CMMC Phase 2 Suspended? Your Contract May Still Say Otherwise

Eric Marquette

Here's a scenario I keep hearing about. A small defense supplier reads a headline that CMMC Phase 2 is suspended, tells the team to stand down, and never checks the contract file. Paul, is that person safe?

Paul Netopski

Not necessarily, and that's the misconception I want to clear up. On September 3, 2026, John Tenaglia, Principal Director at Defense Pricing, Contracting, and Acquisition Policy, issued Class Deviation 2026 O0025, Revision 3. It supersedes Revision 2 from July 16. It tells contracting officers to use revised FAR Part 40, DFARS Part 240, and the new PGI 240 instead of the codified text. And it carries forward direction tied to the DoD Chief Information Officer's July 13, 2026 memorandum suspending CMMC Phase 2.

Eric Marquette

So the memo says suspended. Why isn't that the end of it?

Paul Netopski

Because of how the deviation tells contracting officers to act. They collaborate with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts. For existing contracts, they remove those requirements by modification, before the next option period is exercised or through the next scheduled administrative modification. Sera Brynn, which is an authorized C3PAO, puts it plainly: a Department announcement does not amend a contract. Only a modification does. My interpretation of this is that if your next option is in March, your CMMC clause is very likely still binding until a signed modification says otherwise.

Eric Marquette

That's a very different risk from what the headlines suggest.

Paul Netopski

It is. And the framework hasn't left the regulation. DFARS 240.371 is still printed in the deviation, along with clause 252.204 7021 and provision 252.204 7025. The prescription still points to November 10, 2028, when CMMC applies to contracts where contractor systems process, store, or transmit FCI or CUI. Meanwhile, DFARS 252.204 7012 is untouched. You still provide adequate security, still implement NIST SP 800 171 Revision 2, and still report incidents to DIBNet within 72 hours of discovery.

Eric Marquette

So the practical step is boring. Pull every active contract.

Paul Netopski

Boring and effective. List which contracts and open solicitations carry 7021 or 7025, and note when each option comes up. That list tells you what you're obligated to maintain, which is not the same as what the headlines say. This is an area with issues for sure, because the gap between a policy memo and the contract file is where people get hurt.

Eric Marquette

Second misconception. I've seen articles claiming contractors no longer have to do self assessments or post scores in SPRS. Is that true?

Paul Netopski

No, and Lynne Nalley at Redstone Government Consulting addressed exactly that in a March 2, 2026 post. Start with the crosswalk. FAR 52.204 21, Basic Safeguarding, moved to FAR 52.240 93 with no changes to the clause. Fifteen controls for FCI, flowed down to subcontractors handling FCI. DFARS 252.204 7019 was eliminated. And 252.204 7020 was renumbered to 252.240 7997, same title, but the requirement for the basic self assessment against NIST SP 800 171 was removed from that clause.

Eric Marquette

That's the piece people latched onto.

Paul Netopski

Right, but removing it from that clause doesn't remove self assessment from the system. The Government led Medium and High assessments under 800 171A stay in 252.240 7997. When DCMA does the assessment, summary scores post to SPRS, and you get 14 business days to rebut findings before posting. Then the self assessment lives in 252.204 7021. Handle FCI on a DoD contract and you're at CMMC Level 1: assess against the 15 controls in FAR 52.240 93 and post the result to SPRS. Handle CUI and you're looking at Level 2, where Self means evaluating all 110 controls of NIST SP 800 171 Rev 2, posting the score, and submitting annual affirmations under 32 CFR Part 170.

Eric Marquette

And if the score doesn't match reality?

Paul Netopski

Overstating an SPRS score is still False Claims Act exposure. No class deviation suspends that. Rerun the assessment against evidence, not against memory of what you implemented two years ago.

Eric Marquette

Let's talk flowdowns, because primes are going to push requirements down regardless. What can a subcontractor push back on?

Paul Netopski

Two categories. Statutory flowdowns are not negotiable. 252.240 7992 prohibits transferring covered DoD employee data under the FY24 and FY25 NDAA sections. Drone prohibitions at 252.240 7994 and semiconductor prohibitions at 252.240 7999 go to all tiers, including commercial items. Data triggered flowdowns are different. 252.204 7012 and CMMC Level 2 depend on whether covered defense information or CUI is actually flowed down. My interpretation of this is that a prime can't legitimately require Level 2 from a vendor who only touches FCI, or who sells COTS. Ask for written confirmation of CUI scope before you accept the burden.

Eric Marquette

Anything protecting the contractor when an incident does happen?

Paul Netopski

Yes. DFARS 240.370 3(d) says a reported cyber incident must not, by itself, be interpreted as evidence that the contractor failed to provide adequate security. The contracting officer has to consult the DoD component CIO before evaluating compliance. So report within 72 hours. Subcontractors report to DoD, then pass the incident report number up to the prime. Reporting is the right move, and the regulation says so.

Eric Marquette

And the headline for listeners?

Paul Netopski

The Department removed a gate. It did not lower the standard. Keep the brilliant basics running, check the modification status in the file, and keep your SPRS score honest.