The Friday Brief — Issue 013

1. What happened

Contractors lost a deadline this week. They didn't lose DFARS 252.204-7012 or NIST SP 800-171.

On Monday, the Department of War suspended CMMC Phase II — the third-party assessment requirement that was set to take effect November 10 — and stood up a 60-day Reform Task Force to review the program. Your Phase I self-assessment is still valid. DFARS 252.204-7012 still applies, and you are still responsible for protecting CUI.

The assessment schedule changed, but the enforcement structure did not. For the next two months, your self-attestation is carrying most of the weight, and no external assessor is coming through the door to verify it.

2. The category getting less attention

Most of the coverage has focused on two groups: contractors that were ready for Phase II, and contractors that were still trying to catch up. The group getting much less attention may actually be the largest: organizations that now have more time, but are not sure what to do with it.

These are the firms who were on track to pass. Their self-assessment would have come back clean, and it still would not have surfaced where most of their sensitive data actually moves now: mobile.

Here's the precise version of the claim, because the loose version is wrong. CMMC evaluates whether the required controls exist and are documented. It does not independently validate the live, operational condition of every mobile device that touches CUI. Those are different things, and the space between them is exactly what a paused deadline leaves untouched.

What actually changed for this group: many were sequencing projects around the November date. When the date disappeared, so did the outside pressure to finish work that wasn't contractually due this month. The risk didn't move. The forcing function did.

3. The one question I ask

Here's the test I run on a contractor's environment. One question: on demand, how long did your last offboarded employee keep access from their managed phone after HR closed the ticket?

I have yet to meet a team that could answer that with a number they could actually defend. The issue is simple: the assessment never required them to measure it in the first place.

That single blank is the whole issue in miniature. Here are five more places the same blank shows up.

4. Five gaps a clean self-assessment can hide

1. Enrolled isn't trusted. An MDM enrollment count tells you a device is registered — not that it's in a state you'd hand CUI to today.
2. Offboarding runs on a lag. Sessions and tokens outlive the exit interview. The gap between "HR closed the ticket" and "the phone actually lost access" is rarely measured and never zero.
3. Phone numbers are unrevoked credentials. A number used for recovery or MFA is an identity factor nobody deprovisions. Recycled numbers and SIM swaps turn a known account into someone else's.
4. Unmanaged devices reach CUI anyway. A personal phone running Outlook against M365, under a Conditional Access policy nobody has revisited in a year, is touching CUI — and never appears in your device inventory. NIST 800-171's connection-control requirement (3.1.18) assumes you know what's connecting. Often you don't.
5. Flow-down stops at your fence line. Your exposure includes your subcontractors' mobile posture. Even with Phase II paused, primes are still required to flow cybersecurity requirements down to any sub that touches CUI — and until each contract is formally amended, existing Level 2 and DFARS flow-down language stays in force ( Morgan Lewis).

None of these show up as a failing control, but they all show up in an incident report.

5. My take

Some organizations will use the pause to cut project spend. Others will use it to answer the questions the assessment checklist kept pushing down the list.

The cost relief is real: the SBA's own analysis put small-firm certification as high as ~$593,800 ( SBA), and the frustration behind that number is legitimate. The delayed deadline does not make the underlying risk any smaller. For now, enforcement depends almost entirely on what contractors report about themselves, and mobile is often the part of that attestation built on the weakest evidence.

For the next 60 days, the only auditor is you.

Run this before Monday

Four questions. For each, you either have the evidence on hand or you don't. No score, no tool — an honest yes or no.

Most teams can fill in one row with confidence. The empty rows are where the real exposure sits, and regardless of the phase or deadline, certification was never going to resolve that for you.

You have 60 days and nobody's watching the compliance clock. Spend them on the surface the framework skipped.

If your CMMC program disappeared on Monday, which mobile exposure would still be sitting there on Tuesday?