The CMMC Reform RFI Closes Tomorrow at Noon — And DOJ Never Paused
Compliance Pulse · Thursday, August 13, 2026
Most contractors read July's CMMC suspension as breathing room. The comment window that could actually reshape the program closes tomorrow at noon Eastern — by email, with no portal and no extension mechanism. Meanwhile the enforcement arm that never paused just posted its first settlement of the fiscal year.
DoW: Seven Questions, Five About Cost, Twenty-Four Hours Left
The Department of War issued its RFI, “Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base,” on July 14. Responses are due at 12:00 p.m. Eastern on Friday, August 14 — noon, not midnight. Submission is by email to the addresses published by SBA's Office of Advocacy. There is no regulations.gov docket, so there is no portal to wait on.
Five of the seven questions ask about cost, administrative burden, or reform. The Department asked the defense industrial base to price its own compliance — a question a small subcontractor can answer better than any prime. Dollar figures, hours, and named controls carry weight. Adjectives do not. The Task Force reports to the Department CIO around mid-September.
Bottom line for small and mid-size DIB suppliers: this is the rare moment your cost data outranks a prime's opinion — and it expires tomorrow.
DOJ: The Civil Cyber-Fraud Initiative Is Running at Full Speed
On June 18, LOGZONE Inc., a Huntsville defense contractor, agreed to pay $507,144 to resolve allegations that it knowingly failed to satisfy cybersecurity requirements on two Navy contracts between 2021 and 2025. DOJ alleged unimplemented NIST SP 800-171 controls. The claims are allegations only; there was no determination of liability. DCMA's DIBCAC assisted.
It is the first publicly reported cyber-fraud settlement of this fiscal year. DOJ recovered $52 million across nine cyber settlements in the prior fiscal year, and these resolutions have more than tripled in each of the last two years. DOJ's own framing matters here: these cases are not about breaches. They are about misrepresentations.
Bottom line for CEOs and general counsel: your SPRS score is a representation to the government, and it is discoverable.
What This Means for Security and Business Leaders
Suspending Phase 2 removed the assessor, not the exposure. A C3PAO certificate was never only a compliance artifact — it was corroboration sitting between your self-attestation and someone else's theory of the case. That corroboration is gone, and the signature it supported still binds. DFARS 7012, FAR 52.204-21, 800-171 Rev 2, SPRS postings, and annual affirmations are all untouched. Maritime operators run the same logic toward July 16, 2027.
A pause in verification is not a pause in liability. It is the same obligation with fewer witnesses.
If you are filing before noon tomorrow, the most useful thing you can put on the record is a real number. What did your last assessment actually cost you?
