CUI Hotline: Live CMMC Q&A

If you think November 2026 is the deadline for every defense contractor to achieve CMMC Level 2, then the weekly CUI hotline is for you.November could be the deadline depending on your specific customer.November isn't the deadline based on any general policy from the department of defense.For a lot of people who have already received CMMC status level requirements, they wish they another 7+ months.There are a lot of variables at play and we sit down every week to answer questions about all of them (live!)

The CUI Hotline continues this Friday at 10am EST.
Questions about DFARS cyber requirements? NIST? CMMC?
We sit down for an hour every week and answer your questions live!

Every Friday at 1pm EST we sit down and answer questions about CMMC, DFARS cyber requirements, and NIST controls.
And we do it live!
And it's free!
See you there.

A question we often hear: how can businesses be expected to defend themselves against nation states?
Typically people don't realize how even nation states routinely use well known techniques with known mitigations and detection signatures.
Turns out that some pretty boring, evergreen cybersecurity practices that have been around for decades are still extremely effective.
But you have to actually do them.
We answer all kinds of questions on the Hotline every week.
Stop by this Friday and we'll spend some extra time talking about how a 10 year-old security standard still punches above it's weight...

We're only 15 weeks into the CMMC phased rollout and the DoD is crushing their Level 2 certification estimate.
Originally the department was shooting for 517 Level 2 certifications in the first year.
We're barely over 100 days in and we're already nearly double that number.
There's just 181 days left until the start of phase 2.
Have questions? Stop by the hotline and we'll answer them live!

There's just 185 working days left until CMMC Phase 2 begins.
If you have questions, the CUI Hotline is the place for you.
Live every Friday at 1pm EST.

We all have a lot of questions after the Super Bowl.
- How does it feel to cut a 14-win QB only to watch him win a Super Bowl the next year?
- Who had Sam Darnold as the first QB from the 2018 draft class to win a Super Bowl?
- Why did the DoD make the largest non-CMMC change to DFARS cybersecurity clauses since 2020 and fail to, ya know, fail tell anyone about it?
Luckily we sit down every Friday at 1pm EST to answer important questions like these - LIVE!

People overestimate the difference between NIST SP 800-171r2 and r3.
They underestimate the difference between CMMC Level 2 and Level 3.
Not sure about the difference or why it matters?
Come hang out on the Hotline and we'll answer your questions live!

We're still 41 weeks away from the start of CMMC Phase 2.
Yet, many defense contractors are finding out that the "phased roll-out" has virtually no bearing on when they will receive a 3rd-party assessment requirement.
People who tuned into the weekly CUI Hotline knew what was coming.
Not sure? Tune in each Friday and we'll answer your CMMC/DFARS/NIST questions live!

We're 2.5 months into the CMMC roll-out.
The most common type of call we get these days:
Defense contractors we originally spoke with 3-4 years ago who decided to "wait and see" what would happen.
It's a big reason why we're answering the same questions today that we did in 2022.
That's also why we started the weekly hotline!

Another week into the CMMC phased roll-out, another supplier letter from a major prime contractor.
Trying to condense years of compliance work in to a few months?
Putting the final touches on your systems before the big assessment?
You probably have a lot of questions and luckily we sit down every Friday to answer them live!

We're quickly approaching 100 CMMC level 2 certified clients.
Every week we share our insight and experience for free!
CMMC is going to change things for defense contractors in 2026, but the CUI Hotline has your back.

We're one month into Phase 1 of the CMMC roll out and reality is setting in for a of companies.
Some opted to wait until the last minute as a strategy.
Some waited with no intention of ever getting started.
We get very different questions from both groups.
Luckily we sit down every Friday and answer as many as we can - live!

For the first time in five years there are no major rulemaking updates looming over the holiday season.
CMMC is in-effect, the phased roll-out is underway, and requirements are being signaled by the government and primes alike.
Instead of one or two big questions, it's the season of a million little questions.
That's why we do the Q&A livestream every Friday!

We're quickly approaching 67 CMMC Level 2 clients.
We sit down every Friday to share what we've learned.
Find us live on YouTube, LinkedIn, or reach out at cuihotline[.]org

First hotline of CMMC Phase 1!
Join us live every Friday at 1pm EST on LinkedIn and YouTube.
We answer questions about everything from DoD cyber regulations to individual controls to technology and service strategies real companies have used to achieve CMMC Level 2.

Alrighty folks, the last CUI Hotline before the start of CMMC Phase 1!
This is a great time to check out the stream and bring your questions on all things NIST, CMMC, and DFARS cyber.

CMMC Phase 1 begins just after Halloween - spooky!
To celebrate we're telling CMMC ghost stories on the hotline.
Boo!

The government shutdown continues, but CMMC phase 1 is still 11/10/2025.
A trickle of notices are still going out on SAM[.]gov and they clearly include CMMC requirements.
Have questions? We have answers live every Friday!

We're less than 30 days away from the start of CMMC phase 1.
That means lots of people with lots of questions.
We sit down for an hour every Friday to answer questions live.
CMMC, DFARS, NIST, you name it.
Come hang out!

We're just 35 days away from the start of CMMC phase 1.
Have questions?
We've been streaming live every Friday for over a year.
Come hang out!

Every week we sit down to answer as many questions as possible in an hour.
And we do it live!
I used to think an hour was too long, but with nearly 100 live viewers every week we can barely get through everything.
See you there!

Some of the most interesting questions are the ones that don't get asked.
Lots of people assume they will be allowed to self-assess CMMC level 2 during phase 1 of the roll-out.
First, DoD policy has a caveat to phase 1 so big you could drive a truck through it - level 2 certifications will absolutely be required.
Second, according to the final rule estimate, only 2% of defense contractors would qualify for a level 2 self-assessment.
With such a large policy gap and such a small % chance, where is the confidence in self-assessments coming from?
Tune in Fridays at 10...

Here we are nearly a year later at live episode no. 50!
And the Summit 7 YouTube channel recently crossed 60,000 subscribers!
Our audience has collectively spent over 15,000 hours watching our CUI Hotline livestreams alone.
We absolutely love interacting with everyone each week.
Here's to 50 more!

We're coming up on our 50th CMMC Q&A livestream.
First, we never get tired of answering questions.
Second, it's amazing how often the same questions come up.
It's also amazing how often new questions come up about old information.
For example, the most recent DFARS class deviation simply reinforces CMMC policy guidance that went into effect in December 2024:
The CMMC phased roll-out begins on the effective date of the 48 CFR CMMC final rule - NOT on October 1st.
We won't know the effective date until the 48 CFR CMMC final rule is published...

CUI HOTLINE - EMERGENCY EDITION
ICYMI: The 48 CFR CMMC final rule is out.
CMMC Phase 1 begins November 10th, 2025.
Today, 9/9/25, the 48 CFR CMMC final rule is out for public inspection.
Tomorrow, 9/10/25, the rule will be officially published in the Federal Register.
60 days later, 11/10/25, the rule officially goes into effect.
From that day forward, all new DoD solicitations and contracts will include some level of CMMC requirement as a condition of contract award.
Join us today for our instant reaction episode!

Not every question has an answer.
For example: Will CMMC Phase 1 include Level 2 certification assessments?
A lot of people have convinced themselves that Phase 1 will only include self-assessments.
We've read the relevant policies roughly 3,185 times and that's not what they say.
The real question is how to strategize and operate your business under uncertainty.
We sit down every week to try and help with that problem - even if there isn't a black and white answer.

The most confusing part about CMMC is where people get their wacky ideas from.
It is incredibly unlikely that CMMC will be required on October 1st.
It is incredibly likely it will start being required in Q4.
Not every contract will require certification in the first 12 months.
But it's more likely than not that you'll be asked for certification during that same time period.
Want straight answers with citations?
We host a Q&A livestream every Friday at 10am PST.
Check it out.

The latest edition of CMMC whataboutism: L2 certified service providers.
There are nearly 300 Level 2 certified companies out there.
A common reaction I'm seeing:
"Yeah, well, I'll bet a lot of those are just MSPs, not contractors"
This is bizarre because not that long ago everyone was complaining that MSPs wouldn't get certified ahead of their clients, creating a huge bottleneck.
We should want as many of the early adopters to be MSPs as possible.
The MSP Collective Directory lists 24 certified MSPs.
That's ~10% of the current L2 certs.
In addition to our...

People have been asking about the CMMC "small biz roll-out".
There is no such thing.
CMMC will be rolled out by contract and the level required will be determined by the type of data handled pursuant to that contract.
The size of the company involved (or the amount of controlled information) is irrelevant.
Every Friday we spend an hour taking live questions on CMMC, DFARS, NIST, etc.
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
...

This has been the busiest 45 day stretch in CMMC-land I can remember.
- The 48 CFR CMMC final rule is in final regulatory review
- Supplier memos from Lockheed and Boeing re: CMMC
- Official CMMC notices from the Army Corps of Engineers
- SECDEF memo emphasizing CMMC as a strategic priority
That's a lot to keep up with.
Luckily we sit down every Friday to answer questions live.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's a real number)

The longest pole in the CMMC tent isn't the total number of assessors.
It's the collective capacity to implement requirements.
Most companies affected by DoD cyber requirements don't have the ability to implement those requirements.
Only now that CMMC (which verifies implementation) is around the corner are people realizing how far behind they are.
Every Friday we sit down and answer any and every kind of question that we hear from that week and any live questions from the audience.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's...

We've been taking live questions about CMMC every week for almost a year.
What's the most common question, by far?
"How fast can we go?"
Meanwhile, Reddit threads are popping up from folks who have been duped by companies claiming compliance can attained in a matter of days.
Or that 100% of compliance can be outsourced to an external service provider.
Do you have a sinking feeling that you've been sold something that's too good to be true?
Call the hotline today: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.

And we do it live!

If you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?

Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we sit down and provide the analysis other people use to train their lame "AI" models.
We answer all the questions about CMMC, DFARS, NIST, CUI, and more.
We stream live on LinkedIn and YouTube but if you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021