Audits slipped: the cloud gaps worth closing with the extra runway
Third-party CMMC assessment timing has been pushed back. What that changes is the calendar, not the obligations: DFARS 252.204-7019 still requires a current NIST SP 800-171 self-assessment score posted in SPRS to be considered for award, 252.204-7020 still gives the government access to verify it, and the security requirements underneath both are unchanged. The honest way to read the slip is as runway, and runway is only worth something if you spend it on the heavy gaps.
In cloud environments, the heavy gaps are configuration decisions. Multifactor authentication that covers laptops but not the management console, CLI, API paths, or break-glass accounts carries a five-point deduction if MFA is absent for any users, three if it stops at remote and privileged users. Encryption that is switched on but not FIPS-validated costs three points, and it is the only above-one-point gap the rule permits on a POA&M, which tells you how common the Department expects it to be. A POA&M documents the fix; it does not restore the points.
The operational lesson: use the runway in scoring order. Five-point items first, then the partial cases, then the one-point sweep from your asset inventory, then update the system security plan so the document matches the environment. If your posted score predates your cloud migration, start there, because that number describes an architecture that no longer exists.
This week we also published the full framework behind this series: The CUI Cloud Decision Framework, covering GovCloud, Azure Government, and commercial-with-enclave from the decision through the score.
