CMMC Self-Assessments: Paperwork Theater or Real Security?

Eric Marquette

Following the Department's announcement temporarily suspending implementation of CMMC Phase II, the Department of War's CMMC Reform Task Force put out Question 5 in their request for information. And, uh, it cuts right to the heart of the matter. They are asking industry point blank whether Phase 1 self assessments actually create a dynamic cybersecurity posture or if it is all just, well, compliance theater.

Paul Netopski

It, it, it is pure theater under DFARS 252 point 204 7019. Right now you have thousands of small defense contractors logging into SPRS, the Supplier Performance Risk System, and uploading a perfect score of plus 110 based on an annual review of static PDF documents. But that score tells you zero about what is happening on their network right now. I, I give you firsthand testimony, not commentary on this.

Roz the Rulemaker

Wait, plus 110 is the maximum score you can claim, right?

Paul Netopski

Exactly. And I audited a precision machine shop recently that claimed that exact plus 110 score. They had spent 15,000 dollars on a canned policy template package from a consultant. The binder looked beautiful on the shelf. But when we actually looked at the network, they had open Remote Desktop Protocol ports exposed directly to the public internet, running completely unmonitored for six straight months.

Eric Marquette

Six months with open RDP ports while holding a perfect score in the government database?

Paul Netopski

Six months, Eric. It is, it is like checking the tire pressure on your truck once every three years before driving across the entire country. Sure, the gauge said thirty five pounds back in 2021, but that gives you zero insight into the flat tire you get tomorrow morning. The current self attestation model measures paperwork, not operational defense.

Roz the Rulemaker

And from a regulatory perspective, that gap between reported data and operational reality is a massive administrative liability. The government is relying on static paper assurances to make procurement decisions, while the actual risk exposure is totally unquantified.

Eric Marquette

Right, because if the score in SPRS does not match what is happening on the server floor, then the entire self assessment mechanism is failing its regulatory purpose.

Paul Netopski

Which brings us directly to my response to Question 5 in the RFI. My recommendation to the Task Force is simple: replace these static 110 point self attestation questionnaires with automated technical telemetry. Instead of forcing a machine shop to fill out paper binders, use continuous API checks that prove endpoint detection is active and multi factor authentication is enforced across the scope.

Eric Marquette

So instead of paying a consultant 15,000 dollars for a binder, the system just pings the network and checks the actual controls directly?

Paul Netopski

Yes! Right now, pre award self attestation forces small suppliers to spend upwards of 50,000 dollars on pre bid compliance consulting, all under the looming threat of False Claims Act prosecution. And after spending all that money, the government still gets zero verified security assurance. Focusing on the brilliant basics through automated telemetry eliminates that friction.

Roz the Rulemaker

You know, Paul, what is fascinating here is how administrative law strongly supports your proposal. Under the Paperwork Reduction Act, federal agencies are legally mandated to minimize administrative burden on small entities and avoid redundant information collection. Replacing manual annual SPRS filings with automated, lightweight health signals fits the Paperwork Reduction Act standards perfectly while still satisfying the underlying DFARS security requirements.

Eric Marquette

So the law actually encourages shifting from manual paper filings to automated signals?

Roz the Rulemaker

Uh, absolutely. Executive Order 12866 also requires regulatory actions to be cost effective. Requiring a small machine shop to burn 50,000 dollars on pre bid paper consulting when a lightweight API signal can confirm MFA enforcement in real time is classic procedural inefficiency. OMB and OIRA would strongly favor automated telemetry over duplicative manual paperwork.

Paul Netopski

That is why Question 5 is the ultimate litmus test for this Reform Task Force. Will the Department of War embrace continuous automated proof, or will they double down on high stakes paperwork exercises that do not stop a single adversary?

Eric Marquette

That really sets the stage for where CMMC goes next. Good discussion today, everyone.