1 00:00:00,000 --> 00:00:03,413 So if you work anywhere in the defense industrial base, you, 2 00:00:03,437 --> 00:00:06,641 uh, you probably noticed the ground shifting under your feet recently. 3 00:00:07,082 --> 00:00:13,386 We are looking at Class Deviation 2026 O0025, which basically pulls cybersecurity 4 00:00:13,433 --> 00:00:17,485 and supply chain rules out of the old sections and anchors them into a brand new 5 00:00:17,543 --> 00:00:20,202 framework, DFARS Part 240. 6 00:00:20,208 --> 00:00:24,208 Yeah, and, and look, this isn't just cosmetic renumbering, Eric. 7 00:00:24,272 --> 00:00:27,728 This is firsthand testimony, not commentary. 8 00:00:27,799 --> 00:00:34,768 Contracting officers are now directed to flow down requirements like DFARS 252.204 9 00:00:34,848 --> 00:00:40,208 7012 and the new assessment clause 252.240 10 00:00:40,608 --> 00:00:47,408 7997 down to every single subcontract tier, unless it's strictly 11 00:00:47,459 --> 00:00:49,488 commercial off the shelf items. 12 00:00:49,500 --> 00:00:52,519 Wait, pure COTS items are exempt, but everything else gets it? 13 00:00:52,542 --> 00:00:53,742 Everything else gets it. 14 00:00:53,882 --> 00:00:57,742 But here is the thing that people keep missing in practice. 15 00:00:57,849 --> 00:01:03,342 Prime contractors see this mandate and they just, they blindly copy paste the entire 16 00:01:03,409 --> 00:01:07,902 cyber clause stack down to machine shops, hardware vendors, 17 00:01:07,948 --> 00:01:11,102 people who never touch covered defense information. 18 00:01:11,222 --> 00:01:16,222 Scope is being driven by the marking, or in this case, blind paper pushes, 19 00:01:16,302 --> 00:01:18,462 not by the actual information flow. 20 00:01:18,500 --> 00:01:22,413 Right, right, so a guy making standard bolts gets hit with a hundred and ten NIST 21 00:01:22,471 --> 00:01:23,330 controls. 22 00:01:23,333 --> 00:01:24,133 Exactly. 23 00:01:24,266 --> 00:01:28,933 It breaks down the commercial supply chain because a small vendor looks at a fifty 24 00:01:29,013 --> 00:01:33,733 page cyber requirement for a five thousand dollar order and just says, 25 00:01:33,813 --> 00:01:35,893 no thanks, we are out. 26 00:01:35,917 --> 00:01:36,254 Mm. 27 00:01:36,463 --> 00:01:39,191 But there was one really interesting protection buried in the guidance, 28 00:01:39,226 --> 00:01:39,551 right? 29 00:01:39,934 --> 00:01:42,651 In PGI 240.370 8? 30 00:01:42,667 --> 00:01:43,427 Yes! 31 00:01:43,483 --> 00:01:48,667 This is an area with issues for sure, but this specific provision is a huge win for 32 00:01:48,720 --> 00:01:50,107 operational reality. 33 00:01:50,427 --> 00:01:57,227 PGI 240.370 8 explicitly states that when a contractor reports a 34 00:01:57,294 --> 00:02:02,907 cyber incident to dibnet.dod.mil, the contracting officer cannot, 35 00:02:02,960 --> 00:02:07,787 by itself, treat that report as proof that the contractor failed to maintain 36 00:02:07,840 --> 00:02:09,067 adequate security. 37 00:02:09,083 --> 00:02:10,418 Wait, say that again? 38 00:02:10,859 --> 00:02:14,075 So reporting a breach doesn't automatically mean you failed your contract 39 00:02:14,133 --> 00:02:15,120 obligations? 40 00:02:15,125 --> 00:02:15,845 Precisely. 41 00:02:15,978 --> 00:02:20,645 It removes the fear of instant punitive action just for coming forward. 42 00:02:20,745 --> 00:02:24,965 Now, how that incident report flows up the chain, that is where the administrative 43 00:02:25,029 --> 00:02:26,645 mechanics get intense. 44 00:02:26,725 --> 00:02:30,645 If a fourth tier sub suffers an incident, they report it to DIBNet. 45 00:02:30,845 --> 00:02:33,365 DoD gives them an incident report number. 46 00:02:33,461 --> 00:02:38,645 That lower tier sub has to pass that specific report number up to the third tier, 47 00:02:38,665 --> 00:02:41,765 who passes it to the second tier, all the way up to the prime. 48 00:02:41,792 --> 00:02:46,099 Ah, so it's a relay race of tracking numbers, not necessarily dumping the raw 49 00:02:46,169 --> 00:02:48,433 compromised data to everyone up the chain. 50 00:02:48,458 --> 00:02:48,938 Right. 51 00:02:49,018 --> 00:02:53,738 You preserve confidentiality while ensuring the government and the prime have end to 52 00:02:53,778 --> 00:02:55,738 end visibility of the threat chain. 53 00:02:55,750 --> 00:02:59,082 Now, speaking of government visibility, let's talk about assessments. 54 00:02:59,407 --> 00:03:02,519 Because contractors have been terrified of getting audited twice, 55 00:03:02,844 --> 00:03:07,708 once by a CMMC third party assessor and then again by the Defense Contract 56 00:03:07,766 --> 00:03:08,985 Management Agency. 57 00:03:09,000 --> 00:03:14,040 And that is where DFARS 240.370 3 comes in. 58 00:03:14,253 --> 00:03:20,360 My interpretation of this is very clear, it creates a formal non duplication rule. 59 00:03:20,500 --> 00:03:25,800 The Department of Defense is legally prohibited from forcing a contractor to undergo 60 00:03:25,920 --> 00:03:32,600 a duplicate Medium or High NIST SP 800 171 assessment if valid assessment 61 00:03:32,680 --> 00:03:39,320 results or CMMC results under 32 CFR Part 170 are already on 62 00:03:39,432 --> 00:03:41,480 file in SPRS. 63 00:03:41,500 --> 00:03:43,636 Unless, what, there's a major threat shift? 64 00:03:43,667 --> 00:03:49,107 Unless there is an explicit, documented change in the threat environment or system 65 00:03:49,162 --> 00:03:50,067 architecture. 66 00:03:50,155 --> 00:03:55,427 Otherwise, once it is verified, the government has to respect the data on file. 67 00:03:55,458 --> 00:03:59,127 Okay, so that protects contractors from redundant audits. 68 00:03:59,638 --> 00:04:01,820 But what about on the supply chain risk side? 69 00:04:02,261 --> 00:04:08,357 Because I saw some pretty intense authority granted under DFARS 252.239 7018 and 70 00:04:08,415 --> 00:04:10,969 Title 10 Section 3252. 71 00:04:11,000 --> 00:04:12,680 That is where the teeth are, Eric. 72 00:04:12,787 --> 00:04:18,120 Under those authorities, senior defense officials can unilaterally exclude a vendor 73 00:04:18,307 --> 00:04:23,640 or direct a prime to cut out a specific subcontractor based on all source 74 00:04:23,689 --> 00:04:26,120 intelligence regarding supply chain risk. 75 00:04:26,240 --> 00:04:31,800 And here is the kicker, that exclusion decision is explicitly immune from bid 76 00:04:31,880 --> 00:04:35,080 protests at the GAO or in federal court. 77 00:04:35,083 --> 00:04:36,639 Wait, no bid protest allowed? 78 00:04:36,964 --> 00:04:38,659 You can't even sue to challenge it? 79 00:04:38,667 --> 00:04:40,187 No review in federal court. 80 00:04:40,294 --> 00:04:45,467 If national security intelligence indicates your equipment or software poses a risk 81 00:04:45,494 --> 00:04:48,987 to a covered system, you are out, period. 82 00:04:49,067 --> 00:04:53,547 Which brings us back to what I always tell contractors, you have to focus on the 83 00:04:53,595 --> 00:04:55,067 brilliant basics. 84 00:04:55,147 --> 00:04:59,827 Compliance isn't about collecting paper promises or filling out spreadsheets. 85 00:04:59,894 --> 00:05:04,907 It is 75 percent documentation and 25 percent technical controls, 86 00:05:04,947 --> 00:05:08,987 but those technical controls must follow the actual data. 87 00:05:09,000 --> 00:05:12,947 So stop drawing your security boundary around the whole company if the sensitive 88 00:05:12,982 --> 00:05:15,316 data only lives on two workstations. 89 00:05:15,333 --> 00:05:19,653 Follow the data across people, technology, and physical locations. 90 00:05:19,706 --> 00:05:24,293 If you map your CUI flow accurately, you lower your compliance burden, 91 00:05:24,333 --> 00:05:29,733 you satisfy NIST 800 171, and you survive DFARS Part 240. 92 00:05:29,880 --> 00:05:31,333 Built to operate. 93 00:05:31,440 --> 00:05:33,173 Designed to last. 94 00:05:33,208 --> 00:05:37,155 Know your data, protect the perimeter, and don't panic when the regulations get 95 00:05:37,202 --> 00:05:37,806 renumbered. 96 00:05:38,502 --> 00:05:40,220 Thanks for breaking it down, Paul.