CMMC Reform Task Force RFI: Closed — What Happens Next (Aug 2026)
Quick answer: The public CMMC Reform Task Force RFI comment window closed 14 August 2026 (widely reported; confirm on primary DoD notices). No new contractor obligation text landed with that close—DFARS safeguarding, honest NIST SP 800-171 self-assessment, and SPRS duties still apply if your contracts require them. Next watch: Task Force recommendations to the CIO ~mid-September 2026. This page keeps the small-shop filing guide and template as an archive for any future DIB RFI.
Key takeaways
- RFI window closed 14 August 2026 — late filings are generally not expected; confirm any reopening on primary notices.
- Closing an RFI is not a rule change. Suspension ≠ repeal; signature and SPRS risk remain.
- Next policy signal: Task Force recommendations ~mid-September 2026 (forecast from public coverage—not a published DoD milestone).
- Use the pause to fix optimistic scoring and evidence gaps—not to discard the program.
- Prefer official DoD / Acquisition.gov text over any blog (including this one).
Status (28 August 2026)
| Item | Standing |
|---|---|
| RFI comment window | Closed — 14 August 2026 (widely reported; confirm on primary DoD notices) |
| New obligation text from the close? | No — closing comments ≠ changing DFARS / 800-171 / SPRS duties |
| Next watch | Task Force recommendations to the CIO ~mid-September 2026 (public forecast—verify when published) |
| What you should do | Keep a living SSP, honest self-assessment, and a score someone can sign. See CMMC after Phase II suspension. |
Verify first. Treat DoD / Federal Register / official RFI text as authoritative. If this page and a primary notice disagree, trust the primary notice. See sources.
Why this page still exists
Phase II timing remains unsettled. A Reform Task Force gathered industry input through a public Request for Information (RFI) with responses due 14 August 2026. Themes centered on the burden of implementing and complying with CMMC—exactly what a 20–100 person subcontractor lives with.
Large primes and associations filed. Many small shops did not. This page remains:
- A status + what’s-next marker so readers are not stuck on “due 14 Aug” copy
- An archival filing guide + template useful if a successor RFI or related comment window opens
What to confirm on the official notice
Before relying on any date or channel (including ours):
- Exact deadline and time zone
- Submission channel (portal, email, regulations.gov, etc.)
- Word/page limits
- Whether responses are public
- The numbered questions as published (do not invent them)
Primary starting points:
- DoD CMMC program
- Acquisition.gov / Federal Register search for CMMC RFI
- DoD CIO
What a 40-person shop should actually report (archival)
You do not need a white paper. Report operational facts:
| Topic | Useful data (examples—no CUI) |
|---|---|
| Who you are | Employee count band, sub vs prime mix, NAICS if comfortable, state |
| CUI reality | Whether you process CUI for DoD/primes (yes/no/unsure)—no details of what it is |
| Cost to date | Rough $ spent on tools, consultants, training, assessment prep (ranges OK) |
| Projected cost | What a full Level 2 path looks like for you (ranges OK) |
| Time | Months of owner/IT time already burned |
| Assessment capacity | Queue experiences, wait times, C3PAO scarcity if observed |
| Flow-downs | How primes push requirements that exceed your capacity |
| Suspension impact | What you changed operationally after Phase II pause headlines |
| What would help | Clearer timelines, scaled paths, assessment capacity, cost realism |
Avoid: classified data, other companies’ confidential pricing, personal attacks, or claiming you speak for the entire industry.
Suggested structure (short)
- Header — company size band, role (sub/prime), contact email
- Context — one paragraph on your CMMC/800-171 posture
- Answers — map to official RFI questions one-by-one
- Closing — one ask (clarity, timeline, burden recognition)
Fill-in response template (archive)
Download: cmmc-reform-task-force-rfi-response-template.txt
Copy also below:
SUBJECT: CMMC Reform Task Force RFI response — [Company legal name]
1) Who we are
- Employees (approx): ___
- Role: [prime / sub / both]
- State / region: ___
- Do we handle CUI for DoD or primes? [yes / no / unsure]
- Contact for this filing: name, email, phone
2) Burden we actually see (facts, not slogans)
- Money spent to date on cyber readiness / CMMC prep (range OK): $___
- Tools / MSP / consultant categories (no vendor secrets required): ___
- Owner or IT hours this year (approx): ___
- Assessment / C3PAO experience (wait times, quotes if non-confidential): ___
3) What Phase II suspension / uncertainty changed for us
- What we paused: ___
- What we continued (SPRS, DFARS, prime flow-downs): ___
4) Answers to official RFI questions
[Paste each official question number and answer in order.
Keep each answer 1–2 short paragraphs. Use ranges where precise $ is sensitive.]
Q1: ...
A1: ...
Q2: ...
A2: ...
5) One constructive ask
- The single change that would most help small/mid contractors: ___
6) Disclaimer
This response is industry input from a small/mid-size contractor. It is not legal advice
and does not include CUI or classified information.
Submitted: [date] by [name, title]What’s next (for contractors)
- Do not treat the RFI close as compliance relief. Continue defensible self-assessment if your contracts require it.
- Watch primary sources for Task Force outputs (~mid-September 2026 is widely discussed for CIO reporting—confirm when published).
- We will revise the suspension guide when primary text moves (next scheduled review noted on that page).
- Keep a copy of anything you already filed offline.
Related
Frequently asked questions
Is this RFI still open?
No. As of this page’s Last verified date, the public response window closed 14 August 2026. Re-check DoD / Acquisition.gov / Federal Register primary notices if you hear of a reopening or a successor RFI.
What happens next?
Public coverage points to Reform Task Force recommendations delivered to the CIO around mid-September 2026, with formal instruments (class deviation, DFARS change, or 32 CFR Part 170 amendment) possibly later. Treat those dates as forecasts until primary text publishes.
Do I need a lawyer to have filed?
Not required for a public RFI comment in most cases, but counsel can review if you are unsure what to disclose. Do not include CUI, proprietary pricing of third parties you cannot share, or classified information.
Did the RFI close change my SPRS score obligations?
No. An RFI is policy input. DFARS safeguarding, self-assessment, and SPRS duties—if they apply to your contracts—continue unless and until primary rules change.
What this page is / is not: readiness and advisory guidance only. Not legal advice, not a C3PAO assessment, and not a CMMC certification. CUI designation is driven by government requirements and contract language—not by this site. Prefer primary sources when policy text conflicts with any blog (including ours).