Question 07 and the Case for Real CMMC Reform

Eric Marquette

Question 07 is, is where the whole thing opens up. The prompt literally asks, what other ideas, approaches, or policy changes should the CMMC Reform Task Force consider? And when we promised last episode to walk through your submission line by line, Paul, this was the moment I was waiting for.

Paul Netopski

Yeah, because, uh, Questions 1 through 6 keep you, they keep you trapped in their box. They ask how to tweak the current mechanics. But Question 07 lets us point out that the, the, the foundation itself is cracked. The Department of War established a CMMC Reform Task Force to comprehensively review the program, not just polish the brass on a sinking ship.

Roz the Rulemaker

And from an administrative standpoint, that broad mandate in Question 07 is rare. Usually, federal agencies limit comments to narrowly scoped regulatory text. But here, the Task Force is explicitly soliciting structural alternatives before 32 CFR Part 170 becomes an unworkable reality for the industrial base.

Paul Netopski

Right, and my primary recommendation in Question 07 is to take federal money away from bloated, passive advisory programs like, uh, Project Spectrum. Defund them. Take those dollars and reallocate them directly into SBA technical assistance grants and standardized, government furnished System Security Plan templates.

Eric Marquette

Project Spectrum! Man, small machine shops tell me they get pointed to these online portals, and it is just endless video modules. Meanwhile, they are being asked to drop $100,000 out of pocket on consultants just to prove compliance before they even get to bid on a contract.

Paul Netopski

That $100,000 pre award penalty is a complete paradox. You are forcing a ten person machine shop in Ohio to spend six figures of capital on audits and toolsets for a contract they might not even win! Verification has to become a reimbursable, post award contract deliverable. You do not demand a builder certify a house before you hire them to build it.

Eric Marquette

And because of that exact fear, small suppliers fall prey to these predatory consultants selling $50,000 canned policy template packages. They end up with 300 pages of binder filler that nobody reads and nobody can actually execute on the shop floor.

Roz the Rulemaker

Well, and if you want to fix that without waiting three years for formal notice and comment rulemaking to finish, the agency has to use an immediate DFARS Class Deviation. That gives contracting officers immediate legal authority to pause pre-award gating while 32 CFR Part 170 is formally amended.

Paul Netopski

Exactly. A DFARS Class Deviation creates an immediate safe harbor for contractors who make honest, good faith self attestations while the system gets fixed. But, uh, Roz, we also have to fix the upstream cause. The government itself is breaking the scope.

Roz the Rulemaker

You mean CUI over marking.

Paul Netopski

Yes! Scope is being driven by the marking, not by the information. DoD program offices use automated tools that slap Controlled Unclassified Information banners on simple email headers and public spec sheets. That automatically forces a tiny subcontractor into full CMMC Level 2 scope for no security reason at all. We need financial accountability for program offices that over mark.

Eric Marquette

So instead of punishing the small vendor who receives a mislabeled PDF, you penalize the buying office that mislabeled it in the first place.

Paul Netopski

It is about changing the model from an adversarial pre bid barrier into a collaborative post award performance model. Brilliant basics, real engineering support, and safe harbors for small businesses doing the real work.

Roz the Rulemaker

The August 14 RFI deadline is the ultimate test for the Task Force. We will see whether leadership actually tackles these structural administrative flaws or just reshuffles compliance paperwork under a shiny new title.

Eric Marquette

August 14 is the line in the sand. Thanks Paul, thanks Roz. Talk soon, everyone.