CUI Hotline: 10.09.26

---

Transcript

Cold Open: Where’s the Intro?

Jacob: We’re live, I think. Was there no intro? Did it work? Oh man, it’s a live show. Somebody was in here messing with settings, so we didn’t play our intro. You know how the song goes, so play it back in your head. Hopefully we have an outro. I’ll have to double-check the settings before we leave. It’s spooky season and the stream is haunted, so we’ll chalk it up to that.

We’re live on LinkedIn. You can find us at cuihotline.org, shoot us a DM, call the number and leave a voicemail, or fill out the form. We have a big backlog of questions. I’m very thrown off by the lack of music, but let’s get into the thought of the week. Daniel, you’re seeing this more and more. There’s a lot of talk out there about advanced security, continuous compliance and monitoring, IoT, PQC. What about Level 1?

Thought of the Week: Companies Can’t Meet CMMC Level 1

Daniel: Of the problems I thought I’d be solving, this wasn’t one. How long has FAR 52.204-21 been out? Since 2016, so we’re at ten years of basic cyber hygiene requirements in every federal contract, which is the equivalent of CMMC Level 1. This week, three different companies told me they can’t meet Level 1 in their corporate environment. Most are getting hung up on things like device access. They say, “We kind of just let people connect.” I ask whether they have RADIUS, conditional access policies, or any mechanism for blocking devices in the commercial cloud or on-prem, and they say no, nothing like that.

To me the FAR 15 controls are very low-hanging fruit. Any commercial MSP, even one that’s never heard of CMMC, should be able to layer these on. But more and more companies knock on our door saying they can’t get the basics done. An enclave is great for the 10, 15, 50, 100 people who need it, because it’s locked down and it’s just a virtual desktop. But the organizational change and approvals required to hit Level 1 across the enterprise, where their FCI sits, are crazy. A Level 2 hardened system that touches a few dozen people is no problem, but Level 1 for the whole enterprise is like an act of Congress, even though it’s been a requirement for most of them for a decade.

Jacob: Technically, FAR 52.204-21 works exactly like DFARS 7012. By accepting the terms, you’re attesting that you’re doing those things. Every federal contractor, not just defense contractors, has been attesting to the requirements in the FAR basic clause. That’s why the FAR CUI rule, if you read it closely, estimates the cost of complying with NIST SP 800-171 minus the 15 requirements in FAR 52.204-21. They say you’ve had those for ten years, you already told us you were doing them, so we won’t estimate that cost.

Daniel: It’s the same issue DFARS 7012 has had since 2016. You’ve been attesting, so the government expects you’ve done it.

A Story About Internal Red Tape

Daniel: Here’s a story about internal roadblocks. A company came looking for help. They had a big kickoff call with their whole team, then we dealt with part of that team over several weeks while we put proposals together. The final deal wasn’t communicated to the rest of their internal team. When they got on the schedule and in our backlog, the other part of the team came to us and said, “This isn’t what we asked for.” It felt like a therapy session.

The person who reached out initially said, “We have money tied to defense work, Level 1 and Level 2, self-attestation, and our primes are demanding it. Please help.” They handed us to someone in finance to negotiate terms, and we talked about the backlog and typical periods of performance. When it got back to the person who actually needed it, the BD and sales lead trying to keep and grow their revenue, the timeline never reached them. They needed to self-attest to Level 2 by the end of the month. That’s millions of dollars on the line, and this isn’t a small company.

Jacob: A senior executive in charge of contracts and a senior executive in charge of finance didn’t talk to each other. They inked a deal, and now they may miss out. The contract executive told us on the call that the finance executive doesn’t know anything about contracts. It was a bit of a Spider-Man meme situation.

Daniel: Red tape happens inside organizations. People don’t understand the full risk because they think it’s “just a cybersecurity thing” that should be quick and easy, or “haven’t we been doing that for years, we have MFA.” These little narratives about flipping a switch are fascinating, and it’s just not how it works. The organizational debt is the real problem. Passing a third-party assessment was the least of their concerns. They weren’t even worried about getting certified. That’s a “level 300 course” for later. They just need to self-attest to the minimum.

CIRCIA Final Rule: In Regulatory Review

Jacob: In other news, the CIRCIA final rule, as we discussed last week, is officially in regulatory review. After all public comments have been adjudicated and all tweaks finalized, it was sent from CISA to the Office of Information and Regulatory Affairs, the element of OMB in charge of rulemaking. This is also the interagency comment period, and there are lots of affected agencies. But this is a congressionally mandated rule now a year past its deadline, so there’s a lot of inertia, attention, and desire to get it done. The authors in Congress have been very involved: hearings, comments, meetings, press releases. I’m confident we’ll see the final rule before the end of the year, and even with the full 90 to 120 day review, before the end of Q1. That’s a big deal, because defense contractors are the largest single group of critical infrastructure entities affected, and nobody at the DoD seems to care.

The question is whether CISA will accept DFARS 7012 incident reports as a substitute for CIRCIA reports. CISA’s rule says it’s willing to consider other agencies’ regulated incident reports if they’re “substantially similar.” When I compare a 7012 report to a CIRCIA report, I don’t see how they are. Beyond the 72-hour deadline, the triggers, scope, contents, follow-ups, and data retention requirements all differ, and there’s no ransomware reporting in 7012. Everyone who commented or attended the town halls said, “We already report cyber incidents, so just accept those.” That’s true, but it isn’t necessarily a substitute. If CISA decides it isn’t, you’ll have two reporting requirements. If you have an incident touching CUI, you’ll report it twice, and for an incident outside your CUI boundary, you’ll still report, because CIRCIA doesn’t care about CUI. That means more work, more liability, and more to juggle.

CISA says it will publish agency agreements on a website once they exist. That website doesn’t exist, and nobody has said whether there’s an agreement with the DoD. This goes back several years. Spin the wheel and pick a DoD official. We’ve asked them, and they don’t have an answer. We’ll find out together when the final rule is published.

Daniel: I don’t see a world where they take DFARS 7012, because it covers only covered information systems, while CIRCIA is CUI-agnostic. 7012 can be scoped to a very small part of an environment, and CIRCIA demands the whole organization.

Jacob: What could work is if the DoD updated 7012 so a 7012 report contained everything a CIRCIA report requires, so the DoD could forward it. But 7012 rulemaking has been stuck in neutral for three years, and A&S hasn’t said they’ll do it. If you’re CISA, with a golden ticket and a mandate from Congress, why defer to the DoD on an overly narrow reporting requirement that most people don’t participate in? The DC3 website shows only a small number of participants, which is less than half the number of Level 2 certifications. They haven’t updated it in a decade. Maybe CISA will accept it, and this was all for nothing, but I don’t think so. What do you think? Let us know in chat.

Daniel: Antonio in chat says it still feels like people are waiting to see what happens after the first major failure to report. We saw that with 7012. People didn’t comply until the False Claims Act suits.

Jacob: The most engaging content I create isn’t about rulemaking or CMMC finally happening. It’s somebody getting sued for attesting to the wrong thing. It isn’t a function of the hours I put in. Just posting a DOJ press release exceeds even my best-performing average content. People want to watch the car crash. We have the backend data that proves it.

Do Incident Reporting and Security Programs Depend on Controls?

Jacob: The flaw is that CISA says you need to report incidents, which assumes you have a control environment that can detect them. The government wants to leverage its power to help with cybersecurity, which requires an incident reporting and information sharing cycle. But that cycle depends on controls existing. If I give you a threat intel report and you can’t act on it, it doesn’t matter. If I require you to report an incident and you have no logging, monitoring, access control, or configuration, I’ll never get a report. CIRCIA is great, but are you going to mandate the controls that enable this cycle? If not, we’re spinning our wheels.

Daniel: Brad says, “Both DoD and contractors don’t understand data protection is not solely an IT issue.”

Jacob: It goes back to the philosophy of 800-171. It assumes you have an existing security program. It isn’t a framework to replace your security program or teach you how to start one. It’s a subset of things a security program should easily be able to meet. That assumption is reasonable, but it doesn’t work in reality. You assume everyone has a security program and mandate outcomes, so are you going to give contracts to people who can’t meet them? If not, you either subsidize their security programs with a lot of money, or you chip away at the requirements until anyone without a program, budget, or workforce can meet them, which means nothing. You prescribe controls and never ask anyone to prove it, which does nothing, or you blame the controls and remove them until nothing happens. It doesn’t work.

Daniel: Which raises a philosophical question: is it the government’s job to teach contractors how to start a security program from scratch?

Jacob: I think it’s the SBA’s job, according to some pending… [laughter] rules. Say I’m a defense manufacturer with a bunch of OT equipment, making precision parts for important weapon systems. I’m a critical supplier with no security workforce. Should the government establish and run my security program, or do I lose contracts to people who have one? All along the government has said it wants to work with people who have a security program. Then, when it was about to lose everyone without one, it said, “Whoa, these requirements are problematic.” And you’re like, guys, it isn’t the requirements.

Daniel: One quick follow-up: you mentioned the NDIA report showing about 40 percent of respondents didn’t have a single IT person.

Jacob: The NDIA RFI response cited a 2024 cyber survey of DIB companies. Thirty to 40 percent of respondents had zero FTEs working on IT and security. They spend basically no money, have no people, no skills, and no negotiating power to take requirements out of their contracts. They exist below what’s known as the cybersecurity poverty line. When a significant portion of the DIB is below that line, you can reduce the requirements until someone with no people, money, or skills can meet them, which is nothing. Or you decide not to give contracts to those people and shoot yourself in the foot. Or you take the harder path: go to the appropriators with your hat in your hand and say, “We need these suppliers, they must do security, they can’t, we can’t reduce the requirements, give us the money.” That’s unpopular, so around and around we go. The 10-year-old baseline is simultaneously insufficient for security and a backbreaking burden. It’s Schrödinger’s requirements baseline.

Daniel: It’s insane, because we see this day in and day out. DoD, open invite: do an undercover boss with us. We’ll give you an anonymous account, you just listen to the calls, and maybe you’ll hear it.

Jacob: The only thing preventing compliance isn’t red tape. It’s never been the problem. Say you decide point-in-time assessments every three years aren’t enough assurance and move to continuous automated 24/7 monitoring. That’s better assurance, but if companies can’t show up once every three years because they have no people or money, doing it continuously gets you to the same place. Thirty to 40 percent of contractors can’t meet the requirements at all, so it doesn’t matter how often you assess them. Are you still going to give them contracts? If so, the government has to step in and replace their security program, which it hasn’t wanted to do.

Q&A: Why Government Customers Don’t Seem to Care About CUI Handling

Daniel: Ms. Gil says, “Local government oversight on contracts is something I don’t hear many people talk about. What’s the thinking when a contractor handles CUI because the government customer marks it as such, but the customer seems lacking in concern about the contractor’s handling? Mine is cynical.”

Jacob: Cynical thinking is welcome around here. If you go back to the 2019 DoD IG report that kicked this off, it found two things. Contractors weren’t meeting requirements, which got all the attention. But the contract workforce also wasn’t asking whether they were. They weren’t asking, contractors weren’t telling, and things got worse. The IG’s recommendation, and Congress’s requirement, was to create a mechanism that solves both problems: making contractors implement their requirements and making the contract workforce do something. Third-party certification solves both. It gives the contract workforce a checkbox, even though people don’t like that term, and it gives contractors something to achieve to prove they’ve implemented. Whether it should be done by humans, every three years, annually, automated, or subsidized are questions after the fact, but you need some mechanism for both issues. That’s still open, Ms. Gil, because the IG findings and the congressional requirement are still there and the solution is under review.

Daniel: I think the DoD had a prime opportunity with DFARS 252.204-7019. Everyone knows you could post a -203 up to 110. If they’d systematically raised the bar year over year from -203 up to the point CMMC began, I don’t think we’d have had this whiplash. Instead the DoD effectively said, “It’s okay if you score a zero on the test. We’ll still give you work.” That set the expectation that I don’t have to do anything and can still win work, and then suddenly I have to go from -203 to a minimum of 88. That whiplash shook everybody. “I’ve had a score in there for years and won work, and they didn’t care until now.”

Q&A: The Original Premise of 800-171

Daniel: Someone noted that the original 171 was developed on the premise that DoD contractors already had a mature security program.

Jacob: NIST says so in 800-171. If you go to Appendix E in Rev 2, every requirement tailored with the code NFO is a control NIST believes is already implemented and shouldn’t need to be specified, like managing third parties. That was obviously a mistake. I talked about it in my CMMC history video in 2021 and in extensive interviews with Ron Ross, and it’s why you end up in what I call the paradox of burden. NIST has realized the assumption is incorrect, so it has to undo the things that kept the baseline small and specify everything it thought you’d already be doing. That expands the baseline and increases the burden. If they assume less maturity, the burden goes up, and if they assume more, it goes down. DoD rhetoric, NIST tailoring, all of it assumes pre-existing maturity. None of it is set up to regulate an environment full of companies that, by their own admission, have zero security maturity, so they don’t know what to do and do nothing. That’s where we are, waiting to see what this generation of DoD leadership does. Maybe this time will be different.

Q&A: How Do I Convince Leadership to Keep Implementing During the Suspension?

Daniel: I’ve had this conversation a lot. Some leadership hears “CMMC is paused” and thinks they can go back to a -203 and still win work. I ask: do you still see DFARS 7021 in your solicitations? Does it still say Level 2? That requires a minimum score of 88 of 110. Do you have that? When I show them, they say, “Oh no, I thought it was canceled.” Even if CMMC becomes something totally different over the next two to three years, they won’t remove the score reporting requirement, and they deleted the only other clause that mandated it. DFARS 7021 is the only one left.

Jacob: It’s a question of how seriously you take your potential liability. Business is about taking risk, but many companies take risks they don’t understand. We try to educate people on what risk they’re taking, but the decision is yours. I wouldn’t recommend it. The companies still working with us understand how liability works and don’t want to risk getting caught. When things kick back into gear, there isn’t much time to catch up. Third-party certification is the least of some customers’ concerns. Their customer called and said, “We want a perfect 110. Where’s the paperwork?” That has nothing to do with certification.

Daniel: The DoD said it’s too costly and burdensome, but the only thing they suspended was the third-party proof, not the requirements. We did a podcast on this in July: you still make the attestations and put in the score. You just don’t pay $40,000 to $50,000 for a third party. That saves you money but solves none of the other problems.

Jacob: It depends on how comfortable your leadership is rolling the dice. I’m not telling everyone to talk to a lawyer, but ask yourself whether your company is telling you to roll the dice or you’re informing leadership and they’re rolling them. Aerojet Rocketdyne told Brian Markus to put his hands on the dice and roll, and he said no, and we all know what happened with the False Claims Act case. Rachel Tennyson, whom we interviewed recently, said they shouldn’t be rolling the dice, and they told her to go away. Leadership might be comfortable, but you might not be. Protect yourselves.

Q&A: Managed Enclave vs. Fully Managed Environment

Daniel: An enclave is a separate environment outside your enterprise IT. A typical enclave is virtual-desktop driven, using FedRAMP cloud services that sometimes meet export control requirements too. Fully managed means taking your existing enterprise IT, on-prem servers, networks, and third-party cloud services, and making it compliant. CIRCIA would apply to both.

Jacob: And the DoD has said over the last 90 days that it’s more concerned with cybersecurity and resilience outside the bounds of established CMMC scoping guidance. I want to know what that means. Are you going to shred the CMMC scoping guidance and say everything is in scope? Scoping is the number one mechanism for saving people cost and burden. If you say you don’t care about the data and care about the entire enterprise, then putting data in an enclave no longer saves you.

Daniel: That’s what we’ve told people for years: use an enclave as a foot in the door, and use scoping to reduce licenses and costs. The most common question on this show is about scoping.

Jacob: FAR CUI doesn’t have scoping guidance either. The scoping is one line in 800-171 saying the requirements apply to systems that process data or are attached to it. CMMC had to invent all the rules about security protection assets and CUI assets because the NIST guidance is one sentence. The scoping guidance was pushed hard by the big primes and NDISAC. The reason you can have contractor risk-managed assets inside your CUI boundary is that folks at a mega prime didn’t want to spend the money to rearchitect one of their systems, so they lobbied for it. That’s a true story. It’s insane from a security standpoint, but convenient, and it saves a lot of money. Are we going to throw out CRMAs? Specialized assets? Your OT environment wouldn’t be a specialized asset if OT security is, as we’ve been led to believe over the last 90 days, the number one priority.

Q&A: If 10 to 20 Percent of Our Company Handles CUI, Is Scoping the Whole Company Overkill?

Daniel: We didn’t cue this up, folks, but it’s the question we get all the time. The number we typically see is about 10 to 15 percent of your user population needing daily access to CUI. At 15 percent or below, people typically go with an enclave. At 15 to 20 percent, they wonder which way to go. At 20 to 25 percent and above, it drifts quickly into an all-in approach. Some people look at top-line revenue instead, especially with FAR CUI and all federal contracts. And that’s for US-specific entities. If you’re a large enterprise with a global presence, you can’t make every country’s infrastructure CMMC compliant. Data sovereignty extends well beyond the US, and other countries have their own requirements, like Cyber Essentials and Cyber Essentials Plus in the UK. We’re talking primarily about your US legal entity.

Q&A: International Reciprocity

Daniel: Has Canada or the UK changed their position on third-party assessment for their equivalent CMMC programs? What’s the parity?

Jacob: Nobody knows. An Air Force colonel was specifically in charge of reciprocity with DFARS 7012 before CMMC was a thing. After he left that assignment, as far as I’ve heard, nobody is in charge of international agreements or reciprocity, not even on the 7012 question. The DoD doesn’t have an answer or anyone working on it, or if it does, it hasn’t told anybody. That’s a big deal, because we talk all the time to US entities that are subsidiaries of foreign companies or hold contracts with other governments. We spend a lot of time reading vague guidance and connecting dots.

Daniel: I talked with an Israeli company this week with a large US footprint that’s expanding quickly. The parent needed access to specific systems, they weren’t under FOCI mitigation, which is a whole other set of requirements, and the answer was “yes, but you have to be creative about how you do it and what data you pull,” because of export control and no licenses at the parent. If the FOCI rule for unclassified work goes through, which I think is still in rulemaking, it will open another layer of problems. If you’re an international organization doing work in the US, pay close attention to it. And suspending third-party assessments for Phase 2 does nothing for any of those obligations.

Q&A: Can We Operate Inside M365 Commercial?

Daniel: This is our weekly tradition, where the GCC High people tell you that you don’t need GCC High. Microsoft has a chart. [shares slide] Microsoft Commercial can be used for federal contract information. It cannot be used to process, store, or transmit CUI, and it can’t meet export control. GCC can handle FCI and basic CUI, but not specified CUI or export-controlled data like ITAR, because Microsoft uses follow-the-sun support. The data centers can be in the US, but the support team isn’t a dedicated US-persons team. GCC High, the highest commercially available subscription, checks all the boxes. Some organizations bring GCC into scope for basic and specified CUI with customer lockbox and heavy bring-your-own-key deployments, but it limits the tenant’s capabilities and handcuffs you. That’s why people just go to GCC High. Of our roughly 1,800 clients, maybe 5 percent are in GCC.

Jacob: You don’t inherently need GCC High to achieve CMMC. But many more people need a solution like it than they think, because of everything else they do in their business. It isn’t CMMC pushing you into that environment. It’s everything else that exists whether or not third-party certification exists.

Daniel: And most people don’t know that two or three years ago Microsoft removed its FedRAMP authorization for the commercial cloud, M365 included.

Q&A: Is an Enclave the Fastest Way to Get Compliant?

Daniel: For medium and large businesses, yes. For a small business of 10 to 30 users, it’s about the same amount of time, because you probably have a few laptops and a simple boundary. But with Endode, which hopefully is finally getting funding, it’s an enclave for small businesses of 10 users or fewer, and that would be a rapid path. I suspect the funding is delayed because of the CMMC suspension, once the Army gets the dollars.

Jacob: It’s ironic that Endode is in limbo because third-party certification is paused. It’s the same with NDISAC and its services. I got on their bad side because at conferences they kept saying, “We have all these services that help you meet your requirements.” I said, release the mapping between your services and the assessment objectives, so everyone knows on a shared responsibility matrix exactly what they’re getting. The government solution should meet the same transparency requirements expected of private vendors. The director of their DIB initiative said on LinkedIn they were waiting for CMMC to release the mappings. Why would you wait on the verification program to map your solutions to requirements people have to meet right now? That was two or three years ago. With Endode, why wait to release an environment that helps people meet their requirements based on the review of third-party assessments? People inside the government often don’t understand that CMMC isn’t the requirements. It’s its own program.

Q&A: If We Get Level 2 Certified and Guidance Changes, Do We Start Over?

Daniel: Almost certainly not. A certification is good for three years. At the DoD’s current pace, maybe we won’t get new guidance until yours expires.

Jacob: Some strategic companies expect requirements to expand and get more expensive and complicated, as they always seem to after one of these reviews, so they want the cert now to insulate themselves for years. If I have a Level 2 certification against Rev 2, valid for three years, there’s no caveat in eMASS saying which revision I was certified against. If I don’t want to move to Rev 3, I can certify against Rev 2 now and not worry for three years. Another set of dice. Do you think things will be easier and cheaper after the review? If so, wait. If not, get your cert. It’s a business decision, not about compliance or security. Many people decided certs would never be required and never implemented their requirements. When certs were required, they told the government they hadn’t implemented anything, and the government said, “We need to do a review.” It’s all business.

Q&A: Pre-Award or Post-Award Compliance Investment?

Daniel: Right now, pre-award. Primes won’t let them receive the data or win the work otherwise. If you’re a prime, it’s still mostly pre-award, because the condition of award is a minimum score of 88 of 110. You then have six months to remediate to a perfect 110. I recorded a podcast this week, released next week, with a nonprofit bank that gives out cyber loans to defense and federal contractors. It’s 0 percent interest, an insane program. If you’re trying to break into the DIB and need to invest before anyone gives you work, which is what’s handcuffing people right now, stay tuned for next week.

Q&A: What Does the November 2028 Language in the New Class Deviation Mean?

Jacob: It did not extend CMMC another two years. The 32 CFR CMMC final rule, from the end of 2024, has the same 2028 language: in November 2028, CMMC goes into all contracts. That language conveyed the phased rollout to contracting officers. When the DoD announced the suspension of Phase 2, it implemented it through a class deviation, which modifies the text of an existing regulation for the contracting workforce until it’s updated through rulemaking. They’ve gotten loose with class deviations recently, but that’s how it’s supposed to work. The July class deviation said you can only require Level 1 or Level 2 self-assessment, not a Level 2 C3PAO assessment or a Level 3 requirement. Everything else, including the November 2028 language, stayed exactly as in the regulation.

In September, about 60 days later, the class deviation was updated as part of a group of other changes, such as those on Chinese sourcing. It didn’t change the CMMC text from July, but it was the first time people saw it, and they thought the DoD had pushed third-party certs out to 2028. That’s not what happened. There has been no change since July other than that you can’t be required to have a third-party assessment as a condition of contract award. It was a coincidence that got run with, so read the original regulation and don’t get misled by social media hot takes. When they come out of this review, there will be a pyrotechnic show, a ticker-tape parade, and press releases. They won’t make a phantom change and not talk about it. Will they come out and say they’re extending to 2028? Maybe, but that’s not what the class deviation says.

Q&A: Is Any of the 110 Requirements Far More Expensive If Done Wrong?

Daniel: I wouldn’t point to the 110 controls. The biggest expense we see is implementing the controls in the wrong environment, on a cloud provider that doesn’t meet FedRAMP requirements, so all that work ends up being the equivalent of not-met controls. That happens more than we can count. Access control and physical access can be big uplifts depending on where you are, and FIPS-validated hardware is hard to get right, especially with chip shortages. You can be weeks or months out from getting the hardware, and that’s a time cost and an investment, let alone post-quantum crypto coming soon. But the wrong platform is the biggest cost, and it has nothing to do with the 110. It’s an obligation of 7012 and CMMC.

Jacob: If you squint, the 15 requirements in FAR 52.204-21 are a starting place for the full 110, though they weren’t designed as stepping stones. But the FAR clause doesn’t require FedRAMP and the DFARS clause does. If you implement the 15 in commercial, then do the rest in commercial, then migrate to FedRAMP and do it all again, that has nothing to do with the NIST requirements.

Q&A: Level 1 or 2 by November 2028 but No Third Party?

Daniel: Jason in chat asked about this.

Jacob: Level 1 and Level 2 self-assessments are required as a condition of contract award right now. You can’t be awarded a DoD contract without a Level 1 or Level 2 self-assessment status. CMMC is still in effect. The only thing that no longer exists is third-party assessment. Per current DoD guidance, no one will be required to achieve a C3PAO Level 2 or Level 3 status as a condition of award. Primes can absolutely say they want a C3PAO status, and they’re saying they want a 110 and proof, which is an outside-CMMC problem. The November 2028 language doesn’t mean anything. It’s the language that’s always been in there for the start of Phase 4, and technically the November 2026 language is still there too, held at bay by a memo. Hopefully they have an answer before November 10, 2028, for clarity’s sake.

If requirements are the source of the cost and burden, a self-assessment versus a third-party assessment is a tiny fraction of that cost, so you haven’t addressed the main source. And if you then say you want more requirements, don’t care about scope, and want other technologies included, that costs money and increases burden. We’re all waiting to see what rabbit they pull out of the hat. Maybe they have multiple rabbits.

Wrap-Up

Jacob: We’ll all find out together, maybe on Halloween. It’s a Saturday, and it’s also the end of daylight saving time, so we get an extra hour of trick-or-treating. I don’t think we have another Saturday Halloween for 11 years, so get your costumes ready.

If you find this afterward, leave your questions and comments and we’ll add them to the queue. We’re live every week on YouTube and LinkedIn. You can find us at cuihotline.org and summit7.us. If you’re going to AUSA, come hang out at our event, where we have news about new solutions for small companies, and I think it’s free. And if anybody’s going to CS5, we’ll be there later this week. I’m sure it’ll be a barrel of laughs, especially if there’s no news. We’ll all find out together whether the outro works. If not, it’ll be really awkward. See you next week.