Good Afternoon. In four weeks, November 10 will arrive. This was supposed to be the start date for CMMC Phase 2 third-party certification, and compliance teams have spent two years and significant resources getting ready.
But nothing will happen on that date. The task force report that should explain the next steps has been unpublished for a month, while the actual rules were released on September 3 with little attention.
Was this email forwarded to you? Sign up here
🎯 THE SIGNAL
The CMMC Reform Task Force gave its recommendations to DoW CIO Kirsten Davies around September 11, meeting its 60-day deadline. A month later, the report is still unpublished, and the department’s CMMC page still shows Phase 2 as suspended. At the Billington summit on September 9, Davies said that over half of the 1,100-plus RFI comments supported the suspension. She also suggested moving away from one-time certification toward ongoing monitoring and clearer CUI marking. The Cyber AB said at its September town hall that it does not have any inside information about the recommendations.
While everyone is waiting for the report, the binding document has already been released. Class Deviation 2026-O0025 Revision 3, issued on September 3, made the pause official by moving it from a memo into acquisition regulation. Now, contracting officers must remove third-party CMMC requirements from solicitations and update existing contracts at the next option exercise or administrative change. Levels 1 and 2 can be met through self-assessment.
NIST SP 800-171 still applies under DFARS 252.204-7012, and a new clause, DFARS 252.240-7997, keeps the government’s right to run its own Medium and High assessments on your systems, with results posted to SPRS.
There is a common misunderstanding that needs to be cleared up. The 71-page deviation repeats a November 10, 2028 date, which many in the industry have mistaken for the new CMMC deadline. This is actually the original Phase 4 date from the 2024 rule and has not changed. Nothing has been rescheduled because the new framework does not exist yet.
With certification on hold, your self-attested SPRS score is now the only form of verification, and that is where the risk is focused. The Justice Department settled two cybersecurity False Claims Act cases during this pause. LOGZONE paid $507,144 in June after posting a perfect self-assessment score of 110 to SPRS in 2021 for Navy contract work, but a DIBCAC assessment later found their score should have been negative 170.
Honeywell Aerospace paid $2,042,518 on September 1 over NIST 800-171 compliance on a single network. That case began with a 2022 whistleblower complaint and did not involve any alleged breach. Both settlements resolved allegations, not final determinations, but they send the same message to anyone with an inflated score.
The audit may be paused, but the liability for your attested score remains.
Across the industrial base, things are unclear. Redspin’s October survey found that about three-quarters of companies are keeping their cybersecurity spending steady, while about one in five have paused spending on certification specifically. Also, 76.6 percent of subcontractors said they have not heard from their prime about the pause. For example, Elbit America told its suppliers in writing to continue as planned and be ready for a Level 2 self-assessment if needed.
Even if your prime has not communicated with you, they likely have a position on this.
Development | What It Means for You |
|---|---|
Rev. 3 makes the pause binding regulation | Your contracts now carry different clause sets depending on award and modification dates. Someone on your team should know which contracts say what. |
Self-assessment is the only verification running | Score accuracy is the whole game. A DIBCAC assessment can still land under 252.240-7997, and LOGZONE shows what the gap costs. |
November 10 passes with no replacement | Competitors who treated certification as a discriminator lost it. Evidence of actual compliance is what travels now, in flowdowns and in court. |
The report stays unpublished | The replacement framework is still being decided. When it publishes, the comment window that follows is the one to start preparing for now. |
The deadline everyone was watching will pass quietly, but the new enforcement already has cases. Here are four things to do before November 10: Check which clause versions are in each of your contracts, make sure your SPRS score matches evidence you can show an assessor, keep records of your gap-closure work as you complete it.
Remember that your next annual affirmation is a legal filing, so treat it seriously.
🤝THIS SPOT IS OPEN
Sponsor Tip of the Spear. We feature one sponsor per issue, right after the lead analysis. Your recommendation will be written in our style, with your company name in bold and one link that readers are likely to click. You send us a draft, and we’ll adapt it to fit the newsletter’s voice, with your approval before it goes out.
We only accept sponsors that our readers would genuinely use, and if you sell to this market, that probably means you. Placements start at $299, with discounts for six or twelve issues. Book a placement now.
💰MONEY MOVES
Anduril signed a Navy deal worth up to $2.9 billion for Virginia-class submarine components, announced on October 6. Payments are tied to production results, and the company is taking on most of the execution risk. No obligated amount was published. Anduril is also investing $3.7 billion in private capital for Arsenal-2, a shipyard in Baltimore County that should be operational by the end of the decade. In shipbuilding under EO 14402, the deal’s structure is more important than the dollar amount.
Anduril also won an Army contract worth up to $1.8 billion over five years to expand NGC2’s common data layer, announced a day earlier. The contract includes a $162.8 million base period and the first deployment to I Corps in the Pacific. That means Anduril secured $4.7 billion in contract ceilings across two domains in just two days.
Wolfspeed received a conditional $1.5 billion, 30-year loan commitment from the Office of Strategic Capital last week to expand silicon carbide semiconductor capacity. The department also took warrants for up to 7.5 percent of the company’s equity. This kind of OSC lending is industrial policy delivered through a loan instead of a contract, and the warrants give the government a stake in a key defense chipmaker. This move supports the FORTRESS America supply chain pillar.
Kaizen Technology Partners, which runs the Pentagon’s counter-drone marketplace, won a five-year, $49 million Army enterprise contract on October 5. The first task order is for classified work. Funding for counter-unmanned aircraft systems continues to find non-traditional paths.
📡OPPORTUNITY RADAR
There are six days left to comment on the FAR rewrite. The second set of proposed rules in the FAR overhaul closes for comments on Monday, October 19. Two of the four cases are especially important. FAR Case 2026-006 is the formal rulemaking for the fixed-price default, making EO 14402’s justification process permanent, with an alternate clause for different contract types. FAR Case 2026-011 removes the FAR’s civilian data-rights coverage and replaces it with DFARS-based rules, giving government-purpose rights to every agency you sell to, not just DoW.
Commercial software and dual-use companies have the most at stake, but they usually submit the fewest comments. The dockets are public, so you will be able to read your competitors’ filings on October 20.
Keep an eye on these deadlines: The Project Agincourt plan and the FORTRESS America program office are both expected around October 30. The Senate returns the week of November 9 for the NDAA endgame. The continuing resolution expires December 11. The statutory PCB sourcing ban under 10 U.S.C. 4873 takes effect January 1, no matter where the rulemaking stands.
🧭PEOPLE & POSTURE
The drone office now has a leadership team. Owen West, who is on leave from directing DIU, is CEO of DRPM-UxS. Max Strasiser joins him, and Bonnie Evangelista, co-founder of the Tradewinds marketplace, is now in charge of drone acquisition as of October 6. After 43 days without leadership, the office now has three named leaders. There is one detail to watch: The June memo said the office would report to Deputy Secretary Feinberg, but now a department official says West reports directly to Hegseth. When reporting lines change before an office is fully staffed, it usually means there is still debate about its structure.
Richard "Matt" O'Malley is serving as interim director of the FORTRESS America program office. He was named in Under Secretary Duffey’s October 6 implementation directive, and the office has a 30-day setup period that runs until the end of the month.
We are still waiting for the task force report. In July, Davies said the recommendations would be combined within about 15 days of delivery and made public soon after. That timeline ended in late September. When the report is published, it will be the lead story in this newsletter.
📊READER PULSE
This issue’s question: It’s one tap, anonymous, and results will be shared on Thursday.
What has the CMMC pause done to your cybersecurity spend?
Redspin recently asked the industry a similar question. In the next issue, we will print their results alongside yours.
🔮PREDICTIONS
Record: 2-1. The open prediction from July is that the FY27 NDAA conference report will be delayed past Thanksgiving, and so far that looks accurate. Senate cloture on the defense bill failed on July 14, and the Senate is out until the week of November 9. That leaves about eight Senate session days before the holiday. We will review this prediction after November 26.
New prediction for this issue: The CMMC Task Force report will not be made public before November 10, so the original Phase 2 date will pass with the industry still waiting for a replacement. The department has held onto the report for a month, missing its own timeline, and nothing in the acquisition calendar requires them to act.
Confidence: Moderate-High. The outcome is clear and public, and we will review it on November 11.
⭐TIP OF THE SPEAR PRO
The October report will be released on Friday.
Agincourt: The Drone Office, the Money, and the Command That Eats It
Covers the Pentagon’s autonomy reorganization as it happens. Let’s start with the funding. The Defense Autonomous Warfare Group requested $54.6 billion for FY27, but only $1 billion in discretionary funds has a clear path. The $53.6 billion mandatory portion has no funding mechanism, and every committee that reviewed the request listed only $1 billion. Plans based on the larger number are relying on money that does not exist yet.
The report also profiles the new leadership team, outlines the October 2027 Autonomous Warfare Command goal, and shares our predictions about the Agincourt plan before it is released at the end of the month, each with criteria so you can judge our accuracy.
July’s report predicted the CMMC outcome you just read about in the Signal three months in advance. This new report makes similar predictions about the drone reorganization, in writing, before the plan is published.
Pro membership gives you access to the report library, the live tracker, the Monday Huddle, and a direct line to us.
THE LAST WORD
Redspin found that 76.6 percent of subcontractors have not heard from their prime about the CMMC pause. Let us know if you are in that group. If your prime sent you guidance, we want to hear what it said. If you have not heard anything, that is also an answer.
Just reply to this email.
Your response is anonymous, and your input will help shape our coverage of the replacement framework when it arrives.
Semper Fi,
Justin
