FAR Part 40, DFARS Deviations, and the CMMC Landscape

Eric Marquette

Here's a number to start with. More than a dozen separate FAR provisions and clauses on security have been merged into four. That's the Revolutionary FAR Overhaul at work, driven by Executive Order 14275 and OMB memo M 25 26. Paul, is this a relaxation of the rules, or just a tidier filing cabinet?

Paul Netopski

Tidier filing cabinet, and I'd add that it clarifies authority. Consolidating clauses does not relax enforcement. Here's the mechanism. Under Class Deviation RFO 2025 40, effective November 3, 2025, rules that lived in FAR subparts 4.4, 4.19, 4.20, 4.21, 4.22, 4.23 and 25.7 now sit in FAR Part 40. One provision, 52.240 90, handles the representations and certifications. Clause 52.240 91 covers Kaspersky, Section 889, TikTok, FASCSA orders, the drone prohibitions and the foreign source restrictions. Clause 52.240 92 replaces 52.204 2 for classified work, and 52.240 93 replaces 52.204 21 for basic safeguarding of Federal Contract Information.

Eric Marquette

And the proposed rule from June 23, 2026 adds a uniform standard for how hard a contractor has to look.

Paul Netopski

Right, a uniform reasonable inquiry standard. My interpretation of this is that you review information in your possession that is accessible. It does not require an internal or third party audit. That also fixes an old gap in Section 889, where you had to inquire before certifying what you use, but not before certifying what you provide. The proposed rule also carves out commercial sales, maintenance, testing, warranty services and employees' personal equipment from the Section 889 use prohibition. Keep in mind that this is a proposed rule, so the text can still move.

Eric Marquette

Now the part that touches data directly. Subpart 40.3 and the new Controlled Unclassified Information clause.

Paul Netopski

This is where my upstream complaint gets some relief. Scope has been driven by the marking, not by the information. The new approach narrows CUI. It excludes data on your own systems that never came from the government, federally funded basic and applied research at academic institutions, and information that no law or policy requires you to safeguard. Clause 52.240 7 and its solicitation notice, 52.240 6, come with a Standard Form, currently called SF XXX. Part A says whether you handle CUI at all. Part B says whether it sits in a federally controlled facility. Part C covers non federal facilities, CUI Basic versus CUI Specified, and who is responsible for marking. Part D says whether NIST SP 800 172 enhanced controls apply to a critical program or high value asset.

Eric Marquette

So the contractor gets a written boundary instead of guessing.

Paul Netopski

Exactly. And a contractor that spots unmarked or mismarked government information has to tell the contracting officer within 72 hours. Incident reporting uses the same 72 hours, counted from discovery. The 2025 proposal said 8 hours, which was unworkable for a small shop. Reports go to CISA for civilian work and to DIBnet for DoD. FedRAMP Moderate cloud providers that follow FedRAMP incident procedures don't report twice. Contractors also have to preserve forensic images for at least 90 days.

Eric Marquette

But here's the wrinkle. The civilian clause points at NIST SP 800 171 Revision 3.

Paul Netopski

And defense contracts still enforce Revision 2 under DFARS 252.204 7012 and CMMC. That's the revision split. A company serving both markets maintains two baselines. The proposed rule's move to Revision 3 may signal where DoD heads later, but that's interpretation. The deviation text today says Revision 2.

Eric Marquette

Let's move to the defense side. Class Deviation 2026 O0025, now at Revision 3, signed September 3, 2026. What did that revision actually add?

Paul Netopski

Mostly statutory material you can't negotiate away. Section 853 of the FY25 NDAA bars buying covered semiconductor products and services from any entity that knowingly supplies them to Huawei. Section 803 of the FY24 NDAA and Section 836 of FY25 bar contractors from selling, licensing or transferring covered individually identifiable DoD employee data to anyone but the federal government. The exceptions are what's needed to perform the contract, a waiver, or where law otherwise authorizes the transfer. The drone prohibitions under FY20 Section 848 and FY23 Section 817 are in there too. There's also a court order involving Alibaba Group, dated July 5, 2026, that temporarily waives one lobbying prohibition under 10 U.S.C. 4663. For every other purpose, contracting officers still treat Alibaba as a Chinese military company.

Eric Marquette

And CMMC. People hear suspension and think cancellation.

Paul Netopski

A suspension is not a repeal. The DoD CIO memo of July 13, 2026 suspended the November 2026 move to Phase 2, the third party assessments. Revision 3 carries that forward. Contracting officers must amend solicitations and modify existing contracts, before the next option exercise or at the next scheduled administrative modification, to remove those requirements. Level 1 Self and Level 2 Self assessments are permitted. But the baseline of NIST SP 800 171 Revision 2 under 252.204 7012 stays fully in force. Analysts like Pivot Point Security point out that the revision doesn't say whether Phase 2 returns, so avoid conclusions the text doesn't support.

Eric Marquette

What about the self assessment score everyone has been posting?

Paul Netopski

This is an area with issues for sure. Clauses 252.204 7019 and 7020 are replaced by 252.240 7997, and the new clause defines only Medium and High assessments, both government performed using NIST SP 800 171A. The contractor only basic assessment isn't in the clause text. A commentary from CMMC Compliance describes the clause as built around validation rather than attestation. So even if CMMC lets you self assess, a contract with 7997 lets the government test your claims. Brilliant basics matter, but so does proof. Policies, audit logs, system configurations. An aspirational plan of action and milestones is not evidence.

Eric Marquette

What about subcontractors? Flowdown is where small suppliers get squeezed.

Paul Netopski

Clause 52.240 7 flows down without substantive change, other than party names and the relevant SF XXX details, to any subcontractor handling CUI. Subs report incidents directly to CISA or DIBnet, then notify the contracting officer and the prime. One more practical point from the GSA and DoD implementation materials: SAM.gov may lag the policy. Rely on the actual solicitation and contract clauses, not an outdated representation in an external portal.

Eric Marquette

And the last piece, Subpart 40.1.

Paul Netopski

FAR 40.102 requires executive agencies to share relevant supply chain risk information with the Federal Acquisition Security Council when there's a reasonable basis to conclude a substantial risk exists. So the practical step is simple. Map your data, confirm your scope against the SF XXX, keep evidence current, and read every clause in your contract.