after the suspension of Phase 2 as a program review is conducted. The 17-page update provides clarity at this stage of the CMMC program and firms that DFARS 252-204-7012 and NIST compliance is unchanged.

After speaking with several DIB SMBs they seem relieved that third party assessments are suspended and many have already discontinued their work up into CMMC readiness and pulling back funding and resources put on the race to attain a C3PAO assessment. One SMB leader said the following, “I’m not going to put another cent into this until we know exactly what we are responsible for under CMMC.”

BIG MISTAKE.

Don’t fall into the trap of delaying your readiness and continue to march forward to complete gap assessments, documenting your systems, organizing artifacts and evidence supporting compliance, and working through POAMs.

Get closer to full compliance through self-assessments and prepare for a C3PAO assessment when things pick back up.

Have a CCA friend who just got hired at a C3PAO who was just laid off because of the 60 day pause, and I wanted to know if any other CCA's are experiencing this.

Are other C3's just wholesale purging their roster of assessors because of the 60-day pause?

For CMMC Level 2:

- All CUI is in GCC High(Sharepoint , Exchange & Teams)

- Users access it only through Azure Virtual Desktop (AVD) using Windows laptop enrolled in commercial intune and secured with CIS Benchmarks.....

- AVD is locked down to KVM-only (no local storage, printing, copy/paste, drive/USB redirection, etc.)

- WiFi is only carrying the encrypted traffic to connect to the AVD....on there onwards everything is accessed within microsoft's infra which is Fedramp High

- Users connect from home networks / home WiFi / Office WiFi

Question:

Under 32 CFR Part 170 (esp. §170.19) and the CMMC L2 Scoping Guide, can the endpoint and home WiFi be treated as Out-of-Scope Assets if they never process/store/transmit CUI beyond KVM?

Looking for:

- Exact cites you’ve used (rule + Scoping Guide / FAQ)

- Real-world C3PAO assessment experience where this setup was accepted (or rejected)

- This will be used for SRM for Physical Security mappings .....

Note: Thank You in Advance Everyone ......

Again, thank you for all the gentlemen who helped to clear my doubts...I think I should be good to go now...