CMMC Assessment Bottleneck

Cyber AB CMMC Town Hall – March Session

Cyber AB Town Hall Summary: March 2026

The March 2026 Cyber AB Town Hall addressed significant transitions within the CMMC ecosystem, specifically focusing on the final handover of training and credentialing to ISACA, a deep dive into the recent GAO report, and the emergence of CMMC requirements in active solicitations.

Strategic Program Updates

• GAO Report Findings: The GAO’s “deep dive” into CMMC success factors found the program has a strong mission statement and clearly defined roles. However, it flagged “key external factors” as a risk, specifically regarding whether the private sector ecosystem has the capacity to meet demand.
• Congressional Testimony: Kirsten Davies, CIO, recently testified before Congress, addressing the balance between small business implementation costs and the imperative to protect Controlled Unclassified Information (CUI).
• Leadership Changes: Stacey Boschanick has announced her retirement from federal service after 27 years, having served as a primary lead for the CMMC PMO. Locally, Emily Ermellini has joined the Cyber AB as Director of Executive Administration.

Ecosystem Growth & Metrics

• Certificates Issued: The ecosystem has eclipsed 1,074 Level 2 certificates issued by C3PAOs.
• Professional Cadre: There are currently 103 authorized C3PAOs, 759 CCAs, and 1,564 CCPs. Lead CCAs saw a 7% growth this month.

The ISACA Transition (Effective April 1, 2026)

The CAICO (CyberAB Accreditation Body) officially completes its handover to ISACA tomorrow.

• Platform Integration: Starting at 10:00 AM Central tomorrow, candidates can manage certifications via the “My ISACA” page.
• Fee Structure: Exam fees will transition to ISACA’s standard pricing ($575 for members / $760 for non-members). However, those who completed training in the last six months will have the previous Cyber AB pricing honored.
• New Content & NIST 800-171 Rev 3: ISACA will release new training content in Q4 2026 aligned with NIST 800-171 Rev 3.
• Bridge Courses: To manage the transition, “bridge courses” will be developed to allow Rev 3-trained assessors to perform Rev 2 assessments and vice versa.

Operational Insights: CUI and Flow Down

Guest speaker Ryan Bonner highlighted that CMMC requirements are now appearing “in the wild” within active solicitations from the Army Corps of Engineers, Air Force, and Navy.

• CUI Position: Contractors are encouraged to define their “CUI Position” to navigate ambiguity in data markings.
• Flow Down Logic: CMMC flow down is designed to “follow the data” rather than just the contract.

Scoping Strategy: Bonner advised focusing on a “Minimum Viable Product” for certification—identifying a core, defensible environment to get certified first, rather than attempting to cover 100% of a complex organization immediately.

Speaker 1 – 00:00

Welcome to the March Town Hall. It’s the last day of the month and the last day of the quarter. I hope everyone is doing well across the United States and around the world as the CMMC ecosystem gathers for our monthly touchpoint.

As always, we aim to provide a full hour of high-quality CMMC programming. Before we begin, a quick reminder: the Cyber AB is an independent nonprofit 501(c)(3) organization that supports the Department of Defense through a no-cost contract. Nothing shared tonight should be interpreted as official Pentagon or U.S. government policy.

We’re also pleased to acknowledge our partners at NCMS, the Society for Industrial Security Professionals, who are simulcasting tonight’s Town Hall to their membership.

We have a strong agenda tonight. I’ll start with a program update, followed by a fireside chat with Ryan Bonner on emerging CMMC requirements and how flowdown is working in practice. Then Todd Gagnon from ISACA will join us to discuss the transition of responsibilities from the Cyber AB to ISACA.

Speaker 1 – 01:34

I need to begin with an important announcement. Earlier this week, it was announced that Stacey Boschanick is retiring from federal service after 27 years.

Stacey has been a central figure in this program. She served as the senior executive overseeing the PMO and most recently led DIB cybersecurity efforts. Throughout her tenure, she provided consistent leadership and support to the Cyber AB and the broader ecosystem.

Those of you who have seen her at Town Halls or conferences know she brought energy, transparency, and a genuine commitment to sharing information, even during the most challenging phases of rulemaking.

We hope to have her join a future Town Hall to reflect on her time in the program. For now, if you’re watching with a drink in hand, please join me in raising a toast to Stacey Boschanick. We wish her the very best.

Speaker 1 – 03:00

Turning to recent developments, CIO Kirsten Davies testified before both the Senate and House Armed Services Committees last week. CMMC was part of her remarks, including discussion on balancing certification costs with the need to protect CUI.

I encourage everyone to review the testimony and Q&A sessions available on the committee websites.

Additionally, the GAO released its report on CMMC earlier this month. This was not an audit, but a strategic review focused on program success factors and whether sufficient planning exists.

The report found that CMMC has a clear mission, defined scope, methodology, and assigned roles. One area identified for improvement is managing external dependencies, particularly reliance on private sector capacity.

Overall, the report was positive, and we recommend reading it for deeper insight.

Speaker 1 – 06:24

Let’s look at ecosystem capacity.

We’ve surpassed 1,000 Level 2 certifications issued by C3PAOs, now at 1,074 and growing. There are also 39 conditional certifications pending POA&M closeout and 116 Level 2 assessments in progress.

On the ecosystem side:

• 103 C3PAOs (up 5%)
• 759 CCAs
• 1,564 CCPs
• Continued growth in Lead CCAs and training providers

The key metric remains assessor growth, and we’re seeing steady progress.

Speaker 1 – 08:56

We’ve also expanded our internal team. Emily has joined as Director of Executive Administration, helping manage scheduling and board operations.

We’re also hiring for a Director of Compliance and Security, with interviews underway.

Speaker 1 – 10:02

Upcoming events include:

• Summit Business Technologies webinar on CMMC pitfalls (tomorrow)
• CS2 West in April
• CMMC Midwest in Wichita
• CMMC Day in the National Capital Region
• Cybersecurity Association Summit in June

Speaker 1 – 13:25

We are now seeing active CMMC requirements in real contracts across agencies like the Army Corps of Engineers, Air Force, and others.

CMMC is no longer theoretical. The rule is active, and requirements are appearing in solicitations.

Fireside Chat with Ryan Bonner

Speaker 4 – 15:40

We’re seeing CMMC requirements appear in RFIs, Sources Sought notices, and formal solicitations. Some agencies are phasing requirements differently than the official rollout schedule.

In some cases, contractors are being denied access to preliminary information unless they demonstrate near-complete Level 2 readiness.

Speaker 4 – 17:43

Primes are aggressively driving awareness. They’re sending strong communications and pushing subcontractors to act.

They can’t afford to wait. If their supply chain isn’t ready, they risk losing contract eligibility.

Speaker 4 – 19:07

Subcontractor awareness varies widely. Some are only now reacting after receiving strong pressure from primes. Others have been preparing for years.

The deeper you go into the supply chain, the lower the awareness tends to be.

Speaker 4 – 20:25

Flowdown follows data. Requirements flow where CUI flows.

Organizations are beginning to segment suppliers:

• Those capable of handling CUI
• Those limited to Level 1
• Those handling only public or non-FCI data

This segmentation allows flexibility but requires planning.

Speaker 4 – 22:09

There’s still confusion around identifying CUI.

Part of the issue is degraded communication as information passes through multiple layers. On the government side, the shift from classified frameworks to CUI requires understanding a wide range of laws and regulations.

Speaker 4 – 23:56

Organizations need a defined “CUI position.”

This includes:

• Identifying where CUI exists in their environment
• Applying consistent handling rules
• Understanding exclusions (like publicly available data)
• Aligning internal interpretation with federal definitions

Speaker 4 – 26:44

A common misconception is that everything is CUI. That’s not true.

Another misconception is that the government has perfect clarity and just isn’t sharing it. In reality, ambiguity exists on both sides.

Organizations need to engage, ask better questions, and refine their understanding.

Speaker 4 – 28:37

Final advice:
Define your scope. Build a minimum viable compliant environment. Focus on what’s required for contract performance first.

Don’t try to certify everything at once. Start with what matters most and expand if time allows.

ISACA Transition – Todd Gagnon

Speaker 5 – 29:29

The transition to ISACA goes live tomorrow at 10 AM Central.

Users will log into their ISACA accounts to:

• View certifications
• Manage renewals
• Continue training

All certification processes now begin with ISACA and transition to Cyber AB for Tier 3.

Speaker 5 – 34:30

Exam fees will align with ISACA standards:

• $575 (members)
• $760 (non-members)

Renewal costs are lower, so long-term cost balances out.

Speaker 5 – 36:00+

Key points:

• No immediate changes to training delivery
• New training aligned to NIST 800-171 Rev. 3 coming late 2026
• Bridge courses will support transition between Rev. 2 and Rev. 3
• ISACA will become the sole training publisher for consistency and speed of updates

Speaker 5 – 42:28

The PI to CCI transition process will begin shortly, with full implementation targeted by June 2026.

Q&A Highlights

Ryan Bonner

• Email headers alone do not make content CUI
• Proper marking requires full designation and category identification
• Organizations must understand CUI categories due to legal implications

He also emphasized better communication:
Low-quality questions produce low-quality answers. Be specific when engaging with upstream partners.

Todd Gagnon

• Certification reviews will typically take about one week
• Renewal functionality will be available immediately
• ISACA will be the system of record, with synchronization to Cyber AB
• Discrepancies should be reported through support channels

Closing

The next Town Hall will be held on April 28 at 6 PM Eastern.