Compliance Paused. Enforcement Did Not.
By Randy Armknecht
A few weeks ago I spent 2 days at CS5 East, outside Washington, DC, with folks whose job is protecting government data. Given the CMMC pause, I was curious how well attended it would be and how invested the attendees would be. But at lunch, I had a wonderful discussion with my table about the nature of sharing files with vendors (link-based vs. authenticated accounts; I'm clearly on team authentication). Between sessions, I had some excellent discussions on how AI can take on the mundane work that human team members aren't particularly interested in (updating documentation and reviewing references to confirm they remain accurate). I came home more energized than a conference usually leaves me.
Then this week, on November 3, the Justice Department announced a $13 million False Claims Act settlement with ILC Dover and ILC Astrospace over the cybersecurity requirements in their contracts with the Army, the Missile Defense Agency, and NASA. Side by side, the two make the same point from opposite ends. The obligation never depended on an inspector showing up.
The Pause Took the Inspection Off the Calendar
In July the Pentagon suspended Phase 2 of CMMC, the phase that would have required third-party assessments starting November 10. It was easy to read that as a reprieve. It was a reprieve from the inspection. The building code stayed exactly where it was.
DFARS 252.204-7012 remained in covered contracts, so NIST SP 800-171 Rev. 2 stayed the code every contractor handling controlled unclassified information agreed to build to. Phase 1 self-assessments continued, and the score posted to SPRS stayed what it always was: a representation to the government about the state of the building. The pause took the scheduled inspection off the calendar. The fire marshal kept his job.
The Fire Marshal Doesn't Need an Inspection Date
The alleged conduct at ILC runs from January 2018 to October 2024. All of it predates the pause, and all of it predates CMMC showing up in contracts at all. No certificate was ever involved. The case rests on the clause and on what the companies told the government about meeting it.
The list of alleged failures reads like the first week of an assessment. No system security plan (SSP) developed and kept current for each covered system across most of that span. Controls not fully implemented. No plans of action and milestones (POA&Ms) to close the gaps. No current assessment submitted to DoD from November 2020 on. Controlled unclassified information stored with a cloud provider that was never held to FedRAMP Moderate equivalency. None of it requires a sophisticated adversary. Each item is a document or a control that someone either maintains or doesn't.
The fire marshal didn't need an inspection date, either. The case started with Philip Root, ILC's former director of cybersecurity, who receives $2.35 million of the settlement. The building's own safety officer made the call. (The settlement resolves allegations only; the release is explicit that there has been no determination of liability.)
When advising clients or teaching classes, I like to emphasize that keeping an SSP up to date is easier when it's a defined, non-optional part of the change control process. If a system is changing, part of the Change Approval Board's process should be confirming that the team has validated the change against the SSP and queued the SSP updates as part of the deployment. Good systems hygiene involves thoughtful record keeping as much as it does thoughtful technical implementation.
Similarly, the POA&M can be a living document that serves as the ultimate project status tracker for any gaps identified and the efforts underway to close them. Doing this means that if DIBCAC or an auditor shows up, there's no need to go "create" the POA&M. It simply exists. Creating the POA&M each year during the self-assessment is an acceptable alternative. Leading organizations maintain it throughout the year and are always ready for an inspection because they operate in a state of continuous compliance and observation.
The Room at CS5 Was Building to Code Anyway
A fire code worth following still lets people cook dinner. The folks I met at CS5 were working that exact problem: keep government data where it belongs, and still give engineers, analysts, and program staff the tools to do their jobs. There was a good amount of discussion about the speed with which Microsoft and others have been bringing new features into the historically lagging government versions of flagship products like Copilot and Purview. The folks I talked with weren't waiting for a deadline to be set. They were actively working on the process of continuous compliance while the business advances.
🤖 AIL LEVELS: This content's AI Influence Levels are AIL2 for the writing, and AIL4 for the images. AI Influence Level (AIL) framework