CMMC office hours offer clarity

Right Hand’s Office Hours on March 13, 2025 was published as a livestream recording watch) and listed a live Q&A format that took audience questions on CMMC edge cases. Matt Gilbert, identified as a principal who leads Baker Tilly’s CMMC and government‑contractor IT risk practice, appeared as the session’s assessor expert bio). Gilbert’s recap clarified DoD expectations for legacy paper and physical code: accessed legacy documents should be treated and labeled as Controlled Unclassified Information (CUI), and physical copies require locked storage or equivalent protections recap). The session also specified that Commercial‑Off‑the‑Shelf (COTS) items generally don’t automatically carry CUI unless they include unique specs, test data, or quality reports—Gilbert advised confirming with contracting customers recap). On assessment readiness, Gilbert noted the DoD had put the proposed CMMC rule out for public comment and that final publication was expected by year‑end, meaning officially certified assessors should not accept deposits or schedule formal CMMC assessments until the rule is finalized rule timing). He recommended contractors engage in preliminary scoping conversations with prospective assessors and start internal planning immediately to align evidence and scope ahead of formal assessments scoping guidance). Right Hand published a March 13, 2025 replay link in its April 2025 newsletter under “WATCH: Office Hours with a CMMC Assessor” and continues to offer monthly Office Hours registration on its events page for follow‑ups newsletter).