DoD Said 60 Days. So Where Is the CMMC Report?

---

Transcript

Jacob: All right, folks. It is September, and it’s been 74 days since the DoD CIO announced the suspension of CMMC Phase 2, and everyone is wondering when we’re going to hear about the path forward. There’s a lot of confusion about the CMMC review timeline and when we’re going to hear what’s going on, and that’s what we’re going to talk about today.

Daniel, the DoD said they were taking 60 days to review the CMMC program, so a lot of people were expecting to hear what the plan was two weeks ago.

Daniel: I can’t blame them. I would also have some expectation around that when I see, in big bold letters, “60 days.” However, 60 days — maybe that’s just a fluid number to them, because I think the internal due-out was supposed to be at 60 days, and then they’re supposed to be like, “All right, this is what we’re going to do, here’s our plan forward,” and then boom, straight to the main stage: “This is what we’re doing with CMMC.” And I think they probably ran into some hurdles, quite honestly, Jacob. It feels like they should have announced something already, just by the nature of it.

Jacob: Yeah. I have a feeling they had a plan going into it. And I don’t know, we’ll see. This isn’t rulemaking. This is an RFI. They’re able to talk about whatever they want during this process. They’re on LinkedIn out here posting about responses that they got — and you haven’t heard anything about what the 60 days was. And as we’re going to talk about, depending on when you start counting and what statement you go off of from the DoD, 60 days can mean a lot of different stuff.

Daniel: A lot of different stuff. It’s all over the place. It’s crazy.

Jacob: But okay, first things first, let’s just talk about this pretty common point of confusion that we’ve seen. The suspension of CMMC Phase 2 is indefinite. The suspension is not 60 days. So the suspension of CMMC Phase 2 requirements is indefinite. The review of the CMMC program is supposed to last 60 days, which is very flexible, as we’re going to talk about. We’ve seen this come up many times — on calls, on the Hotline, out in the wild. But until we hear otherwise, the standing guidance from the DoD is: contractors can only be required to achieve CMMC Level 1 or Level 2 self-assessment status in order to be eligible for contract award. CMMC Level 2 and CMMC Level 3 certifications achieved via third-party assessments, as a requirement for contract award, are suspended indefinitely. That’s what the suspension means. You still have to implement the requirements. You still have to comply with DFARS 7012. You still have to go through the self-assessment. You just don’t have to hire a third party in order to achieve the status at the end. So it’s a big change, but at the same time, it doesn’t really change much for anybody, other than you don’t have to hire anybody to run your assessment.

Daniel: And what’s interesting is, I was on a webinar a couple of days ago, and one of the poll questions was, “Is your prime still requiring this of you?” 47% said, “My prime is still asking for this information.” So, agnostic of the DoD’s — or DoW’s — timeline, which we’ll get into more on the podcast, primes are still like, “I’m not going to wait on them to actually make sure I’m getting this information from my subs.” Which is an interesting little pivot, right? Because they have their own timelines, completely agnostic of what the DoD is doing right now.

Jacob: Yeah, absolutely. I can’t wait to see how the DoD handles that one. That’s a whole other can of worms. All right, so let’s talk about: what does 60 days mean? I can’t believe this is a question. When you say 60 days, how much time is that? Is it this much? Is it this much? Where are we?

So, just to recap, the DoD CIO announced that they were suspending CMMC Phase 2 on July 13th. There were press releases, there were videos, and most importantly, there was a memo — an official memo signed by the DoD CIO, titled “Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of CMMC Requirements.” And specifically in that memo, there’s a line that says, “A dedicated CMMC reform task force is to be immediately established to conduct a top-to-bottom 60-day review of the certification program.” But does that mean that the task force was established and started working on July 13th? If so, 60 days later would have been September 11th. And that’s what most people were expecting. That’s what you’ve heard, right?

Daniel: That’s what I’ve heard. Yeah.

Jacob: Yeah. So, as we all know, if you’re watching this — September 11th came and went. No report, no inkling of a report, no hints of a report, no recommendations, no LinkedIn posts. We saw lots of LinkedIn posts during that 60 days about different RFI comments that were submitted, but we haven’t heard anything about what a plan is moving forward. So either they missed their deadline, or the 60 days meant something different.

So, on July 16th, a few days later, the DoD CIO was giving lots of interviews. There were tons of articles all over the place. The DoD CIO said that after the 60-day review concludes, the task force would have about 15 days to get all of the recommendations synthesized and feedback put together. Then she went on to say, “We’re hoping shortly thereafter that we’ll be able to make that report public, along with the recommendations.” So, about 15 days shortly thereafter. What does “about” mean? What does “shortly” mean?

Daniel: Shortly thereafter. Yeah.

Jacob: So if we assume that the task force kicked off on July 16th, when she was giving this statement, then 75 days later would be September 26th — this Saturday. Probably not going to be this Saturday. So “about 15 days shortly thereafter” would be next week. So, not 60 days from the announcement, but somewhere in that window — you know, next week, the very, very end of September — is a definite real possibility. But there’s one other variable to consider here: the convening memo.

So, a previously unpublished DoD CIO memo that fell off the back of a truck and made its way to us, as many things do, was dated July 20th, and it’s titled “Establishment of the CMMC Reform Task Force.” But the memo doesn’t say when the task force was established. It instead convenes the task force, but simultaneously refers to the task force to begin its action plan within 5 days of being established. And then it also directs organizations within the DoD to provide the names of their task force representatives within 48 hours. So did the task force start their 60-day clock on the 20th? Did they start it within 48 hours of the 20th? Did they start it within 5 days of the 20th? Five days plus seven days later — 75 days from July 20th is October 3rd. July 20th plus five days plus 48 hours would have started the 60-day clock on July 28th. 75 days after that would be October 11th, more than two weeks from this conversation we’re having right now. So, we’ve talked about this on the Hotline, we’ve talked about this in person at Summit 7 Live and some of the events we’ve been to. The window for hearing an update depends on when you start counting, and what you think 60 days means, where you get your information from, which memos you read.

But really, the window for hearing something, based on their statements, is mid-September to mid-October, if you believe them. And Daniel, you’ve been more skeptical about what they’ve said.

Daniel: I have. So, I was at an event, DIBEX, in Philadelphia, in front of two, three thousand people. The CIO gave a fireside chat, and in it she said — and this would have been August, I’ve got the dates pulled up, the 25th, 26th, 27th was the duration of the conference — she was like, “Hey guys, the task force is meeting offsite next week” — which would have been like the first week of September — “and I’m going to have a due-out by the end of that Friday with their recommendations on how to move forward with the program.” Okay. So I’m looking at that and I’m like, “Oh, September 4th is when she’ll get the responses from the task force. She’ll have a concise, summarized version of the action plan, and she’ll be like, thumbs up, thumbs down, and then we’ll all know what’s going on.” And that time has now come and gone. September 4th was 20 days ago. And she said that in front of thousands of people, from the stage. So I’m looking at this and I’m like, “Okay, I see the memos, I see the misalignment of dates everywhere. What’s going to happen? When’s it going to happen?” When things were established, class deviations — which everyone was kind of freaking out about, because they thought that was the conclusion of the task force — and then from the stage she’s also saying she basically should have known something by September 4th, which means she would have had 20 days by now to officially come out and say something. So I’m hesitant around all that.

Now, I’m going to do a little speculation, as I like to do. There’s our glorious friend, the midterm elections, coming up.

Jacob: Yeah.

Daniel: I personally think the news that’s going to be delivered from the CIO’s office is probably not as good of news as telling small businesses that CMMC has been suspended. Nobody wants to look bad on small business during election time. I would not be surprised if we don’t hear an update until post-midterms, in my personal opinion — because, again, I don’t think it’s going to be as positive as the momentum they have suspending the program in its current state, because of what it would take to change it: rulemaking, right? All of the things being said — whether that’s implementing new controls and requirements with the “brilliant at the basics” through separate contractual means, whether that’s revising the program and limiting the POA&M requirements for different-sized businesses, which had kind of been tossed around, or adding continuous assessments — when you look at everything that’s been mentioned during the listening sessions, I bet she wants to do all of that. That’s rulemaking, right? Going from Rev 2 to Rev 3 isn’t good news for small businesses. There are fewer requirements, but under the hood there’s more to do.

Jacob: I agree with you. So, I would be surprised, personally, if they don’t say something prior to the midterms, but I could see a world where they say it after the midterms, and 60 days really just means whatever we want.

Daniel: Yeah.

Jacob: By “60 days,” we actually meant six months — which is just hilarious, because all they talk about is speed, speed, speed. “We’ve got to go fast, we’ve got to do this, we’ve got to do that.” We didn’t say 60 days. They said 60 days.

Daniel: Yeah.

Jacob: And it just goes to show — it doesn’t really matter who is in charge at any given time in the department. The culture and the inertia of the department is its own beast. So they set the clock, they missed the deadline. Even if we think it would be mid-October — I mean, who knows, maybe while we’re having this conversation the news broke, and this conversation is irrelevant as soon as it comes out.

Daniel: I hope so, honestly. Great.

Jacob: I’m going to go check the news right now. Everybody else should go check the news right now — after you like and subscribe. But it could be a while, because unlike rulemaking, there are no established averages for time. They’re just kind of making it up as they go along, through memos and reviews and whatever. They’re not doing any official process here. And like you said, like we’ve talked about in previous episodes, all they talk about after the announcement of the suspension is increasing requirements. So I don’t know how you’re going to come out with the recommendations that everybody’s excited for and say, “Actually, we’re going up here, in the name of resiliency” — which won’t matter. Small businesses don’t care if you call it resiliency, security, whatever you want to call it. Does it cost money, and are the requirements harder to achieve? That’s the only thing that’s really going to matter.

And I think, like we talked about before, they overcooked the RFI. They bit off more than they could chew. They conflated other programs and other requirements with CMMC. And they probably found out — I don’t know, but they probably found out — during the review task force that, “Oh, you can’t just press a button and fix CUI marking. The people who do CUI policy inside the department don’t even work for the DoD CIO.” So, we’ll have to see. There’s a lot of smoke, there’s a lot of noise, there’s a lot of statements from stages in the preceding 60 days, but the conservative estimate of 60 days is long come and gone.

Daniel: Yeah.

Jacob: Maybe they get it done by mid-October. What do you think? Let us know in the comments below. Do you think we’re going to hear it before the midterms, after the midterms, this year?

Daniel: I don’t think so, man.

Jacob: When do you think we’re going to hear what’s going on? Because the longer they go without saying anything, the more we hear, like, “Random primes require it, random primes don’t require it, people are still doing it, they’re not doing it.” It’s just — you know, what’s the plan, everybody?

Daniel: So, yeah.

Jacob: We’ll be breaking the news as soon as it comes out. We’ll be trying to transition through — digging through the hype and the statements and the press releases to get to what the actual requirements are. So, like and subscribe, and we’ll see you next week.

Daniel: See y’all.