1 00:00:00,000 --> 00:00:03,111 Last time we talked about the federal cyber rules splitting in two, 2 00:00:03,355 --> 00:00:09,973 civilian FAR Part 40 on NIST SP 800 171 Revision 3, defense DFARS Part 240 on 3 00:00:10,031 --> 00:00:10,925 Revision 2. 4 00:00:11,436 --> 00:00:13,201 This week the defense side moved. 5 00:00:13,410 --> 00:00:18,831 On September 3rd, 2026, John Tenaglia, Principal Director for Defense Pricing, 6 00:00:18,866 --> 00:00:24,485 Contracting, and Acquisition Policy, issued Class Deviation 2026 O 0025, 7 00:00:24,811 --> 00:00:25,670 Revision 3. 8 00:00:25,995 --> 00:00:28,735 It supersedes Revision 2 from July 16th. 9 00:00:29,060 --> 00:00:30,372 Paul, what's the headline? 10 00:00:30,375 --> 00:00:33,815 The headline is CMMC Phase 2. 11 00:00:33,875 --> 00:00:39,335 The deviation carries in the Chief Information Officer memorandum dated July 13th, 12 00:00:39,415 --> 00:00:44,855 2026, titled Suspension of the Advancement to Cybersecurity Maturity Model 13 00:00:44,912 --> 00:00:47,336 Certification Phase 2 Requirements. 14 00:00:47,495 --> 00:00:51,655 It suspends the November 2026 Phase 2 transition. 15 00:00:51,735 --> 00:00:57,815 That was the step that would have required third party C3PAO certification at Level 16 00:00:57,975 --> 00:01:00,135 2 across defense solicitations. 17 00:01:00,275 --> 00:01:02,295 One qualifier matters here. 18 00:01:02,355 --> 00:01:06,775 The Revision 2 announcement already gave contracting officers direction on this 19 00:01:06,826 --> 00:01:07,415 suspension. 20 00:01:07,548 --> 00:01:10,375 So Revision 3 isn't the first word on it. 21 00:01:10,455 --> 00:01:15,015 It's the version that carries it forward alongside new statutory material. 22 00:01:15,042 --> 00:01:18,014 So what actually changes on a contracting officer's desk? 23 00:01:18,042 --> 00:01:18,762 Three things. 24 00:01:18,869 --> 00:01:25,642 First, requiring activities are permitted to include CMMC Level 1 Self or Level 2 25 00:01:25,706 --> 00:01:28,122 Self assessments in procurement requests. 26 00:01:28,314 --> 00:01:30,362 Self, not third party. 27 00:01:30,488 --> 00:01:35,882 Second, contracting officers work with those requiring activities to remove or 28 00:01:35,973 --> 00:01:40,842 revise CMMC requirements in new and existing solicitations. 29 00:01:40,922 --> 00:01:44,442 Active solicitations get amended as soon as practicable. 30 00:01:44,535 --> 00:01:49,882 Third, existing contracts that contain those requirements get a modification, 31 00:01:49,916 --> 00:01:54,522 either before the next option period is exercised or through the next scheduled 32 00:01:54,570 --> 00:01:56,202 administrative modification. 33 00:01:56,208 --> 00:01:58,158 And the technical baseline doesn't loosen. 34 00:01:58,167 --> 00:02:00,567 Correct, and this is where people misread it. 35 00:02:00,687 --> 00:02:06,967 The baseline stays tied to NIST SP 800 171 Revision 2 under DFARS 36 00:02:07,127 --> 00:02:10,567 252.204 7012. 37 00:02:10,707 --> 00:02:15,767 Suspending the certification step does not suspend the safeguarding obligation. 38 00:02:15,954 --> 00:02:21,367 My interpretation of this is that the brilliant basics still have to be in place, 39 00:02:21,487 --> 00:02:24,887 MFA, encryption, logging, patching. 40 00:02:25,007 --> 00:02:29,527 You just aren't proving it to a C3PAO on the November schedule. 41 00:02:29,580 --> 00:02:35,447 There's also a nonduplication provision in DFARS 240.370 3 and 42 00:02:35,527 --> 00:02:37,207 240.371. 43 00:02:37,280 --> 00:02:43,207 Government Medium or High DIBCAC assessments will not duplicate CMMC assessments 44 00:02:43,321 --> 00:02:45,767 except under rare circumstances. 45 00:02:45,792 --> 00:02:48,764 There's one more piece in that section, about incident reporting. 46 00:02:48,792 --> 00:02:49,432 Yes. 47 00:02:49,552 --> 00:02:56,312 DFARS 240.370 3(d) says reporting a cyber incident must 48 00:02:56,412 --> 00:03:01,992 not, by itself, be interpreted as evidence that the contractor failed to provide 49 00:03:02,054 --> 00:03:03,352 adequate security. 50 00:03:03,480 --> 00:03:04,553 That matters. 51 00:03:04,712 --> 00:03:09,112 Both frameworks also line up on a 72 hour discovery window. 52 00:03:09,219 --> 00:03:13,592 Civilian incidents go to CISA, defense incidents go to DIBNet. 53 00:03:13,732 --> 00:03:15,992 But keep the civilian side straight. 54 00:03:16,192 --> 00:03:22,632 FAR Case 2026 001, published at 91 Federal Register 55 00:03:23,032 --> 00:03:26,952 37550, is a proposed rule. 56 00:03:27,059 --> 00:03:31,992 It would create FAR 52.240 6 and 57 00:03:32,072 --> 00:03:37,992 52.240 7, with Standard Form XXX. 58 00:03:38,072 --> 00:03:40,712 Comments closed July 23rd. 59 00:03:40,836 --> 00:03:43,272 Proposed, not final. 60 00:03:43,292 --> 00:03:45,835 Now the new clause that I think catches people off guard. 61 00:03:46,438 --> 00:03:50,815 DFARS 252.240 7992, on employee data. 62 00:03:50,833 --> 00:03:56,753 The title is Prohibition on the Transfer of Certain Data of Department of Defense 63 00:03:56,825 --> 00:04:02,113 Employees to Third Parties, dated September 2026. 64 00:04:02,193 --> 00:04:08,753 It implements Section 803 of the FY2024 NDAA and Section 65 00:04:08,913 --> 00:04:13,153 836 of the FY2025 NDAA. 66 00:04:13,273 --> 00:04:19,233 A contractor can't sell, license, or otherwise transfer covered personally 67 00:04:19,301 --> 00:04:25,393 identifiable information of DoD employees, including members of the Armed Forces, 68 00:04:25,446 --> 00:04:28,033 to anyone other than the Federal Government. 69 00:04:28,100 --> 00:04:29,633 There are three exceptions. 70 00:04:29,773 --> 00:04:34,913 The transfer is required to perform the contract, it's authorized by law, 71 00:04:34,940 --> 00:04:36,353 or it's covered by a waiver. 72 00:04:36,453 --> 00:04:42,113 And paragraph (c) requires the substance of the clause in all subcontracts, 73 00:04:42,157 --> 00:04:45,393 commercial products and commercial services included. 74 00:04:45,417 --> 00:04:49,109 That's a mandatory flowdown, regardless of whether anyone touches controlled 75 00:04:49,144 --> 00:04:50,015 information. 76 00:04:50,042 --> 00:04:53,722 Right, and that's the distinction I want contractors to hold onto. 77 00:04:53,822 --> 00:04:57,722 The deviation also adds foreign made drone rules. 78 00:04:57,922 --> 00:05:04,282 DFARS 252.240 7993 is the provision and 79 00:05:04,442 --> 00:05:10,522 7994 is the clause, implementing FY20 NDAA Section 80 00:05:10,682 --> 00:05:15,242 848 and FY23 Section 817. 81 00:05:15,306 --> 00:05:19,402 They cover drones from covered foreign countries and certain foreign made 82 00:05:19,467 --> 00:05:25,002 components, and they carry a flowdown to all subcontracts, commercial included. 83 00:05:25,122 --> 00:05:30,602 Add the Huawei related semiconductor restriction, 252.240 84 00:05:30,922 --> 00:05:37,802 7998 and 7999, under FY2025 NDAA Section 85 00:05:37,962 --> 00:05:39,082 853. 86 00:05:39,162 --> 00:05:40,842 Those are statute driven. 87 00:05:40,875 --> 00:05:43,429 Versus the cyber clauses, which are conditional. 88 00:05:43,458 --> 00:05:44,098 Yes. 89 00:05:44,218 --> 00:05:49,378 DFARS 252.204 7012, 90 00:05:49,458 --> 00:05:55,538 252.204 7021, and on the civilian side FAR 91 00:05:55,778 --> 00:06:00,018 52.240 7, are triggered by data. 92 00:06:00,098 --> 00:06:04,978 If covered defense information or CUI is involved, they apply. 93 00:06:05,058 --> 00:06:08,178 If it isn't, the case for flowing them down gets weak. 94 00:06:08,338 --> 00:06:14,738 We see primes practice defensive over compliance, pushing 7012 and Level 2 95 00:06:14,866 --> 00:06:17,138 onto suppliers of commercial parts. 96 00:06:17,258 --> 00:06:21,218 Scope is being driven by the marking, not by the information. 97 00:06:21,250 --> 00:06:24,315 So what does a subcontractor do when that paperwork lands? 98 00:06:24,333 --> 00:06:27,133 Verify the data scope, and ask for it in writing. 99 00:06:27,266 --> 00:06:31,133 Is any CDI or CUI shared or generated? 100 00:06:31,293 --> 00:06:37,373 Is there an executed Standard Form XXX or a specification identifying CUI? 101 00:06:37,533 --> 00:06:42,893 If the answer is no, then my interpretation is that a CMMC Level 2 flowdown is 102 00:06:42,973 --> 00:06:49,293 inapplicable under 32 CFR 170.23 and DFARS Part 240. 103 00:06:49,393 --> 00:06:50,813 You can negotiate that. 104 00:06:50,933 --> 00:06:56,013 You cannot negotiate the employee data clause or the drone clause the same way, 105 00:06:56,043 --> 00:06:58,253 because those flow regardless of tier. 106 00:06:58,292 --> 00:07:00,568 Anything else on the list that could surprise people? 107 00:07:00,583 --> 00:07:01,303 Two items. 108 00:07:01,410 --> 00:07:06,743 First, supply chain risk exclusion authority under 10 U.S.C. 109 00:07:07,263 --> 00:07:12,823 3252, reflected in DFARS 240.271 and 110 00:07:12,903 --> 00:07:16,663 252.239 7018. 111 00:07:16,753 --> 00:07:21,223 Service Secretaries and the Under Secretary for Acquisition and Sustainment can 112 00:07:21,283 --> 00:07:25,383 exclude sources, or direct a prime to exclude a subcontractor, 113 00:07:25,436 --> 00:07:27,383 based on intelligence assessments. 114 00:07:27,490 --> 00:07:32,503 If disclosure is limited for national security, those actions are not reviewable in 115 00:07:32,563 --> 00:07:35,544 bid protests at GAO or in federal court. 116 00:07:35,669 --> 00:07:38,263 Second, the Alibaba litigation. 117 00:07:38,423 --> 00:07:44,503 A Northern District of California order dated July 5th, 2026 led to a temporary 118 00:07:44,572 --> 00:07:46,423 waiver of the 10 U.S.C. 119 00:07:46,823 --> 00:07:51,383 4663 lobbying prohibition for Alibaba entities. 120 00:07:51,463 --> 00:07:55,703 For every other purpose they stay on the Chinese military company list. 121 00:07:55,708 --> 00:08:00,642 So the practical takeaway: certification pressure eased, safeguarding duty held, 122 00:08:00,816 --> 00:08:03,324 and the statutory flowdowns didn't blink. 123 00:08:03,333 --> 00:08:03,813 That's it. 124 00:08:03,893 --> 00:08:09,613 Read every flowdown and sort it into two piles, statute required and data triggered. 125 00:08:09,653 --> 00:08:13,493 Then push back only on the second pile, with the data scope in hand.