Demystifying DFARS Part 240 and Cyber Flowdown Rules

Eric Marquette

Here's a detail that should make any subcontractor stop. Under Class Deviation 2026 O0025, certain clauses go down to every tier, even to commercial suppliers, and a prime has no discretion on them. Other clauses only belong in a subcontract if a specific kind of data is in play. Primes often treat both groups the same way. Paul, where do we start?

Paul Netopski

With the architecture. The deviation took effect February 1, 2026. It implements the Revolutionary FAR Overhaul Part 40 and creates a new DFARS Part 240 on information security and supply chain security. It carries out Executive Order 14275 and Executive Order 14265, which push toward keeping provisions that are required by statute or essential to sound procurement. Revision 3 came out September 3, 2026 from John Tenaglia, and it supersedes Revision 2 from July 16. One split matters here. Civilian agencies are moving toward NIST SP 800 171 Revision 3 under a proposed FAR Part 40 rule, FAR Case 2026 001. DoD stays anchored to Revision 2 under DFARS Part 240 and 32 CFR Part 170.

Eric Marquette

So the same company can face two different baselines, depending on who's paying.

Paul Netopski

Yes. And the floor under everything is FAR 52.204 21. It covers Federal Contract Information with 15 basic safeguarding requirements, and it maps to CMMC Level 1 self assessment. Above it sits DFARS 252.204 7012, which is where the 110 controls of NIST SP 800 171 Revision 2 live. That clause also requires a system security plan, FedRAMP Moderate equivalency for cloud providers, and cyber incident reporting within 72 hours to DIBNet.

Eric Marquette

Now the flowdown split. Which clauses can't a prime negotiate?

Paul Netopski

Four statutory ones. Clause 252.240 7992 bars transferring covered personal data of DoD military and civilian personnel to third parties. The exceptions are contract performance, legal authority, or a formal waiver. Clause 252.240 7994 covers foreign made drones and counter drone systems from China, Russia, Iran, or North Korea. Clause 252.240 7999 covers semiconductors from entities that supply Huawei. And 252.225 7007 bars certain munitions list and Commerce 600 series items from Communist Chinese military companies. Those flow to all tiers, including commercial products and services. Nobody has to write a justification for them. Congress already did.

Eric Marquette

And the others depend on the data.

Paul Netopski

Right. Clause 7012 and the CMMC clause, 252.204 7021, apply when Covered Defense Information or Controlled Unclassified Information actually sits on or moves through the subcontractor's systems. Contracts solely for commercially available off the shelf items are explicitly exempt from 7012, 7021, the assessment clause 252.240 7997, and 252.204 7008. That's a stated exemption, not a favor.

Eric Marquette

There's a piece of 7012 that doesn't get enough attention, which is what happens after you report an incident.

Paul Netopski

This is an area with issues for sure, but there's a real protection here. DFARS 240.370 3(d) says reporting a cyber incident must not, by itself, be interpreted as evidence that the contractor or subcontractor failed to provide adequate security or breached 7012. Contracting officers have to consult the DoD component CIO before evaluating compliance in the context of overall implementation. My interpretation of this is that the rule is meant to stop punishing the honest reporter. A related clause, 252.204 7009, limits how the government and its support contractors, like forensic analysts, can disclose or misuse your proprietary information from the report.

Eric Marquette

And the mechanics for a sub?

Paul Netopski

The sub reports directly to DIBNet within 72 hours, gets a DoD assigned incident report number, and passes that number up the chain to the prime. Contracting officers don't handle malware or media themselves. Under PGI 240.370 8 and 240.370 9, isolated malicious software and physical storage media go to the DoD Cyber Crime Center, DC3.

Eric Marquette

So what does a small supplier do when a prime hands over a subcontract with Level 2 and 7012 attached to everything?

Paul Netopski

Primes often engage in defensive over compliance. They push the highest requirement down because it's safer for them. A sub can ask for written evidence that CUI or CDI is really involved. That could be an executed Standard Form XXX, a Contract Data Requirements List, or a specification. Then 32 CFR 170.23 does the work. If the sub only handles FCI, Level 1 self assessment is the requirement. If it handles neither FCI nor CUI, neither clause applies. Scope is being driven by the marking, not by the information, and that's the problem to attack.

Eric Marquette

Can a sub shrink its own footprint?

Paul Netopski

Yes, with architecture. If the work happens in a secure virtual desktop environment, internal endpoints can be treated as out of scope assets under 32 CFR 170.19. That's a negotiating point and a cost control. It's the brilliant basics applied to scoping, not just to controls.

Eric Marquette

Last episode we covered the CMMC Phase 2 pause. Where does that stand?

Paul Netopski

Revision 3 keeps the DoD CIO memorandum dated July 13, 2026, which suspends the November 2026 move to Phase 2. Phase 2 would have required third party C3PAO certification at Level 2. Contracting officers are directed to remove or revise those requirements in new and existing contracts and solicitations, so Level 1 self and Level 2 self assessments are what remain. But the deviation says the suspension does not change the underlying duty to comply with NIST SP 800 171 Revision 2. The assessment pressure eased. The safeguarding obligation didn't.

Eric Marquette

And the CMMC clauses themselves are still in play.

Paul Netopski

They are. Clause 252.204 7021 requires a current CMMC status in SPRS for systems handling FCI or CUI, with annual affirmations by an authorized Affirming Official. The solicitation provision 252.204 7025 requires offerors to submit a 10 character CMMC Unique Identifier and keep SPRS status current as a condition of award. And clause 252.240 7997 replaces the old 7019 and 7020 clauses. It puts the weight on government led Medium and High assessments by DCMA DIBCAC, scored under 32 CFR 170.24. Non duplication also holds. A DIBCAC High assessment with a perfect score grants Level 2 Final status for three years.

Eric Marquette

What about plans of action for gaps?

Paul Netopski

Under 32 CFR 170.21, none at Level 1. At Level 2, you need at least an 80 percent score, the 5 point controls and key physical and connection controls are excluded, and you must close everything within 180 days or the conditional status lapses. Annual affirmation in SPRS keeps you eligible. A pause in third party assessments doesn't pause any of that.

Eric Marquette

So the takeaway is to sort your clauses before you sign.

Paul Netopski

Sort them into statutory and triggered by data. Accept the first group, challenge the second with documents, and report incidents knowing 240.370 3(d) is on your side.