Health Net Never Had a CMMC Deadline
The Department of War suspended third-party certification on July 13. The mechanism that cost Health Net's parent eleven million dollars was never part of it, and the network that mechanism asks you to vouch for is changing faster than the document describing it.
Friends,
On July 13, the Department of War suspended CMMC Phase II. Kirsten Davies, the department's chief information officer, and Michael Duffey, the Under Secretary of War for Acquisition and Sustainment, announced it together. Phase II was the phase that would have required third-party certification, and it was four months out, scheduled for November 10. A sixty-day task force now has the program. The department declined to rule out cancelling it outright.
The rationale was blunt and it was correct. Current and future requirements, the department said, are creating prohibitive compliance costs and unacceptable bureaucratic burdens, especially to small businesses, and driving them away from doing business with the department. Davies put future phases above $7 billion a year for small and medium firms. SBA priced the all-in cost near $593,800 per certification across more than 100,000 small businesses, and Administrator Kelly Loeffler described costs approaching as much as $600,000.
The trade press ran it as relief. Most of the Defense Industrial Base read it the same way. That reading is half right, and the wrong half is the half carrying legal exposure.
Because on February 18, 2025, Health Net Federal Services and its parent, Centene, agreed to pay $11,253,400 to the Department of Justice. The allegation was that Health Net falsely certified cybersecurity compliance in annual reports to the Defense Health Agency, under its contract to administer TRICARE, between 2015 and 2018.
There was no CMMC in 2015. There was no C3PAO. There was no Phase II. There was a contract, a security requirement, and an annual certification with a signature on it.
That is the entire mechanism. Nothing announced on July 13 touched it.
What stopped, and what did not
One thing stopped. The C3PAO. Program offices can no longer designate third-party assessment. Existing C3PAO and DIBCAC designations come back out of contracts. No new waivers. Going forward a program office may designate Level 1 self-assessment or Level 2 self-assessment, and that is the menu.
Everything else stands.
DFARS 252.204-7012 is still in the contract. NIST SP 800-171 Rev. 2 still carries 110 controls across 14 families. The System Security Plan is still required. So is the POA&M. So is the SPRS score. Phase I self-assessments continue on schedule. DIBCAC can still run a government-led assessment at any time, on any contract, without a phase telling it to. And the Justice Department's Civil Cyber-Fraud Initiative did not pause for anybody.
Then there is the affirmation.
The Affirming Official
32 CFR 170.22 requires an annual affirmation at every level, on its own clock, independent of any assessment. A named human being inside the company attests in SPRS that the organization has implemented and will maintain implementation of all applicable CMMC security requirements. The rule gives that human a title and a definition.
Affirming Official: the senior level representative from within each Organization Seeking Assessment who is responsible for ensuring compliance and who has the authority to affirm continuing compliance. When the DFARS acquisition rule was finalized last September, it deliberately swapped the older phrase "senior company official" for this one. Somebody in a rulemaking sat down and decided this needed to be a person with a name.
At a prime, that person is a compliance director with a lawyer down the hall. At a twelve-person shop, the rule's senior level representative is the owner. The same person who quotes the work, runs payroll, and is on the floor by seven.
Before July 13, an assessor was going to arrive on a known date and test that statement against the network. The arrival now has no date. The statement over her name is unchanged.
What Health Net actually did
Read the allegations, because the shape matters more than the dollar figure.
Between 2015 and 2018, per the Justice Department, Health Net failed to timely scan for known vulnerabilities and to remedy security flaws on its networks, in accordance with its own System Security Plan and the response times it had set for itself. It ignored reports from third-party auditors and its own internal audit department: access controls, firewalls, end-of-life hardware still in use, patch management, vulnerability scanning, password policies. Then it certified compliance to DHA. Annually. In writing. Justice alleged it falsely attested to at least seven security controls.
Health Net and Centene denied everything, admitted no liability, and maintain that no vulnerability was exploited, no breach occurred, and no servicemember data was lost. They settled to avoid protracted litigation. Hold that in frame, because it is true and it is the point. No breach was required. The false statement was the violation.
Note who investigated. Justice's Fraud Section and the U.S. Attorney for the Eastern District of California, with the DoD Inspector General, the Defense Criminal Investigative Service, and DCMA's Defense Industrial Base Cybersecurity Assessment Center. DIBCAC worked a False Claims Act case seven years after the conduct, on a contract with no CMMC in it, in a program that did not exist. Its authority did not come from Phase II, and it cannot be suspended by suspending Phase II.
The mechanism was never the auditor
The False Claims Act needs a false statement material to payment. It does not need an audit, a phase, or a certification program. The annual affirmation is the statement. The contract is the payment. Justice has settled at least ten of these since standing up the Civil Cyber-Fraud Initiative in October 2021, seven in 2025 alone: Health Net at $11.25 million, MORSECORP at $4.6 million on Army and Air Force work, Raytheon at $8.4 million, Illumina at $9.8 million over genomic sequencers, an Alabama defense contractor at $507,144.
Large primes and twelve-person shops. Weapons work and genome sequencers. The through-line is a statement somebody signed.
Qui tam is how those statements surface. Sheppard Mullin counted 980 False Claims Act qui tam filings in FY2024 and 1,300 in FY2025. Relators recover 15 to 25 percent. Treble damages, plus per-claim penalties from $13,946 to $27,894. Run that against a twelve-person shop and the arithmetic stops being abstract.
The relator is rarely the government. Holland & Knight put it plainly in January: IT staff, compliance officers, and security personnel are the people positioned to see the gap between the certification and the network. Health Net ignored its own internal auditors for three years, and the auditors were in the building the whole time. None of them report to DIBCAC, and none were affected by anything announced on July 13. The Administrative False Claims Act, effective December 2024, now lets agencies pursue smaller cases without waiting for Justice at all.
The bet on cancellation
The honest counterargument: the department put cancellation on the table itself, so standing down is rational and everyone who paid for readiness bought a certificate for a test that is no longer scheduled.
Look at what was suspended. Phase II is a CMMC construct, living in 32 CFR Part 170 and the DFARS acquisition rule finalized September 10, 2025. DFARS 252.204-7012 came from neither. It was finalized October 21, 2016, under DFARS Case 2013-D018, and it set a hard deadline of December 31, 2017 for implementing NIST SP 800-171. The clause has carried that obligation on its own authority for nearly a decade. CMMC built a verification layer on a duty that already existed.
Cancel CMMC tomorrow and 7012 stays in the contract. So does 800-171. So does the System Security Plan. So does the annual affirmation flowing down to every subcontractor. The RFI on SAM.gov is titled "Reforming CMMC and Reducing Compliance Burden for the DIB," and it asks about the program.
Health Net's contract had no CMMC clause in it and Justice collected $11,253,400 anyway.
Why the math broke
Davies said it plainly. The math just simply doesn't math.
Roughly 107 authorized C3PAOs as of June, against more than 100,000 small businesses in scope. Fewer than 300 companies held a Level 2 certification as of August 2025. At the end of 2025, under one percent of the Defense Industrial Base was certified. Phase II opened November 10, 2026.
GAO put this in writing four months before the department acted. Report GAO-26-107955, March 12, found the department had only partially addressed three external factors: assessor ecosystem capacity, program demand and attrition, and the drift between NIST revisions. The department concurred and held a small-business roundtable the same day.
The cost figures carry the same signature. The department's own regulatory impact analysis priced a Level 2 third-party assessment at $104,670 for a small entity over three years, inside a program it estimated at roughly $4 billion a year to industry. SBA priced the same requirement at $593,800. SBA counted the readiness work, the tooling, the managed service provider, the remediation. The department counted the audit. Both numbers are honest and they measure different things, which is its own finding: the government has never agreed with itself about what its own rule costs.
The Cyber AB, the sole authorized accreditation partner, grew its assessor corps from 633 in December to more than a thousand by June. Per DefenseScoop, it was not told before the announcement.
The network is not the network in the plan
Here is the part that should worry anyone building health IT or medical devices for this department.
A firm that cannot afford $593,800 cannot afford a compliance director either. It can afford twenty dollars a month for a model. On r/CMMC the practitioners are candid: one describes using ChatGPT to draft policies and procedures, adjusting heavily, treating it as a foundation. That is a rational answer to an impossible cost curve. Read the warning three threads over, from people who just passed a Level 2 assessment: validate all AI-generated text against actual operations, because the risk is the model includes tools or processes that do not exist in practice.
So the model writes an excellent System Security Plan. It describes a patch management program, an asset inventory, quarterly access reviews. Every control reads correctly, because the model has read ten thousand documents that describe controls correctly. The owner recognizes nothing obviously false and affirms it in SPRS.
There is a second bill inside that shortcut. System Security Plans for defense contractors routinely contain CUI, which rules out most commercial SaaS models and pushes a firm toward FedRAMP-scoped or self-hosted deployment. The twenty-dollar tool reached for because $593,800 was impossible has now put CUI somewhere new, inside the document that describes how the firm handles CUI. Akash Mandavilli, who sells AI compliance tooling and is worth reading against his own interest, says the other half out loud: the AI said so is not an acceptable audit trail.
That is the documentation problem. The infrastructure problem is worse.
Veracode has now tested more than 150 large language models across four languages, and 45 percent of AI-generated code fails security tests. Cross-site scripting fails 86 percent of the time. Log injection, 88 percent. Their March 2026 update ran under the headline "Despite Claims, AI Models Are Still Failing Security," and the finding was that the pass rate has been flat near 55 percent across the entire testing period, while coding benchmarks climbed the whole time. The models got better at writing code and no better at writing safe code. CodeRabbit puts AI-generated pull requests at 2.74 times the vulnerability density of human ones. Apiiro, across Fortune 50 enterprises, found 322 percent more privilege escalation paths and a 40 percent jump in exposed secrets.
Then there is the finding that should stop you. In a controlled study, developers using AI assistants wrote measurably less secure code and rated their own insecure solutions as secure. Perry and colleagues called it a false sense of security.
That is the affirmation, in a lab, before anyone opens SPRS.
Now put the tool itself on the network. On July 7, Sysdig's Threat Research Team published what it assesses as the first documented case of agentic ransomware. It named the operator JADEPUFFER. The entry point was an internet-facing Langflow server, the open-source framework companies use to build LLM applications and agent workflows, through CVE-2025-3248, a missing-authentication flaw that lets an unauthenticated attacker run arbitrary Python. From there an LLM agent dumped Langflow's own database, harvested API keys and cloud credentials from the environment, walked a MinIO object store still running on default credentials, pulled files named credentials.json and .env, installed a cron job beaconing every thirty minutes, and pivoted to a production MySQL server. It encrypted 1,342 configuration records and dropped the originals. Six hundred distinct payloads. At one point it failed a login, diagnosed the failure, regenerated the hash, and confirmed access in thirty-one seconds.
None of the techniques were new, and a human still pointed the operation: Sysdig's Michael Clark told CyberScoop that a person provisioned the infrastructure and chose the victim. What the agent supplied was the chaining, at a tempo no defender was going to match. Sysdig's own read is that Langflow servers are attractive precisely because they are AI-adjacent, frequently hold provider keys and cloud credentials, and are often stood up quickly without network controls.
That is a description of every AI pilot in every small business in this country.
Now the two facts that close the circle. CVE-2025-3248 was patched April 1, 2025 and added to CISA's Known Exploited Vulnerabilities catalog in May 2025. The box that got owned was more than a year behind on a publicly catalogued flaw. Health Net's entire $11.25 million case was failure to timely scan for known vulnerabilities and remediate them. Same control family. One firm certified compliance and paid Justice. The other lost its production database. Neither had an assessor coming.
And the standard the affirmation is written against, NIST SP 800-171 Revision 2, was published in February 2020. Revision 3 came out in May 2024 and is still not tied to CMMC. Class Deviation 2024-O0013 holds Rev. 2 in place until rescinded, with no transition expected before 2027. GAO named the drift in March as one of its three unaddressed factors.
So walk it through. A twelve-person firm signs a statement, against a standard from February 2020, describing a network boundary drawn before agentic tooling existed, in a document a model may have written, covering code a model may have generated at a 45 percent flaw rate, on infrastructure that includes a demo box somebody stood up last Tuesday with a live API key in its environment and no entry in the asset inventory.
The Langflow instance is not in the System Security Plan. It was never in scope, because the standard that scope was drawn against was published in February 2020.
And on July 13 the department cancelled the only scheduled event that would have gone looking.
What the schedule taught
Count the firms that did the right thing. They stood up the enclave. They bought GCC High. They hired the managed service provider. They pulled the owner off revenue work for six weeks to write the plan. They did it because November 10 was a real date in a final rule. One MSP practitioner, the day after: invested in the enclave, and the deadline seems to have disappeared without a trace.
The firms that waited are in a better cash position than the firms that complied. That is the lesson the department just taught, and it will outlive the task force report.
The other side is not weak. Contractors have carried 7012 since 2017, and the intellectual property walking out the door goes to China. Someone on r/GovernmentContracting put the sharpest version: this is the Department of Defense, not the Department of Propping Up Small Businesses, and the complaint arrived days after an adversarial nation-state cyber attack. Both are true. The requirement is legitimate, the bill is unpayable, and the department resolved that tension by removing the part that checks. One March roundtable reported 10 to 12 percent of its small-business clients leaving defense work, which is one roundtable's client base and not a market rate.
Where this lands in defense health
DFARS 7012 does not ask what kind of controlled unclassified information it is.
Health Net is the proof. DHA's TRICARE program, health data belonging to military families, a certification that went to DHA, DIBCAC among the investigators, three years before the CMMC program rule published. Illumina extends it past the network and into the product: the first significant False Claims Act resolution against a health technology manufacturer over cybersecurity defects designed into the device.
GAO puts the Defense Industrial Base near 200,000 private companies, roughly three quarters small, and the defense health supply chain sits inside that count. No health-specific breakout has been published and I am not going to build one out of inference, so take the narrower claim, which is sufficient: the software shop supporting a military treatment facility signs the same affirmation as the machine shop making brackets. Same clause. Same statute. Fewer people to prepare it, an AI drafting the plan, an AI writing the code, an AI server holding the keys, and a data set Justice has already shown it will litigate over.
Two federal agencies spent six months establishing that compliance is too expensive for small defense health firms. One spent $11.25 million establishing what happens when they say they complied and did not.
Four weeks
The task force reports around mid-September. Before that, the RFI closes at 12:00 PM Eastern on August 14, the only formal channel between the Defense Industrial Base and a task force with authority to rebuild or bury this program. My read is that the firms holding the best cost evidence are the least likely to use it, for the same reason they could not afford the assessment. At twelve people, the staff position whose job is writing to the government does not exist.
Four things worth doing before the fourteenth.
File anyway. Trade associations will file. C3PAOs holding idle assessors will file. Vendors selling readiness will file at length, with pricing attached. Two pages with real invoices from a firm that lived it outweigh most of them, and it costs an afternoon.
Read your own affirmation. Open SPRS. Read the statement you signed last cycle, slowly, next to your actual System Security Plan. Health Net's problem was not that it lacked a plan. It had one, with response times it wrote itself, and it did not meet them, and it certified that it had. If your two documents disagree, July 13 did nothing for you, and the gap between them is what a relator gets 15 to 25 percent of.
Inventory the AI. Every model endpoint, every agent framework, every demo box, every API key sitting in an environment variable. Check that list against your System Security Plan. Whatever is on the first list and not the second is out of scope, unassessed, and inside your boundary anyway. That is where JADEPUFFER came in.
Price the pause honestly. The money for the C3PAO is genuinely freed, and that relief is real and worth taking. The money for the controls was never a CMMC cost. It was a 7012 cost wearing a CMMC deadline, and the deadline is the only thing that went away.
The signature
Somewhere this week an owner is going to open SPRS, find the affirmation field, and feel the pressure come off.
She is right about the assessor. The assessor is not coming on November 10. She is right that the department heard her, because it said so out loud, in her language, about prohibitive costs and firms driven away from the work. Loeffler put her at $600,000. Davies said the math doesn't math. For once the record agrees with the small business, and that is not nothing.
The field still wants her name. The rule calls her the senior level representative and means the person with authority to promise, and in a twelve-person company that person is her. The statement over her name says the organization has implemented and will maintain implementation of all applicable security requirements. It says that today exactly as it said it on July 12, about a network that has three new AI tools on it since the plan was written.
Health Net signed a version of that sentence every year from 2015 to 2018. It had a compliance department. It had internal auditors, and the auditors told it, and it kept signing. Seven years later the Justice Department collected $11,253,400, and the contract that sentence was written under never contained the word CMMC.
The task force got sixty days. She got the same signature line she had last month, four weeks to tell somebody what it costs her, and a demo server that has not been patched since April.
Let's roll.
— Mary
Mission Meets Tech
The views expressed in this newsletter are my own and do not represent the official position of any organization. This content is for informational purposes only.
MMT Premium
This issue reads the exposure. The companion Capture Corner works the window: how to build an RFI response the task force will actually use before the August 14 close, what the record fills with if small firms sit it out, which cost lines carry evidentiary weight versus which read as complaint, how to separate 7012 spend from CMMC spend on paper so the relief you claim is the relief you get, the AI scope audit a capture lead should run on every teaming partner before the next award, and what the mid-September report is most likely to move first.
Founding Member rate: $199/year, locked permanently for the first 100 subscribers.
Standard rate: $249/year or $29/month.
Premium adds 48-hour early access to deep-dive analysis, monthly Capture Intelligence Sheets with sourced action windows, direct Q&A access (reply to any premium issue), and tool discounts: ProposalPulse $14.99 per assessment, MarketPulse $35 per brief.
Subscribe at missionmeetstech.com/pricing.
Sources
[1] Department of Justice, Office of Public Affairs, "Health Net Federal Services, LLC and Centene Corporation Agree to Pay Over $11 Million to Resolve False Claims Act Liability for Cybersecurity Violations," February 18, 2025. https://www.justice.gov/opa/pr/health-net-federal-services-llc-and-centene-corporation-agree-pay-over-11-million-resolve
[2] Department of Justice, Eastern District of California, parallel release on the HNFS settlement, February 18, 2025. https://www.justice.gov/usao-edca/pr/health-net-federal-services-llc-and-centene-corporation-agree-pay-over-11-million-0
[3] Department of Justice, "Fact Sheet: False Claims Act Settlements and Judgments, Fiscal Year 2025." https://www.justice.gov/opa/media/1424126/dl
[4] Department of War, "War Department Changes Cybersecurity Maturity Model Certification Requirements," July 13, 2026. https://www.war.gov/News/News-Stories/Article/Article/4542849/war-department-changes-cybersecurity-maturity-model-certification-requirements/
[5] Small Business Administration, "SBA Commends U.S. Department of War's Suspension of CMMC Phase II for Small Defense Contractors," July 13, 2026. https://www.sba.gov/article/2026/07/13/sba-commends-us-department-wars-suspension-cmmc-phase-ii-small-defense-contractors
[6] DefenseScoop, "DOD halts CMMC cybersecurity requirements Phase 2," July 13, 2026. https://defensescoop.com/2026/07/13/dod-halts-cmmc-cybersecurity-requirements-phase-2/
[7] Crowell & Moring, "Department of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review," July 2026. https://www.crowell.com/en/insights/client-alerts/department-of-war-immediately-suspends-cmmc-phase-ii-requirements-launches-60-day-reform-review
[8] SAM.gov, RFI, "Reforming CMMC and Reducing Compliance Burden for the DIB," responses due August 14, 2026, 12:00 PM ET. https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view
[9] Government Accountability Office, GAO-26-107955, "Cybersecurity Maturity Model Certification," March 12, 2026. https://business.cch.com/CybersecurityPrivacy/gaocmmcreport.pdf
[10] eCFR, 32 CFR 170.22 ("Affirmation") and 170.4 (definition of Affirming Official). CMMC Program Rule, 89 FR 83092, published October 15, 2024, effective December 16, 2024. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.22
[11] Federal Register, "DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)," 90 FR 43560, September 10, 2025. https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
[12] Federal Register, "DFARS: Network Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-D018)," final rule establishing DFARS 252.204-7012, October 21, 2016; NIST SP 800-171 implementation required not later than December 31, 2017. https://www.federalregister.gov/documents/2016/10/21/2016-25315/defense-federal-acquisition-regulation-supplement-network-penetration-reporting-and-contracting-for
[13] Holland & Knight, "CMMC Affirmation Trap: FCA Exposure for Defense Contractors and Acquirers," January 2026. https://www.hklaw.com/en/insights/publications/2026/01/cmmc-affirmation-trap-fca-exposure
[14] Arnall Golden Gregory, "DOJ Sharpens Focus on Cybersecurity Compliance in Healthcare: Illumina FCA Settlement Signals Broader Trend," August 2025. https://www.agg.com/news-insights/publications/doj-sharpens-focus-on-cybersecurity-compliance-in-healthcare-illumina-fca-settlement-signals-broader-trend/
[15] Inside the False Claims Act, "False Claims Act Settlements to Know from the First Half of 2025" (MORSECORP, March 26, 2025; Raytheon, May 1, 2025). https://www.insidethefalseclaimsact.com/false-claims-act-settlements-to-know-from-first-half-of-2025/
[16] Sheppard Mullin, "DOJ's FOCUS Initiative: False Claims Act Qui Tam Complaints Derived from Data Mining," May 5, 2026. https://www.sheppard.com/insights/blogs/dojs-focus-initiative-false-claims-act-qui-tam-complaints-derived-from-data-mining
[17] Tycko & Zavareei, via National Law Review, "Not Much of a Thank You: TRICARE Contractor Resolves $11M False Claims Act Liability for Known Cybersecurity Violations," March 14, 2025 (treble damages; per-claim penalties $13,946–$27,894). https://natlawreview.com/article/not-much-thank-you-tricare-contractor-resolves-11m-false-claims-act-liability-known
[18] Sysdig Threat Research Team (Michael Clark, Director of Threat Research), "JADEPUFFER: Agentic ransomware for automated database extortion," July 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
[19] CyberScoop, "Sysdig clocks first documented case of agentic ransomware," July 2026 (attack occurred late June 2026; human provisioned C2, staging, and victim selection). https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/
[20] BleepingComputer, "JadePuffer ransomware used AI agent to automate entire attack," July 2026 (CVE-2025-3248 patched April 1, 2025; CISA KEV early May 2025; 1,342 Nacos configuration items encrypted; 31-second failure recovery). https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/
[21] NIST National Vulnerability Database, CVE-2025-3248 (Langflow /api/v1/validate/code missing authentication, CVSS 3.1 base score 9.8, versions prior to 1.3.0).
[22] Veracode, "Spring 2026 GenAI Code Security Update: Despite Claims, AI Models Are Still Failing Security," March 2026 (150+ LLMs evaluated; pass rate flat near 55%; reasoning models 70–72%). https://www.veracode.com/blog/spring-2026-genai-code-security/
[23] Veracode, 2025 GenAI Code Security Report (100+ LLMs, 80 tasks, Java/Python/C#/JavaScript; 45% overall security failure; CWE-80 cross-site scripting 86% failure; CWE-117 log injection 88%; Java 29% pass rate, a 71% failure rate). https://www.veracode.com/blog/ai-generated-code-security-risks/
[24] Cloud Security Alliance AI Safety Initiative, "AI-Generated Code Vulnerability Surge," April 4, 2026 (Veracode figures; CodeRabbit 2.74x vulnerability density; Apiiro Fortune 50 findings: 322% more privilege escalation paths, 153% more design flaws, 40% increase in secrets exposure). https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/
[25] Perry et al., user study on AI code assistants and developer security behavior ("significantly less secure code"; "false sense of security"), as surveyed in "Security Degradation in Iterative AI Code Generation," arXiv 2506.11022. https://arxiv.org/pdf/2506.11022
[26] GovEagle (Akash Mandavilli), "AI and CMMC Assessments: Realistic Applications," June 24, 2026 (vendor source; SSPs contain CUI, ruling out most commercial SaaS AI). https://www.goveagle.com/blog/ai-cmmc-assessments-realistic-applications
[27] Maynard Nexsen, "DoD Finalizes CMMC 2.0 Program Final Rule" (32 CFR RIA: ~$4B annualized industry cost to industry over 20 years). https://www.maynardnexsen.com/publication-dod-finalizes-cmmc-2-0-program-final-rule
[28] NIST, SP 800-171 Rev. 2, February 2020; SP 800-171 Rev. 3, May 2024. https://csrc.nist.gov/pubs/sp/800/171/r3/final · DoD Class Deviation 2024-O0013 retains Rev. 2 until rescinded.
[29] Cyber AB, June 2026 Town Hall (C3PAO and CCA counts). https://www.cmmc.com/newsroom/cyber-ab-town-hall-06-2026
[30] ISI Defense, "CMMC 48 CFR Clears Regulatory Review" (fewer than 300 L2 certifications as of August 2025; under 1% of DIB certified at end of 2025). https://isidefense.com/blog/cmmc-48-cfr-clears-regulatory-review-what-defense-contractors-need-to-know
[31] The Defense Compliance Report, "CMMC Cost for Small Business." https://thedefensecompliancereport.com/cmmc-cost-for-small-business/
[32] 1Ten, "CMMC Small Business Roundtable," March 2026 (10–12% small-business client attrition). https://poweredby1ten.com/intelligence/cmmc-small-business-roundtable
[33] Practitioner sentiment drawn from r/CMMC, r/GovernmentContracting, r/govcon, and r/msp threads, July 2025–July 2026. Substance characterized; wording not reproduced verbatim.
