I know the DoD's new "Basics" aren't requirements, but they are the only signal the department has provided to anyone about ... anything.

There's no scoping guide and the language within the basics is very broad.

"Every asset"?

"All intellectual property, proprietary data, and Department records"?

What is "sensitive data"?

What are "sensitive systems"?

What does "your estate" mean re: Asset Inventory Management?

They're reviewing the CMMC program which includes CMMC scoping guidance, but if the Basics are a signal, is scoping going to get more nebulous rather than more granular?

Anybody else worried about this?

Looking to backup GCCH enclave as well as some VMs in Azure Govt cloud. CUI as well as ITAR data. Looking for cloud to cloud backup solution without any on-prem infrastructure. I see that Avepoint has Fedramp Moderate and Commvault has High but having trouble getting a written answer from either regarding compliance for ITAR/export control. Perhaps I'm not asking the correct questions?

Hoping someone smarter can help me fill in some blanks. Were a small IT team working on getting L2 for a manufacturing plant. The short of it is this: they have several devices that run specialized software running on Win10 devices. A lot of these computers are end of life and cannot be upgraded to windows 11. My initial thought was lock them down so they ONLY can access the tools they need and are completely isolated from our corporate network containing CUI (maybe a different VLAN or subnet altogether). My boss isn’t super technically savvy and says we need to replace them no if ands or buts because of CMMC, but knowing the organization there might be some pushback on that not to mention budget constraints. To be fair I’m not a fan of this either because of the security risks of keeping an old Win10 computer running but I’m trying to find out if by doing the method I mentioned we can still keep them and mark them as out of scope. Being a manufacturing plant there are tons of specialized equipment/software running on a Win10 device and I’m fairly certain saying “we need to replace all of this” and spend potentially tens of thousands of dollars is not gonna fly. Has anyone tried this? I don’t think it’s the wrong approach per se and understand the risks, but am curious is anyone has seen this approach be a hard no.

Some background: I'm a software engineer who works in federal contracting, and I'm trying to understand how the supplier side of CMMC works in practice.

From what I've read in DFARS 252.204-7020, a prime can't award a subcontract involving CUI unless the sub has a current assessment in SPRS.

How does a prime actually verify that? Do you ask the sub directly and take their word for it? Or can you see their score in SPRS yourself, and if so, how?

I’m currently working through CMMC 2.0 and would like to implement a lightweight and user-friendly tool for Remote Management.

Not pitching my services, no AI nothing like that. In fact this is probably a horrible idea. Not sure how many of us are in the US government sector, but I'm sure some of us are. Those either struggling to find subs that are CMMC2 compliant or are subs trying to make sure that their investment doesn't go to waste by picking up CUI projects.

This comes from a discussion, either here or on r/Construction where a GC didn't have a way to find qualified subs. This brings up a few issues, if you are qualified it could make you a target if someone knows you have CUI, but keeping the list of qualified contractors secret makes it impossible to bid projects accordingly.

This is predominantly a Windows question, but welcome any commenters.

==I've seen that enabling "FIPS mode" can "break things".

For those who have enabled "FIPS mode" on their Windows systems, what specifically have you had issues with, if any==,

.. or is that "warning" mostly a Boogeyman for the timid.

Mainly I mean for Windows 11 workstations (that will work with CUI),
I'd be interested to hear about Windows Server 2025 challenges as well.

---

The below stuff probably is scope creep from my main line of questioning, but welcome chatter nonetheless because talking about this stuff is "fun"

(Welcome some Linux talk too, we might go Ubuntu Pro for a/some guest VMs even though i'm not an Ubuntu fan in general (prefer pure Debian) but not sure FIPS is really necessary there, for an on-prem SIEM potentially, maybe on-prem password manager, etc..)

..but if anyone has become L2 cert with AlmaLinux feel free to talk about that experience. It looks like you need this tuxcare..)

(Welcome Mac talk too, we have a single macbook and mac studio, but mostly there I think the situation there is: MacOS 27 just came out (not FIPS validated). MacOS 26 is in Review for FIPS validation, but the last FIPS validated MacOS was EoL MacOS 15.. so, curious if anyone has L2 cert and had a C3PAO with some Macs (last thread I found was a few years back, an all mac shop and don't think they mentioned certification) but my guess is, people who have them just do not let CUI touch them and run the latest versions from Apple)

My company is in the middle of our level 2 cert. with our assessment coming up in a month. We are an AE Firm with roughly 200 people and the entire company is in scope. About 50% of our revenue is DOD work but probably >75% of our employees touch a DoD project at some point during a year. Hence why we have put our entire business in scope.
For a lot of our employees who rarely touch cui projects the restrictions we have to put on their machines are stifle innovation and creativity and in some cases reduce productivity.

The issue I am worried about long term is employees growing tired of the environment and looking elsewhere.

We are too close to our assessment to change our scope or environment but I am curious about potential change we may make in the future even if it might cause us to need to re assess.

I’m wondering if we would have been better off setting up a remote server that employees would log into for CUI projects. This way we don’t have to restrict what programs people have on their machines, You don’t have to mfa every time you log into your computer, etc.

Is this in the realm of possibility for L2 compliance or within reason to try to implement.

I’m currently going through CMMC Level 2, and I’ve come across numerous reviews that seem to be riddled with errors and inconsistencies. It’s quite perplexing to understand what is actually happening.
Anyone here have reached level 2?

We're a small machine shop that just picked up our first defense subcontract. The drawing package has CUI markings and a few sheets have export control notices. Our in-house drafter is out on leave for two months, so we need outside help.

Every website I checked lists AS9100, CMMC and ITAR registration in the same spot. From what I've read, those answer different questions.

So what should we check against our contract before sharing any files?

While looking around for Door Access Control systems I've stumbled upon a few options such as Mercury, Ubiquiti and the worst contender physical keys.

As Mercury is FIPS and NDAA compliant does it mean that FIPS and NDAA are both required for CMMC Level 2?
Because Ubiquiti's Door access systems are NDAA compliant but not FIPS.

I understand that NDAA is specifically for telecom devices and video surveillance so something like door access control readers, controllers, smartcards shouldn't fall into this category.

And for FIPS if I recall it's only required for devices that stores, process or transmit CUI so for example a server storing Camera Feed of a CUI room must be FIPS validated and the IP camera must be FIPS validated as well.

I mean CUI room as in a room that is locked with doors and there is CUI in this specific room that is accessible whether it be viewable on a monitor screen without login, a physical object, etc.

So in this case because the door access control system only allows access into a physical enclave / CUI room and its encryption mechanism is not used to directly protect CUI, does it still require FIPS?

We are working towards CMMC Level 2 and are currently using Imprivata Enterprise Access Management as a solution for MFA on network accounts that are both priviledged and non-priviledged.

I am wondering if it is possible to allow an admin to elevate that is logged in to a standard user account through UAC while also retaining MFA enforcement.

Right now I have UAC elevations completely disabled with this group policy change.

Group Policy changed:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Behavior of the elevation prompt for standard users

set to "Automatically deny elevation requests"

Is this our only option or am I missing something?

I work for a manufacturer that has CMMC requirements on DoD contracts. We are US-based but we have foreign sites, too. These foreign sites have NCAGE codes but not CAGE codes. Can we use their NCAGE code to load their score into SPRS? If not, how do we load their score into SPRS; do we have to use the parent CAGE code (for the Corporate HQs)? Appreciate the assistance.

Hey everyone,

I’m working on an IAM solution tailored for orgs that need modern authentication without giving up control of their identity infrastructure.

The core design is Windows-native, self-hosted, and runs with zero cloud dependencies so it can operate in fully disconnected/air-gapped environments.

Here’s a quick overview of the stack:

• Auth methods: FIDO2/WebAuthn, PIV/Certificates, TOTP, Kerberos (plus push auth for connected setups, though obviously not for air-gap).
• Federation: SAML, OIDC, and WS-Fed.
• Crypto & Compliance: Built on FIPS 140-3 validated modules, specifically keeping NIST 800-171 / CMMC compliance in mind.

(Standard disclaimer: I know an IAM tool alone won't magically make an environment CMMC compliant, but I’m looking at how it fits into the broader picture.)

For those who have actually implemented or assessed disconnected CUI environments, how would you evaluate an architecture like this? Specifically:

1. How would you handle scoping for the IdP? Would you classify it as Security Protection Assets (SPA)?
2. What red flags or concerns jump out at you regarding a self-hosted IdP vs. a cloud-native option in this space?
3. For air-gapped setups, what are the toughest authentication or identity lifecycle pain points you’ve run into?
4. What evidence or capabilities would you need to see before you'd feel confident dropping this into a CMMC L2 environment?

Would love to hear thoughts from assessors or practitioners who deal with air-gapped CUI day-to-day!

We've been working on the FIPS enablement of our product for use in multiple regulatory frameworks, and reviewing the details around the FIPS requirements, especially when dealing with the understanding of a few customers. Looking at CMMC, CJIS, and FedRAMP, CMMC appears to be the strictest at the first glance. It requires FIPS validated cryptography, as they all do, but allows for:

While FIPS-validated modules and algorithms are critical for protecting CUI, in limited cases Enduring Exceptions and temporary deficiencies may apply when implementing such cryptographic mechanisms.

This "limited cases" statement would appear to mean that it should have a very specific purpose, otherwise, the module should be fully validated, not an update stream, as FedRAMP encourages.

However, one can inherit controls from a FedRAMP Moderate Equivalent solution, like an enclave. Would this be a general "Enduring Exception"? The issue we're having is in clients distributed in Windows, MacOS, iOS, etc. Some of our customers would rather distribute a cryptography module, even if it has to be user affirmed because the major OS version doesn't appear in the' tested or vendor affirmed OE lists, than use native cryptography from Microsoft and/or Apple on the update stream from their fully validated modules as OS updates are made, keeping up with the patching requirements of the same standards.

Is there any specific guidance anywhere around this?

Assessors, or those that have faced this particular issue, what are you opinions or experiences?

CJIS and FedRAMP have explicit guidance, in the standard, to allow or even encourage the update stream as an option. CMMC seems to have some wiggle room, but nothing nearly as clearly stated, except the above stated fact that FedRAMP can be included in CMMC in a way.

So. I got onboarding to help with nist implementation for our small business and help coordinate an msp and our compliance. Ive successfully talked everyone into a tiny enclave rather than enterprise scope (months of pain prior)

Our company has spent a shit ton and 2 years working toward this . My boss is old, brought me in for help and I quickly realized the msp did his self assessment and nothing was ever verified , it was a massive mess and headache.

Anyway. Today . Im deciding to harden our scope down as we progress with our enclave im going to go through our clauses so we can really hone in on things. Idk why I just now thought this.

We've never received anything other than dfar (can't remember exactly but whatever ) 7008 . On a reoccurring po . We are way down the sub line .

Just 1 reference to it . No others . No 7012 alongside.

Oh my god my head is spinning .

If you have, any feedback / guidance on what to expect or what to tackle first?

Is there a data base for finding CMMC certified contractors? I work for a GC and I need a cmmc level 2 certified plumber, electrician and utility locator. Apparently all utility locations are CUI.

I don't know how I can get pricing before bids are due if I can't share these utility maps with subs or take them on a job walk.

So they found this on July 16, 3 days after they announce the CMMC assessment pause. That's karma, I guess.

Hi, I missed the town hall this week and I have a meet in a few hours to discuss it.

If you happened to attend I would appreciate hearing any insights you heard.

Hi all!

We are an aerospace manufacturing company. We currently use Microsoft 365 and an ERP software that is written in FoxPro. We are looking at new systems but I have gotten conflicting information. Our outside IT group says that we have to transfer our current tenet to a Microsoft 365 Government due to ITARS. Also, we were looking at a couple of cloud based ERPs (Microsoft Dynamics, Business Central, NetSuite) but they said we can't go with them because they don't have the government security features? I was was wondering why we couldn't just go in house? What are other people doing? We have about 100 employees and need something with production and financial capabilities.

Edited to add: To understand the data flow, we have blueprints, specs, SOWs, Purchase Orders, and so in a on-prem server with restricting Windows security and MFA. However, we reference part numbers, revs, part information, standards and specifications and other customer and part specific information in the ERP system. As for the blueprints themselves, they are viewed digitally and only by those with proper access. Also, I am a bit clueless about the requirements and terminology so please bare with me.