DFARS

The CMMC Reform Task Force's summary, obtained by Federal News Network, recommends restarting Phase 2 on a narrower population within a 90-day horizon and widening POA&Ms from 180 to 270 days. The narrowing runs through a CUI marking rule that has not published, and the summary was assembled in three days without the program office's involvement.

CUI protection was built for data at rest and data in transit. A prompt to a frontier model is neither, and each hop it takes, from prompt to cache to training, carries a different DFARS obligation. GSA's first AI-specific safeguarding clause takes effect October 19, 2026.

The FY2026 NDAA ordered the Pentagon to build an AI/ML security framework and fold it into DFARS and CMMC. The human-era rule is paused mid-rollout, so defense contractors sit between a rule that cannot see their agents and a successor rule that is signed but not in force.

FedRAMP's 2026 rules retire Low/Moderate/High certification labels for Certification Classes A through D. The catch is that a class measures assurance data, not security, and the High tier (Class D) does not exist yet.