July 28, 2026

My Comments Are In!

On July 13, DoD/DoW published a Request for Information on the subject of "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base (DIB)." The comment period ends August 14, and I encourage you to submit your thoughts and ideas!

You can read ours here. In summary:

(1) Educate contract officers and pressure prime contractors to end the unnecessary flow down of CUI to instantly reduce the number of orgs requiring implementation of NIST SP 800-171 and thus CMMC L2.

(2) Reduce the minimum score required for Conditional L2 status and increase the time allowed to close POAMs. The standard of perfection is just too much.

(3) Eliminate the requirements for FIPS-validated encryption and FedRAMP Moderate or Equivalent for the protection of CUI. This would enable orgs to use more affordable commercial products and services.

(4) Eliminate the L1 Scoping Guide and allow the FAR Basic Safeguarding Rule to stand on its own, as originally intended. Those assessment objectives were designed for the application of advanced controls on a mature information security system and are absolutely overkill for an org protecting only FCI.

We also submitted comments on the proposed FAR CUI rule (part 40 of the Revolutionary FAR Overhaul). This rule could have tremendous impact on how CUI is handled by all government contractors, not just defense contractors. The comment period has ended but I managed to get ours in. Two main points:

(1) Require prime contractors to evaluate applicability before flowing down clauses and protected data.

(2) Clarify the content of flowdowns.

Sound familiar? I sincerely believe that overmarking and unnecessarily flowing down CUI together form the single biggest problem with CMMC, and it will only get worse across the entire government contracting universe unless something is done.

Want to know more? Reach out.

Sincerely,

Glenda R. Snodgrass, CCP/CCA/Lead CCA
grs@theneteffect.com
The Net Effect, LLC
www.theneteffect.com
251-433-0196 x107