What it means. The requirements for the DIB did not change. Since 2017, the DFARS 7012 contract clause has required companies to meet NIST SP 800-171, and Phase 1 self-assessments are still required. A company that stopped work in July stopped doing work its contracts still require.

Our read. Most attendees seem to understand that the audit is paused but the obligation is not. Speakers made the same point throughout the day. Assessors said clients are pushing assessments to later dates or switching to practice assessments rather than canceling. One assessment firm said about half of its clients kept their certification assessments on schedule.

One caveat: Summit attendees are already paying attention to CMMC, so this number likely runs higher than it would across the industry as a whole.

What it means. Read this next to the “Momentum held” result. More than half of the people who kept the same pace since July 13 still named something that would get them to speed up. For most, keeping pace means holding steady, not speeding up.

Our read. Most companies are still working, but many want clearer rules before they do more. The two things they’re waiting for most point the same way: an update from the DoW, or a contract that states the requirement. Either one would tell them what’s expected.

What it means. We’ve asked the same budget question at three straight Summits. Each year, more companies have budgeted under $50,000 and fewer have budgeted $100,000 or more. The cost hasn’t come down. The DoW estimates that a Level 2 certification assessment costs a small business $104,670 over three years. That covers only the assessment and the yearly confirmations of compliance, not the work to become compliant. A Level 2 self-assessment is estimated at $37,196 over three years.

Our question didn’t say whether the budget should be yearly or total. Even if every answer were a yearly budget, the 37% who budgeted under $20,000 would have less than $60,000 over three years. That’s well short of the DoW’s estimate for the assessment alone.

Our read. We call this the affordability gap: the distance between what contractors set aside and what the government’s own analysis says the work costs. It has grown every year we’ve measured it. Two things likely keep budgets low. First, many companies in the room are small businesses where, as one assessor put it, every penny matters. Second, the pause gave cautious buyers a reason to wait until the rules are clear. One speaker said many in the industry believe concern about small-business costs was part of why the DoW paused in the first place.

The risk is budgeting only for the assessment. A company also has to pay for the security work the assessment checks, and a small budget may not cover both. Closing the gap means spending first on what matters most, which is protecting CUI, and choosing tools that cut the cost of everything else.

What it means. The room is divided. Half of respondents already use AI for the most time-consuming part of compliance, and almost as many haven’t started. Other uses, like gathering evidence (18%) and reviewing code or system settings (16%), are less common.

Our read. Many companies not using AI may be avoiding a real risk without knowing its limits. Pasting sensitive government information into an unapproved AI tool counts as a data spill. Any AI tool that handles that information must meet the same security standards as the rest of the protected environment. But drafting a policy or a security plan template doesn’t require sensitive information at all. Companies that list which tools are approved, and what can go into them, can use AI safely.

What it means. The tool a company picks determines where its data goes. The Copilot name covers several different products: the free version in a web browser, the business version in Microsoft 365, and the version in Microsoft’s government cloud, which speakers named as one of the approved options for sensitive government information.

Our read. Copilot likely leads because it’s the easiest option. It comes with the Microsoft 365 licenses many companies already pay for, and several respondents said they chose it because it keeps their data inside their own Microsoft environment. That reasoning holds up as long as the version they use is approved for the data they put in it. Claude’s close second suggests teams are also choosing whichever tool writes best.