Top story
The CMMC Reform Task Force has opened its request for information. On July 20 the SBA Office of Advocacy reported that the task force will "comprehensively review the program and deliver actionable recommendations for reform." Responses are due by 12:00 p.m. ET on Friday, August 14, 2026. This is the most direct way for a small contractor to shape what CMMC looks like after the pause.
Rules and policy
- How to respond. SBA Advocacy's notice gives two addresses for submissions: [email protected] and [email protected]. Why it matters: the task force is asking for specifics, so concrete costs, timelines and scoping problems will carry more weight than general complaints.
- SBA Advocacy roundtable set for July 30. On July 23, Advocacy announced a virtual roundtable on "the U.S. Department of War's (DoW) Request for Information (RFI) for its new Cybersecurity Maturity Model Certification (CMMC) Reform Task Force." Its roundtables "are off the record and not intended for press purposes." Why it matters: it's a lower-effort way to get small-business concerns in front of the task force.
Industry and enforcement
- House passes its NDAA. On July 22 the House passed H.R. 8800, the FY2027 NDAA, by 216–212. Breaking Defense called it a "$1.15 trillion fiscal 2027 defense authorization bill" and reported that "Senate Democrats have blocked it from moving to the floor over opposition to the war with Iran and concerns about the defense spending growth." Why it matters: the conference bill is where any CMMC provisions will be settled, and it's a long way off.
- The Senate bill's CMMC grant program is still pending. The Senate Armed Services Committee's bill, S. 4784, marked up in June, would create a CMMC Level 2 grant program. Federal News Network: "The maximum amount per grant would be $100,000. The bill would cap the total funding allotted for the CMMC grant program at $50 million." DoD would have to establish it by July 1, 2027. That provision is in the Senate bill, not the House bill. Why it matters: small contractors could get help paying for Level 2, but only if the provision survives conference.
Still on the radar
- No DOJ cyber-fraud settlements were announced this week. The most recent is LOGZONE Inc. ($507,144, June 18).
Watch list
- The August 14 RFI deadline.
- The SBA Advocacy roundtable on July 30.
- Senate floor action on S. 4784.
What to do this week
- Decide whether to answer the RFI, alone or through a trade association.
- Write down what CMMC has actually cost you so far: consulting, tools, staff time, delayed bids. The task force needs real numbers.
- Keep your self-assessment and SPRS entry current in the meantime.
Sources
- DoW Requests Information for CMMC Reform Task Force (SBA Office of Advocacy, July 20, 2026)
- Roundtable on DoW's RFI for the CMMC's Reform Task Force, July 30, 2026 (SBA Office of Advocacy, July 23, 2026)
- House passes 2027 NDAA while measure remains stalled in the Senate (Breaking Defense, July 2026)
- FY2027 NDAA status (Congressional Research Service, IN12704)
- Senate NDAA proposes CMMC grant program (Federal News Network, June 2026)
This briefing summarizes public sources for general awareness. It is not legal advice. Check the linked primary sources before acting on any item.