Levi Kapilevich (NeQter Labs) joins Steven Molter to talk the 6,500 member CMMC Discord, the DoD suspension, reassessment risk, and MSP readiness in 2026.
Inside the CMMC Discord, the Pause & MSPs: Levi Kapilevich (NeQter Labs) | Ep. 21
Watch the Full Video Here
Before CMMC had a name, about 20 people started a Discord server to work through NIST SP 800-171 and DFARS 7012 together. That server is now the CUI/CMMC “Center of Excellence” Discord. It has grown to nearly 6,500 members with a couple hundred messages a day, entirely by word of mouth. Levi Kapilevich was one of the original 20. Today he sits on its volunteer moderator team.
In Episode 21 of the IntelliGRC Podcast, Steven Molter sits down with Levi, Business Development Manager at NeQter Labs. They recorded in early September, days before the DoD’s 60 day CMMC pause review window closed.
How the CMMC Discord became a DIB resource
Levi traces the server back to the GovIT subreddit days, when many of the names shaping the CMMC ecosystem today were trying to figure out scoping and CUI with no assessment guide to lean on. His rule of thumb: if you found your way to the Discord, you are already ahead of most of the Defense Industrial Base. [Internal link: Ep. 14 with Andy Sauer, who started the server]
The CMMC pause is a suspension
Both agree the distinction matters. A pause implies things resume as they were. Nothing in the DoD CIO’s language guarantees that. They walk through the conflicting messages that have followed since July. The CMMC Assessment Process (CAP) and the Level 3 assessment guide disappeared from the CIO website. Guidance handed to C3PAOs behind closed doors never made it into anything official. Levi shares the email that sums up the damage: a prospect telling him they would be interested “when DoD decides to start this back up again.”
The reassessment risk nobody priced in
Certified organizations are calling NeQter to swap out tools they rushed into place. The open question is whether that counts as a significant change that triggers a full reassessment. Levi has heard conflicting answers from C3PAOs and CCAs, and Steven explains what FAQ version 6 did and did not settle.
What NeQter Labs does
NeQter started as a project team inside a defense contractor and grew into an on prem platform combining SIEM, vulnerability scanning, and asset inventory mapped to NIST SP 800-171 and CMMC. Levi covers the migration from Elastic to OpenSearch, the OpenVAS scanning engine, the roughly 500 CMMC clients the company serves, and why the team has stayed bootstrapped.
MSPs, then and now
In 2020, Levi and Tom Cornelius of ComplianceForge published “Why MSPs Are the Dumpster Fire of CMMC.” Angry MSPs kept emailing for years. Today, Levi says the difference is night and day, though he found a Boston area provider this year still selling a self assessment tool that never reaches the assessment objective level. Steven explains why unequipped MSPs remain one of the biggest risks to small contractors, and why the MSPs voluntarily getting certified give him hope. [Internal link: IntelliGRC MSP consulting or services page]
Use the pause
Levi’s closing advice is to treat the suspension as a gift. DFARS 252.204-7012 and 7020 are still in your contracts, SPRS still needs a score, and DOJ has not stopped filing False Claims Act cases. As Steven puts it, if you are waiting on a certification requirement before implementing the requirements, you have misunderstood what the certification is.
Connect with Levi Kapilevich on LinkedIn or at neqterlabs.com.