r/CMMC

Aloha!

So from what I'm seeing and understanding, we get contracts that have the DFARS clauses but no data/documents/blueprints are ever marked with CUI. So can we ask the contracting officer to remove those clauses?

Also, who is above the contracting officer?

So what if an org handles parts for something that was designed and built decades ago? These parts are also used commercially as well as by the military so this info can be accessed by the public. But most of the diagrams and what not are very very old and pre date DFARS and CMMC. So do we still need to consider it CUI if it's being sent to us marked as CUI?? It seems that the folks sending some of the info over are not even sure why some things are tagged with CUI. Like there will be email discussions that don't involve and FCI/CUI but they are still tagged. But really confused by the older stuff. Help!! lol Thnx

I am looking for guidance on how people bring photography cameras into CMMC L2. I can't really find any information on it online.

The purpose of the camera is that it will take pictures that contains CUI.

I have a service that provides us an enclave so we try to steer users to use that. Of course there are fringe cases that would need an on-prem device and our service can provide us a device for that. We can't really handle an in-scope smartphone right now and our service doesn't provide that.

Would the camera be considered Enduring Exception? As far as I know, there isn't any camera that have FIPs validated encryptions.

Are these just 3 things we need to write down for the SSP?

1. Categorize it as specialized asset.
2. Justification for exception
3. Compensating Safeguards

Trying to move a several running VMs from a regular Azure subscription into Azure Government — there's no native way to just "move" it, so the standard trick is to use Azure Site Recovery and treat the VM like a physical server being replicated in.

That approach used to work fine, but it was built around Site Recovery's old "Classic" setup, which got retired this past March. Now that everyone's forced onto the newer "Modernized" architecture, the tool seems to notice the source is an Azure VM and just... skips the actual setup step. It reports success, but never actually configures anything, so the agent can't connect to anything and nothing starts.

Two questions for the group:

1. Anyone else run into this specific silent-skip behavior, and found a way around it?
2. Has anyone actually pulled off a live move from commercial Azure into Gov since Classic went away, or is this basically a dead end right now?

Wanted to see if anyone's cracked this before I give up on it. Thanks in advance.

Working through some scoping activities related to VoIP and voice data. If we were to allow the use of VoIP to discuss CUI over the phone, would the system then be treated as a CUI asset (I.e. cloud system would need to be FedRAMP moderate, FIPS encryption, etc.)? If they do need to be FedRAMP moderate, does anyone have recommendations for cloud solutions that don’t greatly increase the cost or know of any compensating controls, such as network segmentation, to make it so it doesn’t need to be FedRAMP moderate?

If you could provide previous experiences during assessments or references that would be greatly appreciated.

I am trying to wrap my brain around how to put an AP into a network diagram when you are trying to show what is in scope/in your enclave vs. Out of scope/untrusted/outside of the enclave.

My brain says to put a trunk connecting to the AP that sits on the line of the scope, then a dotted line into a SSID inside the enclave and then one going outside to where the SSID for the OoS is sitting and somehow show it cannot access back into the network?!?!

I am massively overthinking this I'm sure but I can't figure out how to portray this in the network diagram.

Here si a weird one I am wondering if this is a GCC-High-ism...

We have two users who had a second OneDrive company shared folders pop-uo and sync'ing issues have started propagating.

One got so bad, we wiped the device and started over. Uninstalling OneDrive and cleaning out the settings didn't help.

Anyone else see this?

Hi everyone, we are currently migrating data out of our Microsoft commercial to GCC-High. We have about 40 users. We weren’t using share point and teams was used mainly for meetings. We decided to not use a migration tool, Since there wasn’t much data on the cloud. Whats left to migrate is users mailboxes and enrolling the devices in MDM. I wanted to ask has anyone ever done this migrate users mailboxes by exporting psts and importing? Or another alternative. If so could you share your process?

Confused on this one and need some clarification please.....

Community

After reading a few articles, checking a few companies like corsec, wolfssl, draka.
How are you guys getting the FIPS 140-3 cert and what level are you normally getting certified?

If Rubrik is FIPS 140-3, is it possible to get that directly from Rubrik?

Hi everyone,

We have a couple of CNC machines that are connected to the network. The machines are signed in with a domain user account to be able to connect with the CUI server that is in on prem. Has anyone ever encountered this type of setup and how could did you tackle this to make it compliant. Current setup is the user account is added to a security group that is only set to access a specific folder that is accessed from a CNC machine but the folder is located on the cui server. Also did I mention one of the CNC is windows XP

I have a basic understanding of CMMC, but I’m having trouble understanding what happened in the first place that caused the pause.

A few questions I have:
- What is the pause hoping to achieve?
- What are different schools of thought to solve the current problems?
- Is there any competitive advantage to having an C3PAO certification at this time despite the pause?

Thanks!

Aloha,

Ok, so if a company handles both FCI and CUI, do they need to have passed the SPRS with L1 and L2 scores???

I thought that if you're doing L2 then that would cover what is needed for L1.

Does anyone know what the average cost is of doing it on your own / with employees, vs paying for a product to help with it?

Hi all, we got a quote to transition our org from gsuite to GCC High that is $300k in migration costs plus $400 per user for annual licenses. We are a 100 person company. Does this seem high? If so any recs on who to get a quote from?

CORRECTION: license fee is annual not monthly

An opportunity to be heard:

I am posting this as a reminder because the window is short and it's easy to miss. DoW is collecting industry input to guide the CMMC Reform Task Force after the Phase 2 suspension. Task force recommendations are expected around Sept 13, so this is realistically the last clean shot to get small-contractor reality on the record before the report is written.

Deadline: Friday, August 14, 2026 at 12:00 p.m. Eastern. The clock is the receiving mailbox, not your outbox.

Where it lives: https://sam.gov/opp/89ef9bfb0834473791e991c712698d94/view, titled "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base." Check the live notice before you send, since the government can amend a posting.

How you submit: Email only. There is no regulations.gov docket, so don't wait for a comment portal. It isn't coming. Send to both addresses:

• whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil
• leanne.m.condren.civ@mail.mil

Missing the second one risks your comment not being counted.

Subject line: Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base (DIB)

Format: Word or PDF. Body capped at 10 pages, single spaced, 10pt Times New Roman, 1" margins. Text inside tables or graphics at least 9pt. A one-page cover letter is allowed and doesn't count against the 10. Include company name, UEI/DUNS, CAGE code, and a point of contact.

The seven questions, roughly:

1. Your top five most expensive or time-consuming burdens under CMMC and 800-171 Rev 2
2. Which controls genuinely reduce your risk, the ones you'd keep anyway
3. Which requirements cost the most for the least actual security
4. Commercial tools and managed services you already run, and how DoW should give credit for them
5. What makes Phase 1 self-assessments hard to do and report
6. Specific changes that would lower cost and barrier to entry for small and non-traditional businesses
7. What would actually improve resilience versus audit paperwork

You don't have to answer all seven. Pick the ones you have real experience with and skip the rest. A blank beats filler.

Two cautions:

Treat your response as a public document. No CUI, no prime or client names tied to sensitive work, no network or vulnerability detail. Describe the cost and the burden, not your architecture. The notice also says proprietary material may not be considered or returned.

And keep it consistent with your records. Anything you say about your cybersecurity posture should line up with your SPRS score and your prior attestations. FCA exposure didn't pause when the assessment schedule did.

What actually gets read: numbers, not adjectives. "Compliance is expensive" gets skipped. "Our 12-person shop spent about $38k in year one, including $14k in consulting and roughly 400 staff hours" gets quoted in the report. Answer the questions in numbered order, since staff compile them question by question and you want yours easy to drop into a pile. Three tight pages that answer two questions should beat a padded ten.

Happy to answer format questions in the comments but everything you need should be on the live notice website. Hope this helps!

This may be one of the most telling updates we've heard since the CMMC Phase 2 pause was announced on July 13.

During a fireside chat at Black Hat, DoW CIO Kirsten Davies shared several notable updates, including:

• The program being referred to as a "pause" rather than a "suspension."
• Upcoming solicitations are expected to provide some kind of benefit ot award for organizations that have already achieved CMMC Level 2 certification through a C3PAO.
• The Department is exploring continuous monitoring as part of the future of the CMMC program, with ongoing engagement throughout the three-year certification cycle.

Taken together, these comments suggest that while the implementation timeline is under review, protecting CUI and independent validation remain central to the program.

Interestingly, the conversations we're having directly with contractors seem to reflect that too. We're curious whether that's representative of the broader DIB, or whether we're only seeing part of the picture.

What are you seeing?

• Has your organization changed course since the pause?
• Are you still moving toward a C3PAO assessment?
• Have your prime contractors changed their expectations?
• Or has nothing really changed?

We'd genuinely be interested in hearing how others across the community are approaching it.

Looking for S3 compatible storage for Veeam off-site backups that have object lock for immutability. Using Backblaze now, but they are not even FedRAMP Ready. Was looking at Wasabi, but they are only READY and not Authorized.

Anyone have suggestions beyond going with AWS GovCloud of Microsoft Government? I looked at the FedRAMP Marketplace for storage - there were a lot and doesn't call out S3 storage as an offering in the quick blurbs.

Appreciate any nudges in the right direction. Thanks!