What the September Cyber AB Town Hall Tells Contractors Preparing for CMMC Reform
CMMC is still running, and the Cyber AB's September Town Hall offered clues about where reform may go. They point toward security you can prove on any day.
When the Department paused CMMC Phase 2 in July, it left defense contractors with a hard question. Should they keep working on CMMC, or wait to see what changes?
At the end of September, the Cyber AB gave part of the answer. At its September 29 Town Hall, it said plainly that the CMMC program is not paused.
The Town Hall presenters also shared their best guesses about where reform is heading. They opened that part with "We know nothing" and labeled what followed as speculation. In our reading, their guesses point one way, toward security you can prove on any given day.
As an RPO, we get contractors ready for Level 2 assessments. From that seat, the direction of reform matters more than its details, and it should shape what you do next.
What is still running while CMMC is under review?
Start with what has not stopped. DFARS 7012 remains in force. C3PAOs are still running Level 2 assessments, and DIBCAC continues to assess C3PAOs and contractors. RPOs like us keep helping companies with NIST SP 800-171 work.
Certification kept moving, too. In September the Cyber AB counted 2,362 final Level 2 certificates, up 12%, and 117 authorized or accredited C3PAOs.
What is on hold is Phase 2, the step that makes third-party certification a condition of award. The Department paused it while it reviews the program. Your current duties are covered in our post on what still applies to defense contractors.
So the work goes on. The open question is what shape it will take after reform.
Where might CMMC reform be heading?
No one outside the Department knows yet. We found no public release of the task force's recommendations as of October 19, 2026.
At the Town Hall, Cyber AB CEO Matt Travis said the Department's changes were more likely to come at the end of October than in early October, according to an October 6 Inside Defense report.
At the Town Hall, the presenters offered their own read and labeled it speculation. They believe the Department of War (DoW) CIO's office dislikes point-in-time assessments that go stale quickly. They also think it dislikes the checklist feel of NIST SP 800-171 Rev 2, high costs, and bureaucracy.
Their list went further. They think the office also dislikes treating CUI protection as the DIB's top cybersecurity priority, over-marking of CUI, and the Risk Management Framework (RMF).
Over-marking matters more than it sounds. When too much is marked CUI, your boundary grows, and so does the cost of protecting it.
On the other side, they think the office favors continuous validation, automation, and resilience across the supply chain. It also favors NIST CSF 2.0, reciprocity with other frameworks, and bringing operational technology (OT) into scope.
The presenters also pointed to the Cybersecurity Risk Management Construct (CSRMC). The Department announced it in September 2025 to replace "snapshot in time" reviews of its own systems with continuous, automated risk management.
The CSRMC covers the Department's own systems, not contractors, so it does not bind you. It does show how the CIO's office prefers to check risk, which is a fair hint about what it may later ask of suppliers.
Put those pieces together and the direction is clear. Most of what the presenters think the office favors rewards security you can show works on any given day, on IT and OT alike.
What does Brilliant at the Basics ask contractors to do?
The presenters also listed Brilliant at the Basics among what they believe the office likes. It is a DoW CIO campaign for small, mid-sized, and non-traditional defense companies, and it boils good security down to two Top 10 lists.
It is guidance, not a new rule. The DoW says the content is for educational and informational purposes, and your DFARS 7012 and NIST SP 800-171 duties stay the same.
The IT Top 10
- Phishing-resistant multi-factor authentication (MFA)
- Asset inventory management
- Strategic technical debt reduction
- A flexible technology stack
- Logical segmentation to limit an attacker's lateral movement
- Risk-based vulnerability management
- Security built in early in development
- Secure AI adoption and data protection
- Resilient backup and disaster recovery
- Continuous technical workforce readiness
The OT Top 10
- Identity and access control
- Validated asset inventory
- Strict network segmentation
- An OT-specific incident response and recovery plan
- Managing known vulnerabilities
- Remote access pathways
- Continuous monitoring
- System resiliency
- Supply chain security
- Review processes
A company with a working 800-171 program has already done part of this work. Several items line up with Rev 2 requirements.
| Brilliant at the Basics item | Closest NIST SP 800-171 Rev 2 requirement | Where the gap sits |
|---|---|---|
| Asset inventory | 3.4.1, baseline configurations and system inventories | Lines up for systems inside your CUI scope |
| Segmentation | 3.13.1, protect communications at external and key internal boundaries | Lines up inside your CUI boundary |
| Vulnerability management | 3.11.2, scan for vulnerabilities periodically | Lines up with your scanning work |
| Phishing-resistant MFA | 3.5.3, multifactor authentication | Rev 2 does not require the MFA to be phishing-resistant |
| Backup and disaster recovery | 3.8.9, protect the confidentiality of backup CUI | Rev 2 has no contingency planning family |
The gaps sit in three places. Rev 2 asks for MFA, but it does not require it to be phishing-resistant. Rev 2 also has no contingency planning family, and its only backup requirement covers keeping backup CUI confidential. Tested backup and recovery go beyond it.
The third gap is the shop floor. If your machines and controllers sit outside your CUI boundary, they sit outside your 800-171 work today. The OT list brings them into view.
This mapping is our read of the two public documents. Your own gaps depend on where your CUI boundary sits. Those gaps matter even more if reform changes how CMMC is checked.
What would a hybrid CMMC assessment mean for you?
One idea raised at the Town Hall would change exactly that. "I could see a hybrid model," Matt Travis said, and he called the discussion speculative.
As Inside Defense described it, a third-party assessor would check a limited set of controls. The company would self-attest to the rest.
The presenters floated other ideas too, such as continuous monitoring, "compliance-as-code," compliance that scales with risk, FedRAMP integration, and NIST SP 800-171 Rev 3. They also saw a possible role for C3PAOs and RPOs in partial assessments, red teaming, and penetration testing.
If a hybrid model came, fewer controls would face an outside check. More would rest on your own signature, and testing of live systems could matter more. That puts even more weight on evidence you can stand behind at any time.
One more idea on their list was keeping the value of today's Level 2 certificates during any transition. None of these ideas is a rule yet.
What should you do while reform is still a guess?
Our advice is simple. Work to today's rules in a way that also fits where reform seems to be heading. These five moves do both.
-
Keep the 800-171 program running
Class Deviation 2026-O0025 (Revision 3, September 3, 2026) keeps NIST SP 800-171 Rev 2 as the baseline under DFARS 7012. Keep closing gaps and keep your SSP current.
-
Close the shared basics first
Asset inventory, segmentation, access control, and vulnerability management show up in Rev 2 and in Brilliant at the Basics. Work on them first. On the IT side, start moving toward phishing-resistant MFA.
-
Add the recovery work Rev 2 leaves out
Rev 2 asks you to protect backup CUI. Brilliant at the Basics asks for resilient backup and disaster recovery. Test a full restore and write down your recovery plan.
-
Find your OT if you run a shop floor
List the machines, controllers, and remote access paths on the floor. Then record where each one sits relative to your CUI boundary, and why.
-
Make evidence that stays current, and test live systems
Continuous validation and penetration testing both appear in the presenters' speculation. Refresh your evidence on a set schedule, and use penetration testing to confirm your controls work on live systems.
All five moves pay off under today's rules. They also fit the main direction the presenters described, toward security you can show at any time.
Frequently Asked Questions
Will my Level 2 certificate still count after reform?
No one knows yet. The Town Hall presenters listed keeping the value of Level 2 certificates as a possible idea, and they stressed it was speculation. Until the Department decides, keep the program behind your certificate running so your evidence stays current.
Is Brilliant at the Basics a new CMMC requirement?
No. It is a DoW CIO campaign with two Top 10 lists, and the DoW says the content is educational and informational. Your DFARS 7012 and NIST SP 800-171 duties stay the same.
Does Brilliant at the Basics cover OT on the shop floor?
Yes. It has a separate OT Top 10. That list includes identity and access control, validated asset inventory, strict segmentation, an OT incident response and recovery plan, remote access pathways, and continuous monitoring.
What is a hybrid CMMC assessment?
It is a speculative idea. At the September 29, 2026 Town Hall, Cyber AB CEO Matt Travis said he "could see a hybrid model." As Inside Defense described it, a third party would check a limited set of controls, and the company would self-attest to the rest.
The bottom line
So, should you keep working on CMMC while the Department decides? Yes. The program is still running, and the reform signals from the Town Hall lean toward security you can show on any day.
A program built on the shared basics, tested recovery, and current evidence is well placed for whatever comes next. InterSec prepares contractors for assessment, and an authorized C3PAO conducts the Level 2 assessment and issues the certificate.
The practical next step is a CMMC readiness review that checks your controls and evidence against NIST SP 800-171 and both Brilliant at the Basics lists. Many providers offer one. Pick one that asks to see a control working, not just the policy that describes it.
The next Cyber AB Town Hall is set for October 27, 2026. If the task force publishes its recommendations before then, we will update this post.
This article provides general information about CMMC requirements and timelines. It is not legal advice. Consult your compliance or legal team for final interpretation of how these requirements apply to your specific contracts and obligations.
See where your program stands against both lists
As an RPO, we check your controls and evidence against NIST SP 800-171 and both Brilliant at the Basics lists, then rank the gaps so you know what to close first.