1 00:00:00,000 --> 00:00:02,856 Here's a detail that should make any subcontractor stop. 2 00:00:03,460 --> 00:00:09,253 Under Class Deviation 2026 O0025, certain clauses go down to every tier, 3 00:00:09,578 --> 00:00:13,270 even to commercial suppliers, and a prime has no discretion on them. 4 00:00:13,874 --> 00:00:18,437 Other clauses only belong in a subcontract if a specific kind of data is in play. 5 00:00:19,040 --> 00:00:21,246 Primes often treat both groups the same way. 6 00:00:21,757 --> 00:00:23,081 Paul, where do we start? 7 00:00:23,083 --> 00:00:24,323 With the architecture. 8 00:00:24,413 --> 00:00:28,323 The deviation took effect February 1, 2026. 9 00:00:28,390 --> 00:00:35,083 It implements the Revolutionary FAR Overhaul Part 40 and creates a new DFARS Part 10 00:00:35,243 --> 00:00:39,083 240 on information security and supply chain security. 11 00:00:39,270 --> 00:00:44,283 It carries out Executive Order 14275 and Executive Order 12 00:00:44,523 --> 00:00:50,363 14265, which push toward keeping provisions that are required by statute or 13 00:00:50,419 --> 00:00:52,203 essential to sound procurement. 14 00:00:52,274 --> 00:00:58,843 Revision 3 came out September 3, 2026 from John Tenaglia, and it supersedes 15 00:00:58,905 --> 00:01:01,403 Revision 2 from July 16. 16 00:01:01,523 --> 00:01:03,363 One split matters here. 17 00:01:03,423 --> 00:01:10,043 Civilian agencies are moving toward NIST SP 800 171 Revision 3 under a 18 00:01:10,123 --> 00:01:16,123 proposed FAR Part 40 rule, FAR Case 2026 001. 19 00:01:16,283 --> 00:01:22,603 DoD stays anchored to Revision 2 under DFARS Part 240 and 32 20 00:01:22,803 --> 00:01:25,003 CFR Part 170. 21 00:01:25,042 --> 00:01:28,943 So the same company can face two different baselines, depending on who's paying. 22 00:01:28,958 --> 00:01:29,518 Yes. 23 00:01:29,578 --> 00:01:35,278 And the floor under everything is FAR 52.204 21. 24 00:01:35,438 --> 00:01:41,118 It covers Federal Contract Information with 15 basic safeguarding requirements, 25 00:01:41,138 --> 00:01:44,798 and it maps to CMMC Level 1 self assessment. 26 00:01:44,905 --> 00:01:51,438 Above it sits DFARS 252.204 7012, which is where the 27 00:01:51,518 --> 00:01:57,518 110 controls of NIST SP 800 171 Revision 2 live. 28 00:01:57,582 --> 00:02:03,358 That clause also requires a system security plan, FedRAMP Moderate equivalency for 29 00:02:03,411 --> 00:02:08,958 cloud providers, and cyber incident reporting within 72 hours to DIBNet. 30 00:02:08,958 --> 00:02:10,107 Now the flowdown split. 31 00:02:10,316 --> 00:02:12,348 Which clauses can't a prime negotiate? 32 00:02:12,375 --> 00:02:13,655 Four statutory ones. 33 00:02:13,746 --> 00:02:20,375 Clause 252.240 7992 bars transferring covered personal data 34 00:02:20,508 --> 00:02:24,535 of DoD military and civilian personnel to third parties. 35 00:02:24,595 --> 00:02:29,895 The exceptions are contract performance, legal authority, or a formal waiver. 36 00:02:29,986 --> 00:02:36,695 Clause 252.240 7994 covers foreign made drones and counter 37 00:02:36,748 --> 00:02:41,175 drone systems from China, Russia, Iran, or North Korea. 38 00:02:41,255 --> 00:02:48,055 Clause 252.240 7999 covers semiconductors from entities that 39 00:02:48,112 --> 00:02:49,255 supply Huawei. 40 00:02:49,355 --> 00:02:56,135 And 252.225 7007 bars certain munitions list and 41 00:02:56,188 --> 00:03:00,775 Commerce 600 series items from Communist Chinese military companies. 42 00:03:00,868 --> 00:03:05,015 Those flow to all tiers, including commercial products and services. 43 00:03:05,118 --> 00:03:07,575 Nobody has to write a justification for them. 44 00:03:07,655 --> 00:03:09,255 Congress already did. 45 00:03:09,292 --> 00:03:11,103 And the others depend on the data. 46 00:03:11,125 --> 00:03:11,525 Right. 47 00:03:11,605 --> 00:03:18,085 Clause 7012 and the CMMC clause, 252.204 48 00:03:18,485 --> 00:03:25,205 7021, apply when Covered Defense Information or Controlled Unclassified Information 49 00:03:25,285 --> 00:03:30,005 actually sits on or moves through the subcontractor's systems. 50 00:03:30,109 --> 00:03:35,445 Contracts solely for commercially available off the shelf items are explicitly 51 00:03:35,525 --> 00:03:40,325 exempt from 7012, 7021, the assessment clause 52 00:03:40,725 --> 00:03:45,365 252.240 7997, and 53 00:03:45,765 --> 00:03:49,765 252.204 7008. 54 00:03:49,861 --> 00:03:52,485 That's a stated exemption, not a favor. 55 00:03:52,500 --> 00:03:56,691 There's a piece of 7012 that doesn't get enough attention, which is what happens 56 00:03:56,749 --> 00:03:58,305 after you report an incident. 57 00:03:58,333 --> 00:04:02,493 This is an area with issues for sure, but there's a real protection here. 58 00:04:02,573 --> 00:04:08,893 DFARS 240.370 3(d) says reporting a cyber incident must not, 59 00:04:08,946 --> 00:04:14,413 by itself, be interpreted as evidence that the contractor or subcontractor failed to 60 00:04:14,463 --> 00:04:17,693 provide adequate security or breached 7012. 61 00:04:17,800 --> 00:04:23,613 Contracting officers have to consult the DoD component CIO before evaluating 62 00:04:23,678 --> 00:04:26,813 compliance in the context of overall implementation. 63 00:04:26,973 --> 00:04:31,213 My interpretation of this is that the rule is meant to stop punishing the honest 64 00:04:31,266 --> 00:04:31,933 reporter. 65 00:04:32,133 --> 00:04:39,133 A related clause, 252.204 7009, limits how the government and 66 00:04:39,173 --> 00:04:44,253 its support contractors, like forensic analysts, can disclose or misuse your 67 00:04:44,306 --> 00:04:46,493 proprietary information from the report. 68 00:04:46,500 --> 00:04:47,986 And the mechanics for a sub? 69 00:04:48,000 --> 00:04:53,600 The sub reports directly to DIBNet within 72 hours, gets a DoD assigned incident 70 00:04:53,657 --> 00:04:57,520 report number, and passes that number up the chain to the prime. 71 00:04:57,627 --> 00:05:01,920 Contracting officers don't handle malware or media themselves. 72 00:05:01,987 --> 00:05:08,400 Under PGI 240.370 8 and 240.370 9, 73 00:05:08,498 --> 00:05:14,160 isolated malicious software and physical storage media go to the DoD Cyber Crime 74 00:05:14,217 --> 00:05:15,920 Center, DC3. 75 00:05:15,958 --> 00:05:19,743 So what does a small supplier do when a prime hands over a subcontract with Level 2 76 00:05:19,801 --> 00:05:21,809 and 7012 attached to everything? 77 00:05:21,833 --> 00:05:25,513 Primes often engage in defensive over compliance. 78 00:05:25,593 --> 00:05:29,113 They push the highest requirement down because it's safer for them. 79 00:05:29,313 --> 00:05:34,953 A sub can ask for written evidence that CUI or CDI is really involved. 80 00:05:35,049 --> 00:05:40,313 That could be an executed Standard Form XXX, a Contract Data Requirements List, 81 00:05:40,393 --> 00:05:41,753 or a specification. 82 00:05:41,913 --> 00:05:47,033 Then 32 CFR 170.23 does the work. 83 00:05:47,193 --> 00:05:52,393 If the sub only handles FCI, Level 1 self assessment is the requirement. 84 00:05:52,526 --> 00:05:57,673 If it handles neither FCI nor CUI, neither clause applies. 85 00:05:57,793 --> 00:06:01,833 Scope is being driven by the marking, not by the information, 86 00:06:01,873 --> 00:06:03,593 and that's the problem to attack. 87 00:06:03,625 --> 00:06:05,483 Can a sub shrink its own footprint? 88 00:06:05,500 --> 00:06:06,620 Yes, with architecture. 89 00:06:06,833 --> 00:06:10,700 If the work happens in a secure virtual desktop environment, 90 00:06:10,744 --> 00:06:15,500 internal endpoints can be treated as out of scope assets under 32 CFR 91 00:06:15,980 --> 00:06:17,820 170.19. 92 00:06:17,916 --> 00:06:20,860 That's a negotiating point and a cost control. 93 00:06:20,887 --> 00:06:25,180 It's the brilliant basics applied to scoping, not just to controls. 94 00:06:25,208 --> 00:06:28,621 Last episode we covered the CMMC Phase 2 pause. 95 00:06:28,830 --> 00:06:30,038 Where does that stand? 96 00:06:30,042 --> 00:06:36,762 Revision 3 keeps the DoD CIO memorandum dated July 13, 2026, 97 00:06:36,842 --> 00:06:41,322 which suspends the November 2026 move to Phase 2. 98 00:06:41,455 --> 00:06:47,882 Phase 2 would have required third party C3PAO certification at Level 2. 99 00:06:47,980 --> 00:06:54,042 Contracting officers are directed to remove or revise those requirements in new and 100 00:06:54,095 --> 00:07:00,042 existing contracts and solicitations, so Level 1 self and Level 2 self assessments 101 00:07:00,142 --> 00:07:01,322 are what remain. 102 00:07:01,402 --> 00:07:06,442 But the deviation says the suspension does not change the underlying duty to comply 103 00:07:06,538 --> 00:07:11,002 with NIST SP 800 171 Revision 2. 104 00:07:11,102 --> 00:07:13,002 The assessment pressure eased. 105 00:07:13,142 --> 00:07:15,722 The safeguarding obligation didn't. 106 00:07:15,750 --> 00:07:18,908 And the CMMC clauses themselves are still in play. 107 00:07:18,917 --> 00:07:19,477 They are. 108 00:07:19,568 --> 00:07:26,437 Clause 252.204 7021 requires a current CMMC status in 109 00:07:26,557 --> 00:07:33,397 SPRS for systems handling FCI or CUI, with annual affirmations by an authorized 110 00:07:33,457 --> 00:07:34,597 Affirming Official. 111 00:07:34,717 --> 00:07:41,317 The solicitation provision 252.204 7025 requires 112 00:07:41,384 --> 00:07:47,957 offerors to submit a 10 character CMMC Unique Identifier and keep SPRS status 113 00:07:48,007 --> 00:07:50,197 current as a condition of award. 114 00:07:50,337 --> 00:07:56,357 And clause 252.240 7997 replaces the old 115 00:07:56,597 --> 00:08:00,037 7019 and 7020 clauses. 116 00:08:00,170 --> 00:08:05,557 It puts the weight on government led Medium and High assessments by DCMA DIBCAC, 117 00:08:05,626 --> 00:08:09,877 scored under 32 CFR 170.24. 118 00:08:10,037 --> 00:08:12,437 Non duplication also holds. 119 00:08:12,677 --> 00:08:18,117 A DIBCAC High assessment with a perfect score grants Level 2 Final status for three 120 00:08:18,197 --> 00:08:18,837 years. 121 00:08:18,875 --> 00:08:20,825 What about plans of action for gaps? 122 00:08:20,833 --> 00:08:26,193 Under 32 CFR 170.21, none at Level 1. 123 00:08:26,380 --> 00:08:32,193 At Level 2, you need at least an 80 percent score, the 5 point controls and key 124 00:08:32,255 --> 00:08:36,993 physical and connection controls are excluded, and you must close everything within 125 00:08:37,153 --> 00:08:40,953 180 days or the conditional status lapses. 126 00:08:41,016 --> 00:08:44,593 Annual affirmation in SPRS keeps you eligible. 127 00:08:44,793 --> 00:08:48,833 A pause in third party assessments doesn't pause any of that. 128 00:08:48,833 --> 00:08:51,759 So the takeaway is to sort your clauses before you sign. 129 00:08:51,792 --> 00:08:54,512 Sort them into statutory and triggered by data. 130 00:08:54,592 --> 00:08:58,272 Accept the first group, challenge the second with documents, 131 00:08:58,312 --> 00:09:03,712 and report incidents knowing 240.370 3(d) is on your side.