The Department Asked Seven Questions. Read Them Closely.

By Rob Maupin, Overwatch Tools — author of the CMMC Practical Guides series: Volume 1: CMMC Level 1 and Volume 2: CMMC Level 2.

Since July, a lot of small defense contractors have picked up the same habit. Open a browser, search "CMMC," scan the headlines for the word report, close the tab. Try again tomorrow.

The answer they are waiting for is not public yet. But the single most useful document in this whole episode has been public since mid-July. It is short, it is free, and almost nobody outside a policy shop has read it closely: the Request for Information (RFI) the Department of War (DoW) published when it stood up the CMMC Reform Task Force.

An RFI is an agency asking out loud, and agencies do not pick questions at random. What they choose to ask is the closest thing to a direction indicator anyone outside the building can get — and unlike the report, it costs nothing to read.

This article will not tell you what the Task Force recommended. Nobody outside the Department knows, including me. It will read the seven questions the way you would read a clause in your own contract — slowly, asking what each one is reaching for.

That is not a prediction. It is a reading of what was asked.

The Setup, Briefly

On July 13, 2026, Department Chief Information Officer Kirsten Davies signed the memorandum suspending CMMC Phase 2 — the November 10 transition that would have made a certified third-party assessor organization (C3PAO) assessment the default for many contracts — along with every pending and future milestone. The same memo stood up the CMMC Reform Task Force, reporting to the CIO, with 60 days for a top-to-bottom review of the program.

The RFI, titled Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base, went up on SAM.gov alongside it and closed at noon Eastern on August 14. Davies told the Billington Cybersecurity Summit on September 9 that the Department received more than 1,100 responses; at the Department's DIBX conference in Philadelphia in late August she put the volume at more than 11,000 pages. The Task Force's internal deadline was September 11. What happens to its report after that, including whether and when it is published, is the CIO's decision.

One thing in the rulebook has actually moved since July, and precision matters here. The pause no longer lives only in a memo. Revision 2 of class deviation 2026-O0025 carried it into acquisition instruction on July 16, and Revision 3, signed September 3, is the current operative text. I walked through that sequence — and what the September reporting got half-right — in Part 1 of this series. So far, the deviation is the only concrete instrument in this entire story. Everything else is still questions.

So let's read them.

The Seven Questions, in Plain English

Each question is paraphrased below; the full text is on SAM.gov and reproduced by the SBA Office of Advocacy, both linked in Sources. Under each is what the question is actually reaching for, written for a contractor with fifteen employees and no IT department.

Read together

Lay the seven side by side and they describe an agency asking three things: which requirements it could drop or lighten, whether commercial tools and managed services could substitute for some assessment work, and how far self-attestation can be stretched — along with whether, as practiced today, it is worth stretching. That lines up with the RFI's own framing paragraph, which names using existing commercial capabilities, leveraging and optimizing self-attestation, and streamlining compliance requirements as the areas it wanted perspectives on.

That is not a prediction. That is what was asked.

What the Department Has Said Out Loud

Questions show what an agency is curious about. On-the-record statements show where it has drawn lines.

In the same remarks, Duffey said businesses are to adhere to the standards NIST has outlined, and described what was being removed as the bureaucracy of third-party assessment — not the requirement underneath it.

Davies at the Billington Cybersecurity Summit, September 9. She said cybersecurity remains critical and vital, and that the Department wanted to hear from the defense industrial base about meaningful, dynamic cybersecurity. Note the word dynamic — the same word Question 5 uses. That is an observation about vocabulary, not a forecast.

Davies at DIBX, August 26. At the Department's inaugural DIBX conference in Philadelphia, she framed the goal as results rather than red tape — performance rather than paperwork — and described protecting federal data as table stakes: a regulatory requirement that never went away.

Davies on the current assessment model. She has characterized it as a check-the-box, point-in-time view of how a company handles sensitive data. Set that beside Question 5 and the two read as the same concern stated twice: a snapshot taken once a year says little about the other 364 days.

And one line from outside the Department, as a counterweight to the "CMMC is dead" crowd. Professional Services Council president Stephanie Kostro told Federal News Network on September 15: "This is not the death knell of CMMC."

Where the Report Stands Today

The Task Force's report went to the CIO on or about September 11. As of this morning, October 1, it has not been released, and publication is the Department's decision. Industry observers have anticipated a public report somewhere in a late-September to early-October window — that is industry's read, not a schedule the Department has committed to. Which means any analysis of the report's contents circulating right now is speculation, including anything we might write. That is exactly why this article is about the questions instead. The questions are on the record. The report is not.

The One Place This Points That Matters to You

Look only at the parts of the RFI that touch verification: Question 4, Question 5, and the framing paragraph's language about leveraging and optimizing self-attestation. Every one of them points toward self-attestation carrying more weight, not less. Not because the Department has announced an outcome — it has not — but because that is what those questions are about: how much to lean on what contractors, and their vendors, already say about themselves.

Whatever shape the program takes, the same contractor is well positioned under every version of it. The one who can produce:

• An accurate determination — MET or NOT MET on each of the 15 Level 1 practices, and at Level 2, an SPRS score that matches the actual network
• A current system description at Level 1, or a System Security Plan (SSP) at Level 2
• Dated evidence that the controls actually run — not just that a policy says they should
• An annual affirmation signed by someone who is genuinely comfortable putting their name on it

The contractor who cannot produce those things is exposed under every version too. Including right now, with no program change required at all — the affirmation is already a representation to the federal government, today, under the rules already in force. DFARS 252.204-7012 and NIST SP 800-171 did not go anywhere in July, and neither did the Phase 1 self-assessment requirements.

If you hold Controlled Unclassified Information (CUI), the same logic stacks. Level 2 always sits on top of Level 1, never instead of it: 110 practices across 14 domains, an SSP, a POAM framework, a risk register, and evidence that each control runs. For a small business with limited CUI needs, a dedicated enclave on Google Workspace or Microsoft 365 GCC High — no Active Directory, no SIEM, no enterprise IT department — keeps that documentation set small enough to maintain honestly. Our L2 CUI Enclave Package provides the templates, configuration guides, and consulting for that work; clients implement.

What to Actually Do With the Next Three Weeks

None of this requires knowing what the report says. All of it is regime-proof, unglamorous, and useful under every version of the program.

1. Know your scope. Which systems, which people, and which locations touch federal contract data. Write it down on one page. If you cannot draw the boundary, nothing else on this list has a place to stand.
2. Know what you hold. Federal Contract Information (FCI), CUI, or both. FCI brings Level 1; CUI brings Level 2 on top of it. Your contracts and your contracting officer are the authority on which you hold — if a marking or a clause is unclear, ask them in writing.
3. Have a current self-assessment. Check the date on the one in SPRS. If your environment has changed since then — new staff, a new laptop fleet, a new cloud service — it describes a network you no longer run.
4. Collect the evidence while you still remember where it lives. Screenshots, configuration exports, account lists, training records, visitor logs — each one dated. Evidence is perishable in a way that policies are not.

For the Level 1 gap check specifically, the free CMMC Assessment Tool covers all 15 practices in under 30 minutes and tells you which ones to fix first.

The Preview and the Verdict

The questions were the preview. The report, whenever the Department chooses to publish it, is the verdict. And a verdict on a recommendation is still not a rule — that is the subject of Part 3 of this series, on what a task force report can and cannot change.

For you, the most important thing about all of it is how little it changes the to-do list. An accurate self-assessment, a current description of your system, dated evidence, and an affirmation you can stand behind are the same four things whatever the Task Force recommended.

Either way, the work is the same work.