RFI closes; SBA Advocacy asks DoW to fix CUI first

Top story

The CMMC Reform Task Force RFI closed at 12:00 p.m. ET on Friday, August 14. The same day, the SBA Office of Advocacy filed a comment letter drawn from its small-business roundtables. It names the problem every assessor hears first: "The most frequently cited concern is the uncertainty regarding what constitutes CUI, where CUI enters an organization, where it flows, who receives it, and what systems need to be included within the CMMC assessment boundary."

Rules and policy

Advocacy's recommendations, in its words. The letter, addressed to Leanne Condren of the DoW Acquisition Directorate, recommends that DoW "Require clear identification of CUI before CMMC is imposed," "Limit cybersecurity flow down to contracts involving covered information," and "Establish a graduated path to Level 2 CMMC compliance." Why it matters: these are the reforms most likely to change what small contractors must do and when.
"CMMC tax." The letter reports that "one participant aptly described this ecosystem as a 'CMMC tax.'" Why it matters: cost is squarely on the task force's agenda.

Industry and enforcement

No DOJ cyber-fraud settlements were announced this week.

Still on the radar

The task force's 60-day review runs to about September 11. The report is expected about 15 days after it ends.
The Senate NDAA, S. 4784, with its proposed CMMC Level 2 grant program.

Watch list

Any public summary of RFI themes from DoW.
The DIB Accelerator in Philadelphia, August 25–27.

What to do this week

Ask your contracting officers and primes, in writing, which of your contracts actually involve CUI. It's the question Advocacy wants DoW to answer, and it will set your scope either way.
Keep your CUI data-flow diagram current. It's the first thing an assessor asks for.

Sources

This briefing summarizes public sources for general awareness. It is not legal advice. Check the linked primary sources before acting on any item.

All weekly briefings