CompliantCMMC Phase II is suspended, but your NIST 800-171 obligations are not
CMMC Phase II assessments were suspended, but DFARS 7012 still requires NIST 800-171, SPRS scores and honest affirmations.
INSIGHTS · TOPIC
Compliant
CMMC, NIST 800-171, CUI, ITAR and the rules behind your contracts.
9 posts on Compliant
Compliant
CompliantAlphabet soup: FCI, CUI, ITAR, EAR, FAR and DFARS, and how to tell them apart
Proprietary data, FCI and CUI nest like Russian dolls. Three questions to tell which you hold, and which rulebook (FAR, DFARS, ITAR or EAR) applies.
CompliantUnderstanding ITAR: what businesses need to know
What ITAR is, what the US Munitions List covers, what counts as an export, and how to tell whether your business must comply.
CompliantOne week after the CMMC pause: shape what comes next
A week after the CMMC Phase 2 suspension, Kyl describes a defense industrial base split between relief and alarm, and urges contractors to answer the DoW RFI by August 14, 2026. Meanwhile NIST 800-171 and DFARS 7012 obligations still apply.
CompliantCMMC Phase II is suspended, but NIST 800-171 is not
On the July 13, 2026 suspension of CMMC Phase II, Kyl explains that only the DFARS 7021 certification gate is paused. DFARS 7012, which requires NIST 800-171, and the SPRS self-assessment duties still apply, and a proposed FAR CUI rule could widen 800-171.
CompliantThe Revolutionary FAR Overhaul deserves a place on your list
While attention is on CMMC, the Revolutionary FAR Overhaul may renumber every Part 52 provision and clause, which would break clause matrices and templates. Kyl notes that FAR 52.204-21's 15 FCI controls overlap with CMMC Level 1 without being the same obligation, and that public comment is open.
CompliantWhen the "optional" document becomes the one everyone reads
Kyl examines the DoD CIO's voluntary "Brilliant at the Basics" lists, published alongside the CMMC pause, which bring back practices removed in the move to CMMC 2.0. He notes the tension between relieving cost burden and the reappearing expectations.
CompliantFCI, CUI, ITAR, EAR, FAR, DFARS: the cheat sheet
Kyl argues that confusing federal data and contract terms (FCI, CUI, ITAR, EAR, FAR, DFARS) can end a contract. The terms overlap but aren't interchangeable, and the post links to a plain-English breakdown of all six.
CompliantCMMC without the ransom note
A counter to fear-driven CMMC marketing. Kyl frames compliance as a set of habits, illustrated with haiku about protecting CUI and MFA prompts, and calls for a clear plan instead of panic.
Talk to a Principal Engineer
Got a question one of these posts didn't answer? Ask the engineer who would do the work.
Talk to a Principal Engineer
Prefer email? Send us a note instead.