Cybersecurity News

Elbit Systems of America has issued guidance to its suppliers following the Department of War’s suspension of the transition to CMMC Phase II. The letter emphasizes that existing cybersecurity requirements remain in effect and encourages organizations to continue implementing NIST SP 800-171, maintaining required documentation, and preparing for future CMMC Level 2 assessment requirements. 

The full letter is available below and provides additional details.

Read the letter by Elbit Systems of America: CMMC Phase II Suspension – Stay the Course

The CYBER AB responded to the Department of War’s decision to suspend CMMC Phase ll implementation requirements while a newly established CMMC Reform Task Force conducts a 60-day review of the program.

The CYBER AB states it was surprised and disappointed by the pause but remains confident that the CMMC program has demonstrated its value through measurable progress and the significant investments made by the DIB and CMMC ecosystem. It also stated that they will cooperate fully with the task force during the review.

To learn more about the statement released by the CYBER AB visit their website here: Statement on the Department of War’s Suspension of CMMC Phase II Requirements – CyberAB.

In a supplier notice titled “Maintaining Cybersecurity Maturity Model Certification Status,” Lockheed Martin directed active suppliers to document their CMMC status in the DoD’s SPRS (at least a Final Level 1 self-assessment, and Final Level 2 where CUI is in scope), share that status with Lockheed Martin through the Cybersecurity Compliance Attestation (CCA) in Exostar Supplier Management, and keep it current with annual affirmations and assessments within required timeframes. Cybersec Investments performs accredited CMMC Level 2 assessments to help suppliers meet and maintain these requirements.

Read the Lockheed Martin release →

L3Harris Technologies notified suppliers of CMMC requirements tied to DoD contracts. Suppliers handling CUI may be required to obtain CMMC Level 2 certification depending on contract requirements, with applicable suppliers asked to submit proof of certification by July 30, 2026. Cybersec Investments performs accredited CMMC Level 2 assessments to help suppliers meet these requirements.

The GSA Blog published a comprehensive guide on CMMC — covering the certification levels, requirements, and how to prepare. The CMMC sets cybersecurity standards for federal contractors. Cybersec Investments is available for a CMMC Level 2 Assessment.

Elbit Systems of America shared an important supplier notice regarding CMMC Level 2 certification. If your organization may be impacted, Cybersec Investments is available to assist with any questions.

Elbit Systems of America informed suppliers that CMMC compliance is now mandatory. Level 2 certification from a C3PAO is required to continue receiving purchase orders and meet contractual flow-down requirements. Key actions: schedule a CMMC Level 2 assessment, update SPRS Cyber Reports, and pursue Level 2 certification to create new supply chain opportunities.

Lockheed Martin required all active suppliers to submit their CMMC status via a Cybersecurity Compliance Attestation (CCA) in Exostar. Suppliers handling sensitive information with Moderate or Significant risk ratings should complete their CCRA questionnaire and conduct a CMMC readiness assessment. Cybersec Investments provides CMMC and SCF assessments to help suppliers build a clear compliance roadmap.

The DoD officially published the final rule for CMMC under 48 CFR, integrating it into federal acquisition regulations. CMMC certification is now a mandatory requirement for new contracts involving CUI, marking a significant milestone in federal cybersecurity standards. Cybersec Investments performs accredited CMMC Level 2 and SCF assessments in alignment with the new requirements.

Elbit America released an important communication to its supplier community: if business requirements necessitate sharing CUI with a supplier, that supplier will be required to achieve CMMC Level 2 certification as defined in CFR § 170.17. Non-COTS technology suppliers must immediately conduct a Level 1 self-assessment and affirmation within the Supplier Performance Risk System (SPRS).

RTX required all suppliers supporting applicable DoD contracts to maintain an active CMMC certification with final DFARS clause 252.204-7021 effective November 10, 2025. Suppliers must report certification status in the DoD SPRS, maintain six years of evidence, and keep annual registrations current. Level 1 requires full implementation of 15 controls; Levels 2 & 3 protect CUI with POA&M accepted for certain requirements but must be closed within 180 days.

Leonardo DRS released a notice to suppliers about upcoming CMMC 2.0 requirements appearing in select DoD contracts on November 10, 2025. Suppliers with the DFARS 252.204-7012 clause should anticipate a CMMC Level 2 (C3PAO Certified) requirement within two years. Leonardo DRS recommended suppliers close open POAM items, maintain a NIST 800-171 score of 110/110, and engage with authorized C3PAOs through the CyberAB Marketplace.

Lockheed Martin moved to ensure suppliers are prepared for CMMC Level 2 with an effective date of November 9, 2025. Suppliers with Moderate or Significant risk ratings in Exostar’s CCRA should complete or update their questionnaire, close NIST 800-171 gaps, and conduct a CMMC readiness assessment. Cybersec Investments provides CMMC and SCF assessments to help suppliers evaluate readiness and build a clear compliance roadmap.

Boeing released an official letter to suppliers outlining expectations for CMMC compliance. The notice emphasizes that protecting Controlled Unclassified Information (CUI) is essential and that suppliers must demonstrate CMMC readiness to remain eligible for future contracts. Cybersec Investments performs independent CMMC and SCF assessments to help organizations measure compliance posture and prepare for upcoming contract requirements.

The DoD officially published the final DFARS rule integrating CMMC into federal contracts. Key details: published September 10, 2025; effective November 10, 2025; phased rollout across contracts; affects all contractors handling FCI or CUI. Organizations should conduct a readiness assessment, build a compliance roadmap, and prepare for phased implementation.

The Department of Defense officially rolled out the CMMC program with the DFARS rule published in the Federal Register. Phase 1 starts November 10, 2025. Project Spectrum provides free resources — training, self-assessments, and guidance from cybersecurity experts — to help small and mid-sized defense supply chain companies prepare.

The 48 CFR rule, a critical regulation tied to CMMC, was officially sent to the OMB for review — signaling the final stages of rulemaking before CMMC becomes enforceable across DoD contracts. Once OMB completes review and the rule is published in the Federal Register, CMMC requirements will start appearing in new solicitations impacting contractors working with CUI.

Lockheed Martin released a letter to their supply chain emphasizing the importance of getting in line for a CMMC Assessment. Defense contractors in the Lockheed Martin supply chain should act now to ensure compliance and avoid supply chain disruptions.

Read the Lockheed Martin release →

CMMC 2.0 completed its 60-day Congressional Review period without any changes. Rulemaking is now complete and the new program is in effect. Companies should begin working towards their CMMC certifications and C3PAOs can begin assessments in accordance with the guidance in the rule.

The Department of Defense (DoD) 48 CFR proposed CMMC rule was published in the Federal Register. Comments on the proposed rule should be submitted on or before October 15, 2024.

The Office of Information and Regulatory Affairs (OIRA) concluded its review of the 48 CFR proposed CMMC rule — the contract clause that will be added to a defense contractor’s contractual agreement (DFARS 252.204-7021). The next step is publication in the Federal Register and a public comment period.

The Department of Defense submitted the CMMC Program rule to OIRA for final review and publication. OIRA has 90–120 days to review, putting the publication date between late September through late October. Once published in the Federal Register, the rule will be effective 60 days later, making the CMMC Program official.

DoD plans to start the CMMC rollout in Q1 2025. Organizations should begin preparing now to ensure readiness when the rule takes effect.

The long awaited NIST SP 800-171 revision 3 and NIST SP 800-171A revision 3 have been published — establishing updated cybersecurity requirements for protecting CUI in nonfederal systems and organizations.

The DoD released a class deviation on DFARS 252.204-7012 to require contractors to comply with NIST SP 800-171 rev. 2, which will remain in effect until rescinded instead of the NIST SP 800-171 “in effect at the time the solicitation is issued or as authorized by the Contracting Officer.”

The Cybersecurity Maturity Model Certification (CMMC) Program rule has been published to the Federal Register. This marks an important milestone in the formalization of CMMC requirements for defense contractors.