Until you have outside confirmation, we attest via SPRS[1] which requires more detail than just checking a box and holds legal constraints against falsification

Until you have outside confirmation, we attest via SPRS[1] which requires more detail than just checking a box and holds legal constraints against falsification, a lot of DoD contracts renew March-June and the drop dead for CMMC for DoD suppliers is 2025. You will hear about this falsification happening more and more (especially around pentest reqs) , without a dedicated implementation team compliance is hard for already understaffed universities. It is the least interesting place to be for infosec work. [1]https://www.sprs.csd.disa.mil/ https://www.sprs.csd.disa.mil/