CMMC After the 60-Day Review: What DOD Decided, What It Didn’t, and What to Do Now

We're in a pool of assorted opinions surrounded by a mist of speculation.

What I think has changed is just Logan's view, is the readiness progression has slowed down due to the ecosystem not understanding what the next steps are.

And, and getting to that end so abruptly.

So I think, I think we're kind of taking a back turn in readiness across the DIB and that has been the only change.

There's been no level of understanding of what's going forward at this point.

And anything that we hear it's it's speculation from a social media post or something that was misinterpreted and then gained tremendous velocity in the wrong direction.

Hmm.

Yeah.

Well, we do know some things, right, Logan? So I think one of the things you're hitting on is the misinformation aspect of myth, rumor.

I once heard on a podcast sort of information that goes around.

But from your perspective, what are the things that we do know that the Department of War has written some things down? I'm sure you're familiar with those.

So what I do know, what I do know is that the requirements have not changed.

That is, that is a solid, steady, it's still written down, right? The requirements to be compliant with NIST 800-171 across the DIB.

If it's, if it's in that contract, whether it was written, you know, well, if it's the 74-7012, it's still a requirement.

Whether or not it's going to be self-assessed, assessed by somebody else.

And then there's other levels, right? There's that level one requirement that hasn't changed, right? Well, and there's even CMMC requirements beyond some of these current requirements.

Right.

Absolutely.

In fact, there's, you know, the suspension only affected partial of that CMMC requirement, just that third-party assessment, and then the level three for the DIP to step in.

And so, again, the self-assessment for level two has not gone away.

The self-assessment for level one has not gone away.

And so, again, a lot of the things that those were, and I guess how I got to the things that have changed, right, the things that we didn't really see much change because those were still in effect day one of the suspension memo being published.

I still think there's a lot of confusion around that, though.

There's a lot of people who are thinking, well, CMMC was suspended.

Well, no, that's not really what happened, right? I just did a, I tried to look back the last 30 days of RFPs.

We're in a pool of assorted opinions surrounded by a mist of speculation.

What I think has changed is just Logan's view, is the readiness progression has slowed down due to the ecosystem not understanding what the next steps are.

And, and getting to that end so abruptly.

So I think, I think we're kind of taking a back turn in readiness across the DIB and that has been the only change.

There's been no level of understanding of what's going forward at this point.

And anything that we hear it's it's speculation from a social media post or something that was misinterpreted and then gained tremendous velocity in the wrong direction.

Hmm.

Yeah.

Well, we do know some things, right, Logan? So I think one of the things you're hitting on is the misinformation aspect of myth, rumor.

I once heard on a podcast sort of information that goes around.

But from your perspective, what are the things that we do know that the Department of War has written some things down? I'm sure you're familiar with those.

So what I do know, what I do know is that the requirements have not changed.

That is, that is a solid, steady, it's still written down, right? The requirements to be compliant with NIST 800-171 across the DIB.

If it's, if it's in that contract, whether it was written, you know, well, if it's the 74-7012, it's still a requirement.

Whether or not it's going to be self-assessed, assessed by somebody else.

And then there's other levels, right? There's that level one requirement that hasn't changed, right? Well, and there's even CMMC requirements beyond some of these current requirements.

Right.

Absolutely.

In fact, there's, you know, the suspension only affected partial of that CMMC requirement, just that third-party assessment, and then the level three for the DIP to step in.

And so, again, the self-assessment for level two has not gone away.

The self-assessment for level one has not gone away.

And so, again, a lot of the things that those were, and I guess how I got to the things that have changed, right, the things that we didn't really see much change because those were still in effect day one of the suspension memo being published.

I still think there's a lot of confusion around that, though.

There's a lot of people who are thinking, well, CMMC was suspended.

Well, no, that's not really what happened, right? I just did a, I tried to look back the last 30 days of RFPs.