June 2, 2025

DoD: CMMC is an operational reality. It is not going away.

At the recent CS2 conference, Jacob Horne had a "fireside chat" with James Gillooley of the DoD's CMMC office and Matt Travis with the Cyber AB. At 1:40, Jacob asks "What is the main ecosystem takeaway that the DoD would like to convey to industry?"

Gillooley responded with three things:

• You've had these requirements since 2017.
• CMMC is an operational reality.
• It is not going away.

He continued:

"Katie Arrington keeps saying it. Mr. McKeown keeps saying it. The DoD keeps saying it. It's not going away. The administration is not going to kill it no matter how many EOs they put out. So, be prepared, implement 171, and get your assessments as soon as possible ... and don't count on a self-assessment."

Welp. I guess that about covers it! Are you ready?

As for his last comment about self-assessment, I think he meant "after the first year" because we do have the phased rollout codified in the final rule, allowing for L2 self-assessment for the first 12 months after the rule takes effect. Read more about the long-term prospect of self-assessments in this edition of CMMC Update.

In the most recent Cyber AB Town Hall, Matt Travis told us that there have been 115 Final L2 Certifications issued since the assessment program became active on January 2, and a handful of Conditional L2 Certifications. Anecdotally, I've spoken with numerous assessors over the past few months, trying to get true "tales from the trenches," and the common theme by far is "Most orgs simply are not ready for assessment." Most of the OSCs that are actually passing, have been working with a CCA to prepare. From those I've spoken with, the failure rate is about 60-75% and that is of those that look good enough to get past the initial scoping calls with the C3PAO. Many are being turned away as not ready.

So, are you really ready for CMMC L2 assessment?

That's one of my talks next week! Will I see you at the NCMS Annual Training Seminar? I'll be giving three talks on CMMC!

• Scoping Your CMMC L2 Environment
  
• Are You Ready for a CMMC Assessment?
  
• Top 10 Ways to Fail a CMMC Assessment

If you are there, come say hello! I'd love to meet you in person. If you won't be there, you will have a chance to hear these talks as virtual workshops in my CMMC Summer series. Early Bird Prices expire on July 3, so don't delay!

Sincerely,

Glenda R. Snodgrass, CCP/CCA/Lead CCA
grs@theneteffect.com
The Net Effect, LLC
www.theneteffect.com
251-433-0196 x107