1 00:00:00,000 --> 00:00:05,097 Wait, so on February 1st of 2026, when the Department of Defense issued Class 2 00:00:05,143 --> 00:00:11,018 Deviation 2026 O0025 under the Revolutionary FAR Overhaul, a lot of contractors 3 00:00:11,053 --> 00:00:13,851 thought it was just, you know, administrative cleanup. 4 00:00:14,454 --> 00:00:16,718 Like shifting numbers around on a spreadsheet. 5 00:00:16,708 --> 00:00:19,748 Yeah, and, and, and that assumption is flat out dangerous. 6 00:00:19,855 --> 00:00:22,868 Firsthand testimony, not commentary here. 7 00:00:22,937 --> 00:00:29,348 People saw FAR 52.204 21 move to FAR 52.240 93, or 8 00:00:29,468 --> 00:00:35,748 DFARS 252.204 7020 become DFARS 252.240 9 00:00:35,908 --> 00:00:40,068 7997, and they figured, okay, paper shuffle. 10 00:00:40,148 --> 00:00:41,588 But they missed the main event. 11 00:00:41,868 --> 00:00:47,748 DFARS 252.204 7019 was completely eliminated. 12 00:00:47,828 --> 00:00:51,028 The contractor basic self assessment is dead. 13 00:00:51,042 --> 00:00:52,366 Wait, wait, it is gone? 14 00:00:53,178 --> 00:00:57,242 So the self reported score you just type into the Supplier Performance Risk System, 15 00:00:57,625 --> 00:01:01,166 SPRS, that doesn't count as a basic assessment anymore? 16 00:01:01,167 --> 00:01:06,607 The term basic assessment does not even exist in the text of 252.240 17 00:01:06,847 --> 00:01:08,207 7997. 18 00:01:08,347 --> 00:01:10,207 The DoD erased it. 19 00:01:10,427 --> 00:01:16,287 Now, the clause only defines two things: Medium Assessments and High Assessments. 20 00:01:16,399 --> 00:01:22,927 Both of them are government led, using NIST SP 800 171A procedures. 21 00:01:23,067 --> 00:01:26,447 The government isn't taking your word for it on paper anymore. 22 00:01:26,527 --> 00:01:31,167 They wrote direct validation authority straight into the contract clause. 23 00:01:31,167 --> 00:01:34,917 I was talking to a mid tier defense supplier last week, and they were, 24 00:01:34,987 --> 00:01:38,748 uh, they were totally convinced that as long as they had a positive score sitting in 25 00:01:38,830 --> 00:01:44,809 SPRS, they were safe from anyone knocking on their door until full CMMC rolled 26 00:01:44,832 --> 00:01:45,296 around. 27 00:01:45,900 --> 00:01:48,768 They thought the SPRS score was an umbrella. 28 00:01:48,750 --> 00:01:51,310 It is not an umbrella, it never was. 29 00:01:51,550 --> 00:01:57,630 CMMC dictates your eligibility for certification, but DFARS 252.240 30 00:01:57,790 --> 00:02:02,750 7997 dictates contract enforcement authority right now. 31 00:02:02,850 --> 00:02:07,230 The second that clause hits a solicitation or flowdown, the Defense Contract 32 00:02:07,274 --> 00:02:12,190 Management Agency or DIBCAC has full legal standing to walk into your physical 33 00:02:12,252 --> 00:02:16,990 facility, inspect your server room, and interrogate your staff on your System 34 00:02:17,043 --> 00:02:18,110 Security Plan. 35 00:02:18,125 --> 00:02:20,795 So if an auditor walks in, what are they actually looking at? 36 00:02:21,492 --> 00:02:24,255 Is it mostly technical IT setups, or... 37 00:02:24,250 --> 00:02:29,450 Look, compliance labor in the defense industrial base is always 75% documentation 38 00:02:29,570 --> 00:02:32,170 and 25% technical controls. 39 00:02:32,284 --> 00:02:32,971 Always. 40 00:02:33,090 --> 00:02:37,130 You can have the best firewalls on the planet, but if your System Security Plan 41 00:02:37,183 --> 00:02:41,850 doesn't match operational reality, or if your policies are aspirational templates 42 00:02:41,870 --> 00:02:45,850 you bought online, a Medium or High assessment will tear you to shreds. 43 00:02:45,930 --> 00:02:48,970 They validate evidence, not promises. 44 00:02:48,958 --> 00:02:51,837 That brings up a massive issue I am seeing everywhere right now. 45 00:02:52,046 --> 00:02:56,075 Prime contractors are seeing these new clause numbers and panic flowing them down. 46 00:02:56,458 --> 00:03:00,858 I am hearing about tier three machine shops, guys making simple metal brackets, 47 00:03:01,102 --> 00:03:06,373 getting emails from primes saying they need full CMMC Level 2 and a third party 48 00:03:06,431 --> 00:03:09,856 C3PAO assessment or they lose the contract. 49 00:03:09,875 --> 00:03:14,915 It is a complete operational breakdown, and it comes down to one fundamental 50 00:03:14,985 --> 00:03:19,955 problem: scope is being driven by the marking, not by the information. 51 00:03:20,062 --> 00:03:24,995 Prime contracting officers are taking routine Federal Contract Information, 52 00:03:25,088 --> 00:03:30,595 basic specifications for a bolt, automatedly tagging it as Controlled Unclassified 53 00:03:30,655 --> 00:03:36,035 Information, and dumping CUI requirements on companies that shouldn't touch CUI at 54 00:03:36,095 --> 00:03:36,515 all. 55 00:03:36,500 --> 00:03:41,481 So because an email header got auto tagged with CUI, a small five person machine 56 00:03:41,527 --> 00:03:47,355 shop is suddenly expected to drop fifty thousand dollars on NIST SP 800 171 57 00:03:47,471 --> 00:03:48,574 implementation? 58 00:03:48,583 --> 00:03:49,303 Exactly. 59 00:03:49,383 --> 00:03:52,663 And it is crushing the lower tiers of the supply chain. 60 00:03:52,839 --> 00:03:58,983 What primes need to do, and what we teach, is the CDI Determination Workflow. 61 00:03:59,163 --> 00:04:04,263 You have to follow the actual data flow, step by step, across people, 62 00:04:04,328 --> 00:04:06,263 technology, and locations. 63 00:04:06,530 --> 00:04:11,063 Is this data Federal Contract Information, or is it actual Covered Defense 64 00:04:11,116 --> 00:04:11,863 Information? 65 00:04:12,156 --> 00:04:18,743 If it is just FCI, the flowdown is FAR 52.240 93, 66 00:04:18,813 --> 00:04:21,383 fifteen basic safeguarding controls. 67 00:04:21,523 --> 00:04:26,583 You don't need a C3PAO, you don't need a 110 control audit, 68 00:04:26,623 --> 00:04:28,823 you just need the brilliant basics. 69 00:04:28,833 --> 00:04:32,978 So instead of just blindly forwarding every DFARS clause down to every sub, 70 00:04:33,222 --> 00:04:37,146 procurement teams actually have to audit what data they are handing over. 71 00:04:37,167 --> 00:04:42,207 If they don't, they are going to lock out their own critical suppliers before award 72 00:04:42,260 --> 00:04:42,927 gates hit. 73 00:04:43,020 --> 00:04:48,607 Right now, every defense contractor needs to perform an immediate crosswalk of their 74 00:04:48,660 --> 00:04:50,527 internal clause matrices. 75 00:04:50,627 --> 00:04:57,487 Map your legacy 7020 references to 252.240 7997, 76 00:04:57,567 --> 00:05:03,407 clean up your contract flowdowns, and verify your actual data markings today. 77 00:05:03,477 --> 00:05:07,727 Because when the government comes to validate, paper promises won't save your 78 00:05:07,798 --> 00:05:08,447 contract.