Cyber AB June 2026 Town Hall Recap: Enforcement Data, Paper CUI Rules, Choosing a C3PAO, and the FAR CUI Update

Submit any questions you would like answered on the podcast!We're recapping the Cyber AB's June 2026 Town Hall, five topics every DoD contractor needs to hear, plus what's changed since (including the CMMC Phase 2 pause that landed after this town hall happened). Stacey and Brooke break down the real enforcement numbers, the paper CUI rules everyone gets wrong, how to actually vet a C3PAO, and the FAR CUI rule updates working their way through public comment.In this episode:False Claims Act enforcement: why almost every case comes from whistleblowers, not breaches, and why the discrepancies are massive (think negative scores, not "110 vs. 107")Paper-only CUI: when you're exempt from CMMC Level 2 controls, and the exact moment that exemption disappears (scanning, photographing, emailing it)How the town hall's November 10th "full steam ahead" messaging got overtaken by the Phase 2 pause memo weeks laterWhat to actually ask when interviewing C3PAOs (assessor headcount, 1099 vs. employee, on-site requirements, SOCI screening status)FAR CUI rule updates: the incident reporting window moving to 72 hours, and the mislabeled/unlabeled CUI reporting requirement getting struckWhy NIST 800-171 and CMMC were built for ongoing management, not a one-time snapshot, and what that means for your evidence and documentationJustice IT Consulting's own path through certification, and why that certification still matters even during the pause