1
00:00:00,000 --> 00:00:03,216
If you sell a widget to NASA and the exact
same widget to the Navy,

2
00:00:03,460 --> 00:00:08,081
you might assume your cybersecurity
rulebook is, well, basically one single

3
00:00:08,115 --> 00:00:08,684
standard.

4
00:00:09,195 --> 00:00:13,827
But right now, you are legally staring
down two completely contradictory rulebooks

5
00:00:14,153 --> 00:00:16,068
for the exact same laptop.

6
00:00:16,083 --> 00:00:19,523
It is, uh, it is total regulatory
whiplash.

7
00:00:19,616 --> 00:00:22,403
Firsthand testimony, not commentary here.

8
00:00:22,563 --> 00:00:28,083
On June twenty third, 2026, the FAR
Council dropped their proposed overhaul for FAR

9
00:00:28,147 --> 00:00:29,043
Part 40.

10
00:00:29,110 --> 00:00:35,603
Under proposed clause 52.240 seven, any
non federal system holding Controlled

11
00:00:35,683 --> 00:00:42,323
Unclassified Information must implement
NIST SP 800 171 Revision 3.

12
00:00:42,449 --> 00:00:43,843
Period.

13
00:00:43,875 --> 00:00:47,358
Okay, but the Pentagon is already doing
CMMC Level 2.

14
00:00:47,375 --> 00:00:47,935
Right!

15
00:00:48,028 --> 00:00:54,975
Under the Department of War's Class
Deviation 2026 O0025, which

16
00:00:55,007 --> 00:01:00,495
took effect February first, defense
acquisitions are explicitly tethered to Revision

17
00:01:00,655 --> 00:01:03,775
2 under 32 CFR 170.

18
00:01:03,908 --> 00:01:08,975
So if you are a dual market supplier, you
are governing the exact same enclave under

19
00:01:09,019 --> 00:01:12,655
Revision 2 and Revision 3 at the same
time.

20
00:01:12,755 --> 00:01:17,455
The controls do not line up cleanly, the
parameter requirements differ,

21
00:01:17,495 --> 00:01:19,855
and companies are caught in the crossfire.

22
00:01:19,875 --> 00:01:22,801
Wait, so how does a small machine shop
even bridge that?

23
00:01:22,833 --> 00:01:26,433
They cannot, at least not without massive
friction.

24
00:01:26,473 --> 00:01:31,793
And, and, and it gets sharper, because
that same February class deviation quietly

25
00:01:31,850 --> 00:01:33,553
killed off the old paper game.

26
00:01:33,583 --> 00:01:34,744
The old paper game?

27
00:01:34,750 --> 00:01:40,350
DFARS 252.204 7019 is gone.

28
00:01:40,460 --> 00:01:41,310
Removed.

29
00:01:41,530 --> 00:01:46,830
And the replacement clause, DFARS 252.240

30
00:01:47,230 --> 00:01:52,750
7997, completely deletes the term basic
assessment.

31
00:01:52,857 --> 00:01:54,670
It does not exist anymore.

32
00:01:54,708 --> 00:01:55,184
Hold on.

33
00:01:55,230 --> 00:01:58,830
Basic assessment was the self score you
just uploaded to the supplier portal,

34
00:01:58,888 --> 00:01:59,306
right?

35
00:01:59,816 --> 00:02:04,089
You logged into SPRS, checked the boxes,
entered a score of 110,

36
00:02:04,263 --> 00:02:05,528
and went back to work.

37
00:02:05,542 --> 00:02:06,262
Exactly.

38
00:02:06,374 --> 00:02:08,342
Pure self attestation.

39
00:02:08,415 --> 00:02:13,142
Contractors treated their System Security
Plan like an aspirational bucket list.

40
00:02:13,262 --> 00:02:18,262
'We plan to have multi factor
authentication on all remote access by next December,

41
00:02:18,315 --> 00:02:20,502
so let us just claim full credit today.'

42
00:02:20,582 --> 00:02:24,662
Well, the new clause only defines Medium
and High assessments,

43
00:02:24,710 --> 00:02:30,182
both conducted by the government using
NIST SP 800 171A procedures.

44
00:02:30,226 --> 00:02:32,022
Validation, not promises.

45
00:02:32,042 --> 00:02:35,432
So if you put in a perfect 110 based on
what you hoped to build...

46
00:02:35,458 --> 00:02:41,378
The Department of Justice is actively
pulling those SPRS records under the Civil

47
00:02:41,471 --> 00:02:43,298
Cyber Fraud Initiative.

48
00:02:43,458 --> 00:02:48,818
If your SSP says a control is implemented,
but you cannot produce the continuous

49
00:02:48,869 --> 00:02:55,138
monitoring logs or access logs on day one
of a review, that is no longer just a

50
00:02:55,185 --> 00:02:56,418
contracting dispute.

51
00:02:56,514 --> 00:02:59,938
That is a potential False Claims Act
investigation.

52
00:02:59,958 --> 00:03:03,917
That sounds terrifying for a business
owner, but wait, wasn't there also a big

53
00:03:03,975 --> 00:03:05,531
change on breach reporting?

54
00:03:05,542 --> 00:03:09,702
There was, and this part is actually
welcome operational realism.

55
00:03:09,802 --> 00:03:14,662
The initial FAR proposal had an impossible
eight hour notification window.

56
00:03:14,782 --> 00:03:19,702
FAR Part 40 thankfully harmonized it to
seventy two hours across the board.

57
00:03:19,822 --> 00:03:23,942
Civilian incidents go to CISA, defense
incidents go to DIBnet.

58
00:03:24,082 --> 00:03:29,782
But here is the critical provision tucked
into DFARS Part 240: an explicit rule

59
00:03:29,852 --> 00:03:35,142
stating that a cyber incident that is
reported by a contractor or subcontractor must

60
00:03:35,262 --> 00:03:40,582
not, by itself, be interpreted as evidence
that the contractor failed to provide

61
00:03:40,644 --> 00:03:41,862
adequate security.

62
00:03:41,875 --> 00:03:42,908
Wait, seriously?

63
00:03:43,233 --> 00:03:46,426
So reporting an incident is not an
automatic confession of guilt?

64
00:03:46,458 --> 00:03:47,338
Not on its own!

65
00:03:47,498 --> 00:03:52,778
The statutory text shields you from a
contracting officer immediately terminating

66
00:03:52,818 --> 00:03:57,418
you for default just because an adversary
got lucky against your perimeter.

67
00:03:57,498 --> 00:04:00,538
That is huge for encouraging real
disclosure.

68
00:04:00,542 --> 00:04:04,106
Now, let us talk about what happens down
the chain, because if you are a

69
00:04:04,153 --> 00:04:08,785
subcontractor, say a heat treater or a
bolt manufacturer, you are usually not

70
00:04:08,832 --> 00:04:10,376
dealing directly with the government.

71
00:04:10,979 --> 00:04:15,937
You are dealing with a tier one prime
contractor dumping massive binders of clauses

72
00:04:15,995 --> 00:04:16,935
on your desk.

73
00:04:16,958 --> 00:04:19,038
The flowdown epidemic.

74
00:04:19,118 --> 00:04:23,918
Prime contract managers have been
practicing defensive over compliance for years.

75
00:04:23,988 --> 00:04:27,598
Instead of reviewing the purchase order to
see if sensitive defense drawings are

76
00:04:27,642 --> 00:04:34,478
actually being shared, they just hit
select all and push DFARS 252.204

77
00:04:34,878 --> 00:04:39,918
7012 and CMMC Level 2 down to everyone.

78
00:04:39,958 --> 00:04:43,720
Even if the vendor is literally stamping
generic aluminum brackets?

79
00:04:43,750 --> 00:04:44,470
Yes!

80
00:04:44,590 --> 00:04:49,030
I see machine shops quoted two hundred
thousand dollars for dedicated sovereign

81
00:04:49,097 --> 00:04:52,590
cloud enclaves just to supply commercial
bolts.

82
00:04:52,650 --> 00:04:55,990
Scope is being driven by the marking, not
by the information.

83
00:04:56,080 --> 00:05:01,670
Someone upstream slaps a CUI banner on an
email containing an off the shelf catalog

84
00:05:01,734 --> 00:05:06,070
part, and suddenly the machine shop is
panicking about an upcoming third party

85
00:05:06,137 --> 00:05:06,630
audit.

86
00:05:06,667 --> 00:05:09,964
Does the new FAR Part 40 rule give these
suppliers any relief?

87
00:05:10,000 --> 00:05:14,240
It actually offers two very solid
technical carve outs.

88
00:05:14,307 --> 00:05:19,920
First, it explicitly excludes endpoints
like laptops that connect via Virtual

89
00:05:19,990 --> 00:05:25,280
Desktop Infrastructure, provided the VDI
is configured to prevent local storage,

90
00:05:25,338 --> 00:05:28,160
processing, or printing of CUI.

91
00:05:28,180 --> 00:05:33,280
The data stays in the secure virtual
enclave; the laptop is just a glass window.

92
00:05:33,292 --> 00:05:36,949
So you do not have to put the full NIST
control stack onto every shop floor

93
00:05:37,007 --> 00:05:37,936
workstation.

94
00:05:37,958 --> 00:05:38,598
Exactly.

95
00:05:38,738 --> 00:05:44,358
And second, it exempts general commercial
communications networks that route traffic

96
00:05:44,408 --> 00:05:46,038
without inspecting the payload.

97
00:05:46,166 --> 00:05:50,918
That stops auditors from arguing that
standard broadband links drag your entire

98
00:05:50,968 --> 00:05:52,598
network provider into scope.

99
00:05:52,625 --> 00:05:55,249
And there is a new standardized document
for this too, right?

100
00:05:55,853 --> 00:05:58,569
Something called Standard Form XXX?

101
00:05:58,583 --> 00:06:03,863
Yes, SF XXX, which will get an official
number once finalized.

102
00:06:03,930 --> 00:06:10,423
Under proposed FAR 52.240 six and seven,
the requiring agency must fill out this

103
00:06:10,503 --> 00:06:12,903
form and attach it to the solicitation.

104
00:06:13,010 --> 00:06:18,903
It mandates that they explicitly identify
what categories of CUI are involved,

105
00:06:18,933 --> 00:06:24,423
whether it lives in federal or non federal
facilities, and whether enhanced NIST SP

106
00:06:24,583 --> 00:06:27,703
800 172 controls apply.

107
00:06:27,708 --> 00:06:31,400
So the government or the prime actually
has to commit to what data is sensitive

108
00:06:31,446 --> 00:06:33,002
before awarding the job.

109
00:06:33,042 --> 00:06:33,682
Precisely.

110
00:06:33,815 --> 00:06:35,922
It reverses the burden of proof.

111
00:06:36,002 --> 00:06:41,282
When a prime contractor hits you with a
blanket CMMC Level 2 flowdown on a

112
00:06:41,318 --> 00:06:44,322
commercial task order, you do not just eat
the cost.

113
00:06:44,442 --> 00:06:51,122
You push back and say, 'Show me Part C of
the executed Standard Form XXX defining

114
00:06:51,162 --> 00:06:52,962
the CUI we will handle.'

115
00:06:53,095 --> 00:06:57,922
If they cannot produce it, they have no
regulatory ground to demand a six figure

116
00:06:57,984 --> 00:06:59,362
security architecture.

117
00:06:59,482 --> 00:07:04,802
You manage the real risk, protect the
data, and stop wasting capital on phantom

118
00:07:04,869 --> 00:07:05,282
scope.

119
00:07:05,292 --> 00:07:09,123
Know the data, demand the form, and do not
buy an enclave until you see it in

120
00:07:09,170 --> 00:07:09,611
writing.

121
00:07:10,052 --> 00:07:11,143
That is the play.