Episode 30: Pentagon suspends CMMC Phase II; regulators start fining

CMMC Phase II suspended; Phase I and DFARS survive. Under implementing memorandum 26-P-1023, programme managers may designate only Level 1 (Self) or Level 2 (Self); Level 2 (C3PAO) and Level 3 (DIBCAC) designations are prohibited during the suspension, with no waivers. Contracting officers must amend active solicitations. This is acquisition discretion over which clauses go into contracts — not a repeal of the underlying rule. A 60-day reform review is open, with an RFI closing 14 August.

Ofcom's largest age-assurance fine yet — £630,000. £600,000 for failing to deploy highly effective age assurance under the Online Safety Act, plus £30,000 for ignoring a statutory information request.

UK designates four hyperscalers as Critical Third Parties. HM Treasury made its first FSMA 2023 CTP designations on 10 July — AWS EMEA SARL, Google Cloud EMEA, Microsoft Ireland Operations and Oracle Corporation UK. Oversight by the Bank of England, PRA and FCA began 13 July. For the first time UK regulators can look directly at a hyperscaler's resilience rather than at their supervised firms' contracts with one.

Commission refers Ireland, Spain, France and the Netherlands to the CJEU over NIS2. On 8 July, for failing to notify transposition measures more than 20 months past the 17 October 2024 deadline. The Commission asked the Court to impose a lump sum plus daily penalties until full transposition is notified.

California DROP deletions start 1 August. Registered data brokers must process deletion requests from 1 August and at least once every 45 days thereafter. The penalty is $200 per day, per missed request. More than 300,000 Californians had signed up as of 2 June — the first cycle will not be a token volume.