What moved, and what it costs you
Periodic issues on FedRAMP and CMMC movement that reaches software vendors: what changed, what it means for a company preparing to bid, and the dates that matter next. Every date is traced to the body that published it. Anything we could not verify is left out and said so.
We publish when there is something worth publishing and make no commitment about how often that is. A schedule we have not committed to is the same kind of claim as a compliance deadline nobody checked.
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
- September 2026
Class B and C opened. CMMC still has no date.
The federal compliance calendar moved twice in August, in opposite directions — and a software company preparing to bid has to spend the quarter against both. One pipeline opened. One requirement is still paused with nothing behind it.
Read the September 2026 issue →
A date, or the name of the body that published it
Most compliance writing on the open web is a paraphrase of a paraphrase, which is how a requirement that was suspended in July is still being counted down to in September. Every issue of this brief cites the primary record: fedramp.gov, dodcio.defense.gov, acquisition.gov, federalregister.gov.
Where a link has been opened and dated, it is a link. Where it has not, the issue names the publisher and the document identifier and says why — an unopened URL would be the one unchecked claim on a page whose argument is that the record is checkable. Each issue prints the date its sources were last read, separately from its own publication date.
The same standard governs the CMMC explainer and every row in the Compliance column of the roadmap.
Start with the long version
Six pages on what the CMMC certification suspension left standing: scoping, the level question, where the requirement set actually consumes engineering time, and the sequence that fits inside a live pipeline. We confirm the address before anything is sent.
What this form does, exactly
It sends one document — the CMMC brief — after you confirm the address. It does not sign you up for new issues: the list itself is not built yet, and a form that implies one is the kind of small dishonesty this whole publication exists to argue against.
The privacy policy now carries the consent terms a real list needs — what subscribing signs you up for, one-click unsubscribe, and that the list is never sold or shared. The list opens when the sending side is built to match. Until then the issues are here, free and indexable, and writing to us is the fastest way to be told when the next one lands.