AMA: CMMC Phase II Suspension and Beyond

The Department of War (DoW) recently suspended the rollout of CMMC Phase II, sparking confusion for defense contractors about what this means for compliance obligations. In our next AMA, TrustedSec experts will clarify the facts, dispel misconceptions, and help contractors understand how to move forward during the 60-day review period that will determine the future of CMMC.

During this live session, we will discuss:

• What exactly did the DoW suspend and what's still on the table?
• Which parts are paused and what that means for the rest of CMMC?
• Why did this suspension happen in the first place?
• Is this a sign CMMC is being phased out, or just delayed?
• Interpretation of the timing and messaging around this pause.

Join Director of Advisory Services Chris Camejo, and Compliance Practice Lead Lee Quinton for an expert breakdown of these changes and how to prepare for what’s next. Ask your CMMC questions, let us clear up any confusion around this suspension, and help you guide your organization on handling future CMMC regulations. Whether you’re a defense contractor or subcontractor handling FCI or CUI, a provider of IT, cloud, or cybersecurity services to contractors handling CUI, a compliance officer, or anyone who wants CMMC clarity, don’t miss this! Register now to secure your spot in this informative AMA.

CMMC Resources

TrustedSec blogs on CMMC and adjacent topics:

• What organizations do and don't need to be CMMC compliant:
  • https://trustedsec.com/blog/cmmc-nope-why-you-dont-need-to-be-cmmc-compliant
• Determining what CMMC level should apply to an organization:
  • https://trustedsec.com/blog/cmmc-level-and-assessment-requirements-for-defense-contractors
• Supposed CMMC contract requirements that don't align with the CMMC program requirements:
  • https://trustedsec.com/blog/the-proliferation-of-fake-cmmc-contract-clauses
• The CMMC rollout timeline:
  • https://trustedsec.com/blog/a-big-step-on-the-cmmc-rollout-timeline
• How CMMC applies to subcontractors and external service providers:
  • https://trustedsec.com/blog/cmmc-subcontractors-and-service-providers
• How subcontractors that don't handle CUI can implement a minimal environment to pass a Level 2 audit:
  • https://trustedsec.com/blog/a-vault-with-no-treasure-cmmc-level-2-compliance-for-subcontractors-with-no-cui
• CMMC scope requirements:
  • https://trustedsec.com/blog/cmmc-scope-understanding-the-sprawl
• How to get a temporary CMMC status to work on Level 2 contracts before achieving full compliance:
  • https://trustedsec.com/blog/cmmc-conditional-status
• Our take on the CMMC Phase 2 postponement:
  • https://trustedsec.com/blog/cmmc-is-not-cancelled
• Dealing with unmarked and mismarked CUI:
  • https://trustedsec.com/blog/dealing-with-unmarked-and-mismarked-cui
• Deep dive into what CUI is and how the CUI program works:
  • https://trustedsec.com/blog/government-contractors-ultimate-guide-to-cui

TrustedSec webinars on CMMC and adjacent topics:

• CMMC challenges and misunderstandings:
  • https://trustedsec.com/resources/webinars/cmmc-challenges-and-misunderstandings
• Compliance with DFARS 252.204-7012 and CMMC:
  • https://trustedsec.com/resources/webinars/dod-contract-compliance-dfars-7012-and-cmmc
• FCI and CUI compliance requirements (broader than just CMMC):
  • https://trustedsec.com/resources/webinars/navigating-compliance-fci-and-cui-requirements-for-federal-contractors
• How to write a System Security Plan (SSP):
  • https://trustedsec.com/resources/webinars/building-a-system-security-plan-ssp-that-matters

Government resources:

• DoW CIO page collecting the official CMMC documents, including the scope and assessment guides:
  • https://dowcio.war.gov/CMMC/Resources-Documentation/
• CMMC regulation (32 CFR 170):
  • https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
• CMMC contract clause (DFARS 252.404-7021):
  • https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.