#DFARS
LightNews LightNews
vendorship.bsky.social
Monday 10 November was CMMC Phase 2 day. Nothing happens on it.

Suspended since 13 July, Phases 3 and 4 on hold.

Still live: DFARS 252.204-7012, your SPRS score, government-led assessments.

A suspension is not a repeal. The task force report is still unpublished.
November 3, 2026 at 9:38 PM
cyberneza.bsky.social
GCC High: when you need it, and when you don't.
Commercial fits FCI. GCC can work for CUI that isn't export-controlled. GCC High is for ITAR or EAR data, or contracts that require US-only support.
Map where your CUI lives before you buy.
https://cyberneza.com/cmmc
Cover slide over a dark data center aisle of server racks with cyan status lights behind a glass wall, and a glowing blue cloud with a padlock above them. Text: "GCC High: when you need it, and when you don't. One of the biggest real costs of CMMC. Your data decides it." Cyberneza logo, cyberneza.com/cmmc, veteran-owned, 100% US-based. Slide titled "Your data picks the cloud." Commercial: fits FCI; Microsoft positions it for CMMC Level 1. GCC: can work for CUI that is not export-controlled, if your contract and prime allow it. GCC High: ITAR or EAR data, or a contract that requires US-only support; per Microsoft, only GCC High offers the US sovereignty that data needs. Note: any cloud holding CUI must meet FedRAMP Moderate or equivalent, plus DFARS 7012 (c)–(g): 72-hour reporting, 90-day image preservation, forensic access. DFARS 252.204-7012(b)(2)(ii)(D). Slide titled "Why it's a big cost." 1. Pricier licensing, sold through volume licensing after an eligibility check; no trials. 2. A separate environment: you migrate mail and files, and file sharing works only with other GCC High orgs. 3. Fewer features than commercial, so some tools and workflows change. Before you buy: map where your CUI lives, then pick the cloud. Button: "Get an expert-led cloud review." cyberneza.com/cmmc.
November 6, 2026 at 3:08 PM
hivesystems.com
DoD paused CMMC Phase II, but the requirements already in your contracts still apply. 997 RFI responses show where the friction really is, and what DoD could change next.
CMMC Pause: What the DoD RFI Responses Mean for Defense Contractors
DoD paused CMMC Phase II, but NIST SP 800-171 and DFARS 252.204-7012 requirements still apply. See what 997 RFI responses reveal about CMMC costs, what a DoD task force could change next, and what…
buff.ly
November 2, 2026 at 2:28 PM
cyberneza.bsky.social
A cyber incident starts a 72-hour clock.
If CUI comes through your contract, DFARS 7012 requires a report to DoD within 72 hours of discovery. You need a DoD-approved medium assurance certificate to file it. Get it now.
https://cyberneza.com/contact
Cover slide over a dim aerospace quality-inspection lab, with a coordinate measuring machine probing a machined titanium bracket on a granite table and a 3D part scan glowing on a monitor. Text: "A cyber incident starts a 72-hour clock. Your contract sets it. Here's what to have ready before it starts." Cyberneza logo, cyberneza.com/contact, veteran-owned, 100% US-based. Slide titled "What the clock requires." 1. Report to DoD within 72 hours of discovery, at dibnet.dod.mil. 2. Review for compromise: computers, servers, data and user accounts. 3. Preserve images of affected systems and monitoring data for at least 90 days. 4. Submit malware you isolate to the DoD Cyber Crime Center. Note: DFARS 252.204-7012(c)–(e); applies when an incident affects systems that handle CUI. Slide titled "Have these before day one." 1. A DoD-approved medium assurance certificate; you need it to report. 2. Your contract numbers, CAGE codes and contracting officer contacts. 3. An incident plan that names who decides, who reports and who tells your prime. Button: "Get your plan ready." Veteran-owned, 100% US-based, Orlando. cyberneza.com/contact.
November 3, 2026 at 3:09 PM
cyberneza.bsky.social
CMMC Phase 2 is paused. Your obligations aren't. If CUI comes through your contract, DFARS 7012 still requires the 110 NIST 800-171 controls. Phase 1 self-assessments are in contracts and your SPRS score still matters. Free SPRS worksheet: https://cyberneza.com/sprs-score-worksheet #CMMC
CMMC Phase 2: Paused. Your obligations aren't. Still in effect: DFARS 7012 and the 110 NIST SP 800-171 controls, Phase 1 CMMC self-assessments in contracts, and your SPRS score. Use the pause: find your gaps and fix them before Phase 2 returns. Free SPRS score worksheet.
October 31, 2026 at 4:30 PM
aws-news.com
This article clarifies the interconnected DoD cybersecurity frameworks—DFARS 252.204-7012, CMMC 2.0, and FedRAMP Equivalence—that defense contractors must navigate for compliance.
Decoding DoD cybersecurity: CMMC, DFARS, and FedRAMP Equivalence demystified
This article clarifies the interconnected DoD cybersecurity frameworks—DFARS 252.204-7012, CMMC 2.0, and FedRAMP Equivalence—that defense contractors must navigate for compliance.
aws-news.com
October 29, 2026 at 11:09 PM
genaidefense.bsky.social
GenAI “FAR/DFARS helpdesk” for busy contracts teams: ask a clause question in plain English and get cited excerpts + draft compliant language—cutting research time and reducing compliance errors. What clause trips you up most? #DefenseTech #GovCon
October 29, 2026 at 7:32 PM
cyberneza.bsky.social
4 options on the table for CMMC. FNN: DoD's review lists them: restart Phase 2 with fewer contractors, move to NIST 800-171 Rev 3, fix CUI marking, more POA&M time. None is final. If CUI comes through your contract, DFARS 7012 still applies. https://cyberneza.com/cmmc #CMMC
4 options on the table for CMMC. Cyberneza cover slide. The 4 options: restart Phase 2 with a smaller group of contractors, move to NIST SP 800-171 Rev 3, fix inconsistent CUI marking, more time to close POA&M items. What hasn't changed: none of this is final. If CUI comes through your contract, DFARS 7012 and the 110 NIST 800-171 controls still apply.
October 31, 2026 at 1:00 PM
cyberneza.bsky.social
The real cost was never the certification.
DoD's CMMC RFI data, per Federal News Network: $47K average assessment cost cited by respondents. Top cost: NIST SP 800-171 controls.
The pause didn't change your contract. Start with the controls.
https://cyberneza.com/sprs-score-worksheet
Cover slide over a dim avionics electronics lab, with gloved hands soldering a circuit board beside an open avionics chassis and morning Florida sun and palm fronds through a window. Text: "The real cost was never the certification. DoD's own CMMC data points to the controls you already owe." Cyberneza logo, cyberneza.com/sprs-score-worksheet, veteran-owned, 100% US-based. Slide titled "What DoD's CMMC RFI showed." 997 responses reviewed, 509 from the defense industrial base. $47K average assessment cost cited by respondents; SBA's chief had said up to $600K to comply. NIST 800-171 controls were the top cost: GCC High, enclaves, SSPs, FIPS encryption. 2,433 companies held Level 2 certifications as of September. Source: Federal News Network, Oct 26–27, 2026, citing DoD's RFI summary. Slide titled "The pause didn't change your contract." 1. DFARS 7012 still requires NIST SP 800-171 for CUI. 2. Your SPRS score still has to be accurate. 3. The controls are the real cost. Start there. Button: "Score your 110 controls free." Our SPRS score worksheet shows where you stand. cyberneza.com/sprs-score-worksheet.
November 5, 2026 at 3:11 PM
aws-news.com
This article provides a compliance guide for Defense Industrial Base organizations navigating CMMC, DFARS, and FedRAMP requirements, emphasizing the shift from point-in-time compliance to continuous security assurance.
Decoding DoD cybersecurity: Compliance guide for DIB organizations
This article provides a compliance guide for Defense Industrial Base organizations navigating CMMC, DFARS, and FedRAMP requirements, emphasizing the shift from point-in-time compliance to continuous security assurance.
aws-news.com
October 29, 2026 at 11:08 PM
cyberneza.bsky.social
Where does CUI enter your company?
It comes through the contract: email with drawings and specs, your prime's portal, file shares, cloud storage, and files you create from it.
Every system that stores, processes or transmits CUI is in scope. Map it first.
https://cyberneza.com/cmmc
Cover slide over a dim, cyan-lit aerospace CNC machining cell with a machined aluminum aircraft part on the table. Text: "Where does CUI enter your company? It comes through the contract. Here's how to trace it." Cyberneza logo, cyberneza.com/cmmc, veteran-owned, 100% US-based. Slide titled "CUI comes through the contract. Check every way it reaches you:" 1. Email with drawings and specs from your customer. 2. Portals where you download from your prime. 3. File shares and cloud storage where it lands. 4. Files you create from it, like process sheets. Note: DFARS 252.204-7012 covers CUI you receive under the contract, or develop or store to perform it. Slide titled "Map it. Then draw the line." 1. List every place CUI arrives. 2. Follow where it is stored, shared and printed. 3. Every system that stores, processes or transmits it is in scope. Button: "We map it with you." Your scope decides what your CMMC work covers. cyberneza.com/cmmc.
November 1, 2026 at 9:00 PM
awsblogs.bsky.social
📰 New article by Tim Sandage, Michelle Peterson

Decoding DoD cybersecurity: CMMC, DFARS, and FedRAMP Equivalence demystified

#AWS #PublicSector
Decoding DoD cybersecurity: CMMC, DFARS, and FedRAMP Equivalence demystified
Whether you’re a prime contractor, a subcontractor deep in the supply chain, a managed service provider (MSP) supporting DIB clients, or a CSP hosting defense workloads, this post explains what’s required, who’s responsible, and how to build a compliance strategy that holds up under scrutiny. Because nearly every one of these pathways ultimately runs on cloud infrastructure, we also highlight where Amazon Web Services (AWS) and AWS GovCloud (US) fit. The foundation you build on shapes how achievable compliance becomes.
aws.amazon.com
October 29, 2026 at 11:11 PM
cyberneza.bsky.social
FCI or CUI: which one does your contract bring?
FCI only: CMMC Level 1. 15 safeguarding requirements, self-assessed every year, no POA&M.
CUI: CMMC Level 2. 110 NIST SP 800-171 requirements, a POA&M closed within 180 days.
https://cyberneza.com/cmmc
Cover slide over an aerospace composites room, with gloved hands smoothing carbon-fiber plies on an aircraft panel and an autoclave door glowing behind. Text: "FCI or CUI: which one does your contract bring? It sets your CMMC level. Here's how to tell." Cyberneza logo, cyberneza.com/cmmc, veteran-owned, 100% US-based. Slide titled "Know what you're holding." FCI, federal contract information: non-public information provided by or generated for the government under a contract, not public info or simple payment details. Clause: FAR 52.204-21. CUI, controlled unclassified information: information you must safeguard, marked or identified in the contract or developed to perform it, such as drawings and specs. Clause: DFARS 252.204-7012. Check for CUI markings and what you'll receive or create under the contract. Slide titled "Your contract sets your level." Level 1, FCI only: 15 basic safeguarding requirements; self-assessment and affirmation every year; no POA&M allowed. Level 2, CUI: 110 NIST SP 800-171 requirements; assessment every 3 years, affirmation every year; limited POA&M, closed within 180 days. Button: "See where you stand." cyberneza.com/cmmc.
November 2, 2026 at 10:17 PM
cyberneza.bsky.social
Central Florida builds for defense. We help it stay eligible.
If CUI comes through your contract: a current SPRS score, an SSP and POA&M that back it up, and a map of where your CUI lives.
Veteran-owned, 100% US-based, right here in Orlando.
https://cyberneza.com/contact
Cover slide over a military simulation and training lab at golden hour, with a flight simulator pod in front of a curved wall of terrain displays and windows showing palm trees and a city skyline at sunset. Text: "Central Florida builds for defense. We help it stay eligible. What a local subcontractor needs in place now." Cyberneza logo, cyberneza.com/contact, veteran-owned, 100% US-based. Slide titled "Orlando trains the warfighter." NAWCTSD: the Navy's principal center for simulation and training systems. PEO STRI: the Army's program office for simulation, training and instrumentation. Team Orlando: calls itself the world's largest cluster of simulation and training organizations. Local industry supports that work. When CUI comes with it, so does DFARS 7012. Slide titled "What a local subcontractor needs in place now." 1. A current SPRS score; DoD requires one to be considered for award. 2. An SSP and POA&M that back up that score. 3. A clear map of where your CUI lives. Button: "Talk to a local team." Veteran-owned, 100% US-based, right here in Orlando. cyberneza.com/contact.
November 2, 2026 at 6:56 PM
awsblogs.bsky.social
📰 New article by Tim Sandage, Michelle Peterson

Decoding DoD cybersecurity: Compliance guide for DIB organizations

#AWS #PublicSector
Decoding DoD cybersecurity: Compliance guide for DIB organizations
Defense industrial base (DIB) organizations working through Cybersecurity Maturity Model Certification (CMMC), Defense Federal Acquisition Regulation Supplement (DFARS), and Federal Risk and Authorization Management Program (FedRAMP) requirements struggle to know how to get started. The answer depends on your role in the defense supply chain and the type of information you handle.
aws.amazon.com
October 29, 2026 at 11:11 PM
govt-contracting.bsky.social
Time Is Running Short to Update DFARS Covered Materials Clauses
Time Is Running Short to Update DFARS Covered Materials Clauses
anuary 1, 2027, is less than three months away. On that date, Defense Federal Acquisition Regulation Supplement (DFARS) 252.225-7052 (MAY 2024)...
www.jdsupra.com
October 22, 2026 at 5:27 PM
cyberneza.bsky.social
CMMC myth: "We're small, so it doesn't apply to us."
Fact: Company size doesn't matter. If your contract includes DFARS 7012 or a CUI flow-down from your prime, the requirements apply.
Start with your contract: https://cyberneza.com/contact
#CMMC
October 21, 2026 at 3:00 PM
genaidefense.bsky.social
ML “contract clause drift monitor” for contracting teams: compares new FAR/DFARS updates to your templates + active mods, flags impacted clauses, and drafts a change log—cut rework hours & reduce compliance misses. Pilot on 1 vehicle? #DefenseTech #GovCon
October 20, 2026 at 7:31 PM
julstrangepork.bsky.social
Meta is a federal contractor. Their in-kind donation is a bribery scheme.

Congress must take action to address their violation on DFARS.
October 18, 2026 at 3:09 AM
julstrangepork.bsky.social
Meta is a federal contractor. Their actions to favor one political party is called bribery.

Push Congress to evaluate those contracts and work towards getting them canceled for violating FARS/DFARS.
October 18, 2026 at 3:25 AM
julstrangepork.bsky.social
Senator, Meta is a federal contractor. Why are they allowed to give in-kind donations to benefit one political party?

Isn't that called a bribery scheme? For what reason is their FARS/DFARS violation(s) not being evaluated by Congress?
October 18, 2026 at 3:14 AM
collabsharedtech.bsky.social
🔐 Would you play KnowledgeRoots™ Escape the GovCon Room™?

Teams solve GovCon challenges using FAR/DFARS regulations, collect numbers and letters, crack the final code and escape.

I'm exploring it as an interactive experience for GovCon conferences and summits.

Would you participate? YES or NO? 👇
October 18, 2026 at 3:11 AM
mikeblack114.bsky.social
the actual realistic answer is rigorous NISPOM and DFARS clause 252.226-7003 enforcement

the non-national security stuff is a political problem of dealing with a notional trillionaire generally, but the DoD stuff is pretty straightforward
jamellebouie.net jamelle @jamellebouie.net · 29d
is there anyone thinking/writing about the actual mechanics of disentangling the US government from elon musk?
October 12, 2026 at 6:00 AM
g-sharp-major.bsky.social
Would also not be surprised if there are issues regarding complaince with DFARS 252.204-7012 and 252.204-7020. And likely NDAA Section 889 as well.
October 12, 2026 at 2:27 PM
haydonmp.bsky.social
These tools were available to Biden, if musk was correctly viewed as the threat that he was.

DFARS 209.104-1 and FAR 9.104-1 -

Determines whether a contractor possesses sufficient integrity, business ethics, management capability, and operational controls
October 12, 2026 at 11:33 AM