Top story
The first numbers from the RFI came out this week. CMMC.com's recap of the August Cyber AB town hall (published August 26) reports that "the task force had received nearly 1,100 RFI responses, engaged over 1,300 individuals through listening sessions and stakeholder meetings, and collected over 10,500 pages of submitted data." According to CMMC.com, Davies told the DIB Accelerator audience in Philadelphia: "What we want is results, not red tape. We want performance, not paperwork." CMMC.com's account of that session says the report is expected "by late September or early October 2026."
Rules and policy
- New principal deputy CIO. DefenseScoop reported on August 27 that Sonu Shankar "was officially sworn-in Aug. 24" as the Pentagon's principal deputy CIO. Davies: "The addition of Mr. Shankar to our team will add additional firepower to our transformation work and the OCIO team." Why it matters: DefenseScoop reported in July that the Reform Task Force reports to Davies's principal deputy.
- FAR overhaul batch 2 clears OMB. On August 28 the FAR Council's second batch of Revolutionary FAR Overhaul rules cleared OMB review. CMMC.com notes: "CMMC is not in the FAR." CMMC stays in 32 CFR Part 170 and DFARS 252.204-7021 and 252.204-7025. Why it matters: don't expect CMMC changes to arrive through the FAR rewrite.
Industry and enforcement
- The Cyber AB's numbers. The August town hall recap reports that "the CMMC program itself is not paused," that "Over 2,000 Level 2 final certifications have been issued by C3PAOs," and that "76 CCIs have been fully credentialed with 14 applications still in process." Why it matters: thousands of companies are already certified, and their primes know it.
- Davies on operational technology. CMMC.com reports she called protecting federal data "table stakes" and drew a line between information security and OT security. Why it matters: manufacturers should expect OT to come up in whatever replaces the current model.
Still on the radar
- The 60-day review ends about September 11.
- No DOJ cyber-fraud settlements were announced this week.
Watch list
- The task force report, now expected late September or early October.
- A revised class deviation or a new CIO memo.
What to do this week
- If you're certified, make sure your primes know it and have your certificate details.
- If you run production equipment, add your OT network to your system inventory and boundary diagram.
- Keep your SPRS score and annual affirmations current.
Sources
- August 2026 Cyber AB Town Hall Recap (CMMC.com, August 26, 2026)
- OT Security Is Key to DIB Resilience: What the DoW CIO Signaled about CMMC Reform at DIBX 2026 (CMMC.com, August 26, 2026)
- Sonu Shankar appointed as Pentagon principal deputy CIO (DefenseScoop, August 27, 2026)
- Second Batch of Revolutionary FAR Overhaul Clears OMB (CMMC.com, September 4, 2026)
- Pentagon task force to review CMMC hits the ground running (DefenseScoop, July 17, 2026)
This briefing summarizes public sources for general awareness. It is not legal advice. Check the linked primary sources before acting on any item.