October 2026 Cyber AB Town Hall Recap: Task Force Timing, CAICO's New Content, and Two New Stakeholder Collectives

The October Cyber AB Town Hall opened with Matt Travis's latest understanding of when the CMMC Reform Task Force's work could become public. Todd Gagnon shared CAICO's updated timeline for new CCP and CCA training content and confirmed that Town Hall attendance now counts toward CPE requirements. The session also introduced two new stakeholder groups working with the CyberEF, the DIB Collective and the ESP Collective, and included a review of conflict of interest guidance, the latest ecosystem and international participation numbers, and a Q&A.

CMMC Reform Task Force: Timing and status

Travis said the status of the task force was the most frequently asked question at CS5 East. He emphasized that he has no primary sources on the task force's work. His understanding is that DoW CIO Kirsten Davies and other members of the leadership team continue to iterate with the task force.

A possible November timeline

Travis said he has heard secondhand, from people he believes are in the know, that it is reasonable to expect an announcement in November, including decisions on the program's path forward. He stressed that this is not firsthand information. If changes are announced, the Cyber AB may convene a short-notice Town Hall in November to cover them.

Why the review is taking longer than 75 days

The DoW originally described a 60-day review followed by 15 days to write recommendations. Travis said he had been skeptical of that timeline and drew on his own experience as Deputy Under Secretary for National Protection Programs at DHS, where he worked on reforming the Chemical Facility Anti-Terrorism Standards program. He described how reforming a government program requires extensive coordination with lawyers, Congress, and department leadership, as well as careful review of existing statutes, appropriations law, and departmental policy. Without claiming any insight into the task force's process, he suggested that similar coordination is likely underway at the DoW.

CAICO updates: New content timeline and the renewal window

Todd Gagnon revisited several CAICO topics from September, noting that follow-up questions from certification holders made them worth covering again. The biggest change since last month is a firm timeline for CAICO's new training content.

New CCP and CCA content will arrive in Q1 2027

CAICO had originally planned to launch new training content and exams in January, and has shifted that timeline by a few months because of the Phase 2 pause. A beta of the new exams will run from January through late February, CAICO will use the beta results to finalize the exams and curriculum in March, and the new exams are expected in early April after the standard setting required under ISO/IEC 17024.

To bridge the gap, CAICO has extended authorization for the current Rev 2 content from Approved Publishing Partners through March 31, 2027. The corresponding exams remain available through September 30, 2027, giving candidates six months after the current content sunsets to sit for their exam.

CAICO expects to post a call for beta volunteers on its website around November 16. Gagnon noted that passing a beta exam earns the full certification, and suggested that CCPs planning to pursue the CCA consider it as a way to certify early on the new content.

The renewal window will not be extended

The renewal window opens November 1 and runs through December 31. Some certification holders asked whether CAICO would delay renewals given the pause, and Gagnon said it will not. Because the CCP and CCA are accredited under ISO/IEC 17024, they must be maintained on their certification cycle regardless of where the CMMC program stands. Renewal requirements are unchanged from last month, with one clarification: Lead CCAs pay both the CCA renewal fee and a separate LCCA renewal fee.

Cyber AB Town Hall attendance now counts towards CPE

After several months of questions, Gagnon confirmed that attending the Cyber AB Town Hall counts toward CPE requirements. Certification holders do not need to submit proof of attendance, but should keep their records. Gagnon explained that CAICO relies on each holder's professional judgment to decide whether an activity qualifies, and audits a percentage of certification holders each year to confirm the CPEs they claim apply. He also confirmed that a single CPE can be applied to multiple certifications, and that passing a certification exam can count as CPE toward a holder's other certifications.

Stakeholder spotlight: the DIB Collective and the ESP Collective

Mike Snyder of the CyberEF explained that the CyberEF has struggled to reach small and medium-sized DIB organizations, and that early in the rule's rollout, MSPs and other service providers faced persistent confusion about how their roles fit into the program. Partnering with stakeholder groups is one way the CyberEF is trying to close those gaps. Two new groups joined that effort this fall.

The DIB Collective gives OSCs a voice

Allison Giddens introduced the DIB Collective as a voice for the organizations that live under CMMC and NIST 800-171 requirements. It is designed for organizations whose core business is something other than compliance or IT services, such as manufacturers, outside processors, engineering firms, distributors, software companies, and research organizations.

About a month after launching, the collective has roughly 40 member organizations, ranging from companies that are fully compliant to those still working towards certification. Giddens said both perspectives are needed to reflect the reality of the DIB.

The collective operates as an OSC council under the CyberEF, with initial committees for manufacturing, technology and services, and higher education and research. Its first working groups respond to specific requests from the ecosystem. One will examine how organizations are securing OT environments in practice and where requirements and manufacturing realities diverge. Another will help shape a potential expansion of the Cyber AB Marketplace that would let OSCs list what they produce and which CMMC level they hold, something Snyder said DIB companies have asked for repeatedly. A third will look at how organizations can manage supplier risk without creating an unworkable administrative burden.

Giddens said the goal is to produce deliverables that help ground future guidance in real-world implementation. Travis added that if the DoW changes the program, the Cyber AB will need industry input to update its documentation, and if OT comes into scope, the collective could help inform the training assessors would need.

The DIB Collective is volunteer-run and accepting applications at dibcollective.org.

The ESP Collective brings service providers together

Brandon Sessions, President of the ESP Collective, said the group grew out of a meeting of service providers and OSCs at the National Cyber Summit in Huntsville a little over a year ago. Attendees wanted a forum for getting accurate answers to common questions, particularly as misleading claims about CMMC continued to circulate in the market.

The collective is built around collaboration among providers, transparency in how services are delivered, and educating its members. Sessions said it has been sharing member feedback with the CyberEF and Cyber AB during the reform period, and plans to focus on provider education once the program's direction is clear. It also plans to host small events across the U.S. with the DIB Collective, bringing OSCs and providers together for feedback sessions and workshops.

Membership is open to MSPs, MSSPs, RPOs, consultants, and technology vendors, and Snyder noted that C3PAOs are external service providers eligible to join as well. The two collectives are also linking their memberships: OSCs that belong to the DIB Collective can join the ESP Collective at no cost. More information is available at espcollective.com.

Avoiding conflicts of interest

Travis and the Cyber AB's compliance officer, Maureen Njuguna, used part of the session to review the Cyber AB's guidance on risks to impartiality. Travis described impartiality as one of the core reasons the Cyber AB exists, alongside competent and consistent assessments. The guidance is aimed primarily at C3PAOs, though Travis said it is useful awareness for everyone in the ecosystem.

The Cyber AB groups risks to impartiality into four categories: professional, financial, personal, and organizational. Njuguna's central point was that the appearance of a conflict often carries as much weight as an actual one. Her examples included an assessor subcontracting with an OSC on unrelated work, a C3PAO assessor whose relative owns the MSP supporting the OSC, and an MSP that repeatedly refers clients to the same C3PAO. Travis added that relationships like alumni ties can matter too, citing the example of a lead assessor who serves as alumni club president at a university seeking certification.

Njuguna also cautioned that the cooling-off period in 32 CFR is a minimum. Repeated relationships can still create an appearance of conflict after it has passed. When a potential conflict is reviewed and no issue is found, the review itself should still be documented.

Travis summarized the expectation as "identify, disclose, document." C3PAOs are responsible for assessing their own risks to impartiality, and the Cyber AB will look at how they are doing so through accreditation, reauthorization, and any complaint investigations.

CMMC ecosystem numbers

Level 2 certifications continued to climb, with final certificates up 8% since the September Town Hall, according to Travis. There are 78 conditional certificates and 184 Level 2 assessments in progress. Travis said the numbers would likely be stronger without the Phase 2 pause, and acknowledged that many C3PAOs have lost pipeline, but said organizations continuing toward certification still see its value.

The C3PAO count reached 120, including 4 accredited and 116 authorized, with 12 new C3PAOs authorized in the last quarter and none leaving the program. Growth in CCAs and CCPs has slowed, and Travis expects that to continue next month given lower class enrollment. The number of Approved Training Providers is now 47.

Travis also highlighted continued international interest in CMMC. South Korea and Canada lead in Registered Practitioners, with 145 and 56 respectively, and Canada, Taiwan, and South Korea have the most CCA and CCP candidates. Taiwan's first authorized C3PAO, announced last month, has since been joined by C3PAO applications from Australia, Canada, and South Korea.

We'll continue to track updates and insights from each Cyber AB Town Hall as guidance evolves. For ongoing coverage and past recaps, visit the CMMC.com newsroom.