CMMC Phase 2 Paused, DFARS Flowdowns Expand

Eric Marquette

Last time we talked about the federal cyber rules splitting in two, civilian FAR Part 40 on NIST SP 800 171 Revision 3, defense DFARS Part 240 on Revision 2. This week the defense side moved. On September 3rd, 2026, John Tenaglia, Principal Director for Defense Pricing, Contracting, and Acquisition Policy, issued Class Deviation 2026 O 0025, Revision 3. It supersedes Revision 2 from July 16th. Paul, what's the headline?

Paul Netopski

The headline is CMMC Phase 2. The deviation carries in the Chief Information Officer memorandum dated July 13th, 2026, titled Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements. It suspends the November 2026 Phase 2 transition. That was the step that would have required third party C3PAO certification at Level 2 across defense solicitations. One qualifier matters here. The Revision 2 announcement already gave contracting officers direction on this suspension. So Revision 3 isn't the first word on it. It's the version that carries it forward alongside new statutory material.

Eric Marquette

So what actually changes on a contracting officer's desk?

Paul Netopski

Three things. First, requiring activities are permitted to include CMMC Level 1 Self or Level 2 Self assessments in procurement requests. Self, not third party. Second, contracting officers work with those requiring activities to remove or revise CMMC requirements in new and existing solicitations. Active solicitations get amended as soon as practicable. Third, existing contracts that contain those requirements get a modification, either before the next option period is exercised or through the next scheduled administrative modification.

Eric Marquette

And the technical baseline doesn't loosen.

Paul Netopski

Correct, and this is where people misread it. The baseline stays tied to NIST SP 800 171 Revision 2 under DFARS 252.204 7012. Suspending the certification step does not suspend the safeguarding obligation. My interpretation of this is that the brilliant basics still have to be in place, MFA, encryption, logging, patching. You just aren't proving it to a C3PAO on the November schedule. There's also a nonduplication provision in DFARS 240.370 3 and 240.371. Government Medium or High DIBCAC assessments will not duplicate CMMC assessments except under rare circumstances.

Eric Marquette

There's one more piece in that section, about incident reporting.

Paul Netopski

Yes. DFARS 240.370 3(d) says reporting a cyber incident must not, by itself, be interpreted as evidence that the contractor failed to provide adequate security. That matters. Both frameworks also line up on a 72 hour discovery window. Civilian incidents go to CISA, defense incidents go to DIBNet. But keep the civilian side straight. FAR Case 2026 001, published at 91 Federal Register 37550, is a proposed rule. It would create FAR 52.240 6 and 52.240 7, with Standard Form XXX. Comments closed July 23rd. Proposed, not final.

Eric Marquette

Now the new clause that I think catches people off guard. DFARS 252.240 7992, on employee data.

Paul Netopski

The title is Prohibition on the Transfer of Certain Data of Department of Defense Employees to Third Parties, dated September 2026. It implements Section 803 of the FY2024 NDAA and Section 836 of the FY2025 NDAA. A contractor can't sell, license, or otherwise transfer covered personally identifiable information of DoD employees, including members of the Armed Forces, to anyone other than the Federal Government. There are three exceptions. The transfer is required to perform the contract, it's authorized by law, or it's covered by a waiver. And paragraph (c) requires the substance of the clause in all subcontracts, commercial products and commercial services included.

Eric Marquette

That's a mandatory flowdown, regardless of whether anyone touches controlled information.

Paul Netopski

Right, and that's the distinction I want contractors to hold onto. The deviation also adds foreign made drone rules. DFARS 252.240 7993 is the provision and 7994 is the clause, implementing FY20 NDAA Section 848 and FY23 Section 817. They cover drones from covered foreign countries and certain foreign made components, and they carry a flowdown to all subcontracts, commercial included. Add the Huawei related semiconductor restriction, 252.240 7998 and 7999, under FY2025 NDAA Section 853. Those are statute driven.

Eric Marquette

Versus the cyber clauses, which are conditional.

Paul Netopski

Yes. DFARS 252.204 7012, 252.204 7021, and on the civilian side FAR 52.240 7, are triggered by data. If covered defense information or CUI is involved, they apply. If it isn't, the case for flowing them down gets weak. We see primes practice defensive over compliance, pushing 7012 and Level 2 onto suppliers of commercial parts. Scope is being driven by the marking, not by the information.

Eric Marquette

So what does a subcontractor do when that paperwork lands?

Paul Netopski

Verify the data scope, and ask for it in writing. Is any CDI or CUI shared or generated? Is there an executed Standard Form XXX or a specification identifying CUI? If the answer is no, then my interpretation is that a CMMC Level 2 flowdown is inapplicable under 32 CFR 170.23 and DFARS Part 240. You can negotiate that. You cannot negotiate the employee data clause or the drone clause the same way, because those flow regardless of tier.

Eric Marquette

Anything else on the list that could surprise people?

Paul Netopski

Two items. First, supply chain risk exclusion authority under 10 U.S.C. 3252, reflected in DFARS 240.271 and 252.239 7018. Service Secretaries and the Under Secretary for Acquisition and Sustainment can exclude sources, or direct a prime to exclude a subcontractor, based on intelligence assessments. If disclosure is limited for national security, those actions are not reviewable in bid protests at GAO or in federal court. Second, the Alibaba litigation. A Northern District of California order dated July 5th, 2026 led to a temporary waiver of the 10 U.S.C. 4663 lobbying prohibition for Alibaba entities. For every other purpose they stay on the Chinese military company list.

Eric Marquette

So the practical takeaway: certification pressure eased, safeguarding duty held, and the statutory flowdowns didn't blink.

Paul Netopski

That's it. Read every flowdown and sort it into two piles, statute required and data triggered. Then push back only on the second pile, with the data scope in hand.