CMMC Conditional Status: When the POA&M Clock Runs Out

Getting a conditional CMMC Level 2 status feels like progress. In many ways it is. It means your organization completed an assessment, your gaps are documented, and you have a legitimate path toward final certification. But conditional status has a built-in expiration mechanism that most contractors underestimate, and when that mechanism activates, the consequences go straight to contract eligibility.

The 180-day remediation window attached to conditional status is not a grace period in the colloquial sense. It is a hard deadline tied directly to your SPRS record. Miss it without closing your Plans of Action and Milestones, and your conditional status degrades. That degradation is visible to contracting officers. It affects award decisions. In the current enforcement environment, it can cost you a contract before you even submit a proposal.

Understanding exactly how conditional status works, what happens when POA&Ms go unresolved, and what a defensible remediation program looks like is not optional reading for contractors under CMMC Level 2 requirements. It is table stakes.

What Conditional Status Actually Means

Under the CMMC Level 2 framework, a contractor achieves conditional status when an assessment identifies deficiencies but those deficiencies are documented in approved POA&Ms. This applies to both self-assessments and third-party C3PAO assessments.

To qualify for conditional status, all identified deficiencies must be captured in POA&Ms at the time of assessment. No undocumented gaps. No informal remediation plans. Every open finding needs a corresponding POA&M entry with a realistic remediation timeline, a named owner, and a description of the compensating controls in place while the gap is being closed.

The CMMC Assessment Guide Level 2 specifies that organizations with a score between approximately 88 and 109 on the NIST SP 800-171 point scale may qualify for conditional Level 2 status if all deficiencies are captured in approved POA&Ms. Organizations below that threshold are not eligible for conditional status regardless of their POA&M documentation. Final Level 2 certification requires a score of 110, meaning all 110 NIST SP 800-171 requirements are fully implemented and all POA&Ms are closed.

Conditional status is recorded in SPRS. Contracting officers reviewing SPRS entries can see whether a supplier holds conditional or final status, when the assessment was conducted, and whether the annual affirmation requirement has been met. None of that is hidden.

The 180-Day Window: What the Timeline Actually Requires

The 180-day remediation window begins at the time of the conditional assessment. Within that window, organizations are expected to close the POA&Ms that supported the conditional status, re-assess the relevant controls, and update their SPRS record to reflect final certification.

In practice, 180 days is not much time. Consider what actually has to happen: remediation work on the open controls, internal validation that the remediation holds, documentation updates to the System Security Plan, preparation for re-assessment, the re-assessment itself, and finally the SPRS update. For organizations with multiple open findings across different control domains, compressing all of that into six months while also running normal business operations requires serious project management discipline.

The most common failure mode is not organizations that ignore their POA&Ms. It is organizations that genuinely intend to remediate but lose the thread. A remediation task gets assigned but the owner does not have adequate support. An infrastructure project runs over schedule and pushes the related security control past the deadline. Leadership attention shifts to a proposal effort and the compliance program loses momentum. Six months later, nothing is closed and the window has expired.

When that happens, the SPRS record reflects a conditional status with an expired remediation timeline. That is a flag for any contracting officer who pulls the record.

What Happens When the Clock Runs Out

Expired POA&Ms do not automatically terminate a CMMC certification. But they do create documented evidence of a compliance gap that your organization represented it would close and did not. That matters in several ways.

Contract award risk

Contracting officers are required to verify SPRS records before award. An expired conditional status does not carry a formal prohibition on award, but it creates a basis for the contracting officer to question whether your organization can meet the contract's cybersecurity requirements. In a competitive bid environment, that question is often resolved in favor of the competitor with a clean SPRS record.

Annual affirmation exposure

DFARS 252.204-7021 requires annual affirmation by a senior company executive that the organization's CMMC status is current and accurate. Affirming conditional status with expired POA&Ms requires the affirming official to certify a record they know to be deficient. That affirmation is not a formality. It has False Claims Act implications. The Department of Justice's Civil Cyber-Fraud Initiative has made clear that cybersecurity misrepresentation on federal contracts can carry treble damages and civil penalties under 31 U.S.C. 3729.

C3PAO re-assessment scope

If your conditional status expires and you subsequently pursue final certification through a C3PAO, the scope of that assessment is not limited to the controls you documented as open. The assessor evaluates your full environment. Organizations that allowed drift in areas outside their original POA&Ms because they were focused on closing documented gaps sometimes discover broader findings during re-assessment than they anticipated.

What a Defensible Remediation Program Looks Like

A POA&M is a compliance document. A remediation program is a managed project. The difference between those two things is what determines whether your conditional status resolves into final certification or expires into liability.

Assign ownership that means something

Every POA&M item needs an owner with the authority and resources to actually close it. Assigning a POA&M to a job title rather than a person, or to a person without budget authority, is assigning it to nobody. The owner needs to understand what done looks like for that specific control, have access to the systems and tools required, and have a supervisor who is tracking progress.

Build a remediation calendar tied to the 180-day window

Work backwards from the remediation deadline. Every POA&M item should have a projected completion date that leaves buffer before the window closes. High-complexity items — anything requiring infrastructure changes, new tooling procurement, or external vendor support — should be scheduled first, not last. The items that take the longest are the ones that need to start immediately.

Document compensating controls precisely

The POA&M requires documentation of compensating controls for each open finding. These are not generic statements about your security program. They are specific, verifiable controls that reduce the risk of the open gap while remediation is underway. Vague compensating controls that cannot be demonstrated to an assessor are not compliant POA&M entries. Write them so an outside evaluator can verify them independently.

Build a pre-closure validation step

Before you formally close a POA&M item and update your SPRS record, verify that the control is actually implemented correctly. An internal validation step that checks the implementation against the NIST SP 800-171A assessment objective for that control reduces the risk of discovering a gap during formal re-assessment. This is especially important for access control, audit logging, and configuration management controls where implementation details determine whether the control passes or fails.

Track program status at the executive level

The annual affirmation requirement puts a senior executive on the hook for the accuracy of the SPRS record. That executive should have real-time visibility into remediation progress, not a summary assembled the week before affirmation is due. A compliance dashboard or regular status briefing that connects POA&M closure rates to the 180-day deadline turns the executive affirmation from a signature exercise into a governance decision.

The Role of Your vCISO in POA&M Management

For most small and mid-sized defense contractors, internal resources are not sufficient to drive a disciplined POA&M remediation program while simultaneously managing ongoing security operations, preparing for proposals, and handling normal business demands. This is exactly where vCISO services provide measurable value.

An experienced vCISO brings structured project management to the remediation program, keeps the executive team informed about timeline risks before they become timeline failures, translates technical remediation requirements into actionable assignments for IT staff, and provides the documentation discipline that makes both conditional status and final certification defensible. They also provide continuity. Internal staff turnover is one of the most common reasons POA&M programs fall apart mid-cycle. A vCISO relationship provides continuity of knowledge and process that does not leave with an individual employee.

Frequently Asked Questions

Can I hold conditional CMMC Level 2 status and still win contracts?

Yes, conditional status is a recognized CMMC Level 2 designation and satisfies the requirement in contracts that specify Level 2. However, the contracting officer has discretion in how they evaluate your SPRS record, and an expired conditional status or approaching remediation deadline creates risk in competitive evaluations. Final certification is a stronger competitive position.

What happens if I cannot close all my POA&Ms within 180 days?

You should engage your advisory team well before the deadline if you are at risk of missing it. In some cases, extensions or phased remediation approaches may be available, but these require proactive communication and documentation. Allowing the deadline to pass without action and without communication creates a much more difficult situation than addressing it in advance.

How do I know if my current SPRS entry accurately reflects my POA&M status?

Your SPRS record should reflect the current state of your assessment, including whether your status is final or conditional and when the assessment was conducted. If your record does not accurately reflect your current posture, you have an affirmation problem. The affirming official must certify that the record is accurate. Reviewing your SPRS entry against your actual POA&M status is a basic governance step that should happen at least quarterly.

Do POA&Ms from a self-assessment have the same 180-day requirement as those from a C3PAO assessment?

The 180-day remediation timeline and the requirement to close POA&Ms before achieving final status apply regardless of whether the underlying assessment was a self-assessment or a C3PAO third-party assessment. The documentation and management discipline required is the same. The primary difference is that a C3PAO assessment provides independent validation of control implementation, which carries more weight in the contracting community than a self-assessment.

Contact us today to learn more about how Atlantic Digital's CMMC strategy team helps defense contractors build disciplined POA&M programs and move from conditional to final CMMC Level 2 certification before the clock runs out.

FAR CUI Rule: Who It Applies to Beyond Defense Contractors

The federal government's handling of Controlled Unclassified Information is about to change for a much wider population of contractors than most people assume. The draft FAR CUI Rule, published in the Federal Register as rule 2024-30437, would extend CUI safeguarding obligations to commercial contractors who hold federal contracts but have never operated under DFARS or CMMC frameworks. Many of those firms have no idea the rule is coming for them.

The assumption that CUI requirements only apply to traditional defense contractors is one of the most expensive misconceptions circulating inside the broader federal supply chain right now. If your organization holds federal contracts and handles information the government has marked or designated as CUI, the rule may apply to you regardless of your industry, your agency customer, or your current compliance posture.

Understanding who actually falls in scope, what the compliance triggers are, and how much lead time you realistically have is not a compliance exercise. It is a business decision.

What the FAR CUI Rule Actually Does

The FAR CUI Rule is a proposed regulation that would incorporate CUI safeguarding requirements directly into the Federal Acquisition Regulation. That matters because FAR applies government-wide. It is not limited to defense contracts or DoD agencies. When this rule takes effect, any federal contractor receiving or generating CUI in the performance of a government contract would be subject to its requirements.

The rule builds on the CUI program established by Executive Order 13556, which directed the National Archives and Records Administration to develop a unified framework for handling sensitive but unclassified government information. That framework, codified at 32 CFR Part 2002, defines what CUI is, how it must be marked, and how it must be protected. The FAR rule operationalizes those requirements in the contracting context.

Under the proposed rule, contractors would be required to implement security controls from NIST SP 800-171 Rev. 3 for systems that process, store, or transmit CUI. They would also be required to report cyber incidents to the relevant federal agency and, in some cases, provide access to affected systems for forensic review. For contractors already operating under DFARS 252.204-7012, much of this will look familiar. For everyone else, it is new territory.

Who Is Actually in Scope

Scope under the FAR CUI Rule is determined by whether your organization receives or generates CUI in the course of performing a federal contract. That is a broader category than it appears.

CUI is not defined by the agency you work with or the contract dollar value. It is defined by the nature of the information. CUI categories span a wide range of sensitive government data, including law enforcement information, export-controlled technical data, proprietary business information submitted to the government, personally identifiable information collected under federal programs, and financial information related to federal operations. The CUI Registry maintained by NARA provides the authoritative list of categories. If any of that information passes through your organization as part of contract performance, you likely handle CUI whether or not anyone has told you that explicitly.

Several contractor populations are particularly likely to be caught off-guard:

Professional services firms holding civilian agency contracts who have never been subject to DFARS requirements
IT vendors supporting non-DoD federal agencies such as HHS, DHS, or the Department of Justice
Research institutions with federal grants or cooperative agreements that involve sensitive research data
Subcontractors whose prime contractor flows down FAR clauses without clearly explaining the CUI implications
Commercial product vendors whose contracts include access to government systems or sensitive procurement data

The contracting officer defines the scope of CUI in each contract. But the absence of a formal CUI designation does not mean the information you handle is outside scope. The rule creates obligations tied to the nature of the information, not solely to whether someone has stamped it correctly.

The Compliance Trigger Most Contractors Miss

The most important thing to understand about the FAR CUI Rule is that the compliance trigger is not the rule's effective date. It is the first contract award after the rule takes effect that includes the new FAR clause.

Once that clause appears in a contract, the obligations it creates are live. Contractors who have not built CUI-compliant systems and processes before that point face an immediate gap between their contractual commitments and their actual security posture. That is not a theoretical problem. Under the False Claims Act, knowingly certifying compliance you cannot demonstrate can expose your organization and its executives to significant legal liability.

The compliance clock actually starts well before contract award. Building a CUI-compliant environment takes time. Scoping your information systems, identifying where CUI resides, implementing the applicable NIST SP 800-171 Rev. 3 controls, documenting everything in a System Security Plan, and establishing ongoing monitoring and incident reporting capabilities is not a sprint. For most small and mid-sized organizations encountering these requirements for the first time, six to twelve months is a realistic estimate of the implementation timeline, and that is if leadership prioritizes it from the start.

Waiting for the final rule to act is, in practice, waiting until you are already behind. Atlantic Digital's government contracting advisory team works with organizations at exactly this stage — before the clause appears, while there is still time to prepare.

How This Differs from the CMMC Framework

Defense contractors familiar with CMMC may wonder how the FAR CUI Rule relates to the compliance program they are already managing. The short answer is that these are parallel frameworks with overlapping technical requirements but different legal authorities.

CMMC applies to contractors operating under DFARS. It is DoD-specific and implemented through the DFARS clause structure. The FAR CUI Rule would apply across all federal agencies through the FAR. A contractor working exclusively with civilian agencies would not currently be subject to CMMC, but could be fully within scope of the FAR CUI Rule.

For contractors who operate in both spaces, there is good news. The technical controls in both frameworks trace back to NIST SP 800-171, though with an important distinction: CMMC Level 2 currently aligns to Revision 2, while the FAR CUI Rule references Revision 3, which introduced updated assessment procedures and clarified several control requirements. Organizations that have already built CMMC-compliant systems will have a significant head start on FAR CUI Rule compliance. The scoping methodology, SSP documentation, incident reporting infrastructure, and control implementation work they have already done maps directly to the FAR CUI Rule's requirements.

But that overlap also creates a false sense of security for firms that have been quietly relying on their CMMC work as a proxy for broader federal compliance. If your FAR contracts include CUI that sits outside your CMMC assessment boundary, you may have a gap you have not yet identified. Atlantic Digital's CMMC strategy experts can help you assess where those boundaries align and where they do not.

What to Do Before the Final Rule Drops

The comment period on the proposed rule has closed. A final rule is expected, and the contracting community should assume it is coming. These are the steps that separate organizations that will absorb the rule cleanly from those that will scramble.

Conduct a CUI inventory across your federal contracts

Review every active federal contract and identify whether you receive, generate, or handle information that falls within a CUI category. If your contracts are exclusively with DoD and you have already completed CMMC scoping, extend that exercise to any civilian agency work you hold.

Confirm your system boundaries

Identify every information system that touches CUI. Cloud environments, collaboration platforms, file storage systems, email, and any third-party tools used in contract performance should all be evaluated. Boundaries that were appropriate for DFARS compliance may not capture the full scope of CUI under the FAR rule.

Assess your NIST SP 800-171 Rev. 3 posture

If you have not already implemented the 110 controls in NIST SP 800-171 Rev. 3, now is the time to begin. If you have, verify that your System Security Plan is current and that your SPRS score reflects your actual implementation status, not an aspirational one.

Build your incident reporting infrastructure

The FAR CUI Rule includes cyber incident reporting requirements. Contractors need to know who their reporting contact is at the relevant agency, what the reporting timeline is, and how to preserve forensic evidence of a security event. These processes should be documented and tested before a contract clause requires them.

Evaluate your subcontractor obligations

If you are a prime contractor who flows down FAR clauses to subcontractors, you have an obligation to understand whether those subs are positioned to comply. A non-compliant subcontractor handling CUI on your prime contract creates exposure for your organization as well as theirs.

Frequently Asked Questions

Does the FAR CUI Rule apply if I only work with civilian agencies, not DoD?

Yes. The FAR applies government-wide. If the final rule incorporates CUI safeguarding requirements into the FAR, those requirements will apply to contracts with any federal agency, not just DoD. Civilian agency contractors who handle CUI are within scope.

How do I know if the information I handle qualifies as CUI?

CUI is defined by the CUI Registry maintained by NARA. If the information falls within a listed category and you received it from or generated it for the federal government under a contract, it is likely CUI. When in doubt, review your contract language and consult with your contracting officer about whether a CUI designation applies to your work.

If I am already CMMC Level 2 certified, am I compliant with the FAR CUI Rule?

CMMC Level 2 certification demonstrates compliance with NIST SP 800-171 Rev. 2 within your assessed boundary. If that boundary covers all the systems where CUI resides, your technical controls will largely satisfy the FAR CUI Rule requirements. However, CMMC is a DoD-specific program. The FAR CUI Rule has its own clause structure, reporting requirements, and contract implementation mechanisms. Certified organizations should still review their contracts and confirm that their system boundaries and incident reporting processes align with the FAR rule requirements.

What is the False Claims Act exposure for contractors who fall out of compliance?

The Department of Justice's Civil Cyber-Fraud Initiative has pursued enforcement actions against contractors who misrepresented their cybersecurity posture on federal contracts. If a contractor certifies compliance with CUI safeguarding requirements in a contract and that certification is knowingly false, it may constitute a false claim under 31 U.S.C. 3729. Penalties can include treble damages and per-claim statutory fines. Multiple settlements have already been reached in cases involving cybersecurity misrepresentation.

Contact us today to learn more about how Atlantic Digital helps defense and federal contractors prepare for CUI compliance obligations before the final rule takes effect.

NIST SP 800-171 Scoping: Where Contractors Go Wrong

Ask most defense contractors what drives up their CMMC readiness costs and they will tell you it is the controls. The remediation. The tooling. The assessment fees. Those answers are not wrong, but they are downstream of the real problem.

The single most expensive mistake in CMMC Level 2 readiness happens before a single control is implemented. It happens at the boundary. Specifically, it happens when an organization draws the wrong line around which systems, people, and processes touch Controlled Unclassified Information.

NIST SP 800-171 compliance applies to the systems that process, store, or transmit CUI. Define that environment too broadly and you spend the next eighteen months remediating systems that never needed to be in scope. Define it too narrowly and you certify a boundary that does not reflect reality, creating compliance gaps on active contracts and exposure under the False Claims Act.

Scoping is not a technical task. It is a strategic decision with financial and legal consequences. Most organizations treat it like an IT exercise. That is where the trouble starts.

What Scoping Actually Means Under NIST SP 800-171

NIST SP 800-171 establishes 110 security requirements across 14 control families. Those requirements apply to nonfederal systems and organizations that process, store, or transmit CUI. The operative question in scoping is: which systems in your environment meet that definition?

The answer requires two things your organization needs to have done before the boundary conversation begins: a CUI registry that identifies what CUI you receive, where it comes from, and what form it takes; and a data flow map that traces where CUI moves once it enters your environment, which systems touch it, which personnel handle it, and where it comes to rest.

Without both, the boundary you draw is a guess. An educated guess, maybe, but a guess that your assessor will test against evidence. Systems your SSP excludes will be examined. If CUI flows through them and they are out of scope, you have a finding.

Industry data consistently shows that poor scoping and inadequate data discovery can inflate total CMMC readiness costs by 20 to 30 percent. That figure does not account for the cost of a failed assessment or a remediation window that delays contract award.

How Contractors Over-Scope and What It Costs

Over-scoping is the more common error, and it tends to be invisible until the bill arrives.

It typically happens when an organization defaults to including its entire enterprise IT environment in the assessment boundary. The logic sounds reasonable: we handle CUI somewhere in this network, so we should include all of it. In practice, this means applying all 110 NIST SP 800-171 requirements to systems that have no contact with CUI whatsoever, finance platforms, HR systems, marketing tools, general productivity infrastructure.

The cost compounds quickly. Every system in scope requires documented controls. Every gap in those controls requires remediation or a Plan of Action and Milestones (POA&M). Every POA&M extends your path to a final CMMC Level 2 score of 110. A C3PAO assessing a bloated environment takes longer, costs more, and finds more findings because there are simply more surfaces to examine.

The fix is not to exclude everything. It is to invest in network segmentation and architectural isolation that genuinely separates CUI-handling systems from the broader enterprise. An enclave approach, where CUI flows only through a defined, controlled environment, reduces scope legitimately and durably. That investment almost always costs less than remediating an over-scoped enterprise.

How Contractors Under-Scope and Why It Is More Dangerous

Under-scoping is less common but significantly more consequential. It tends to happen in one of three ways.

The 'mostly administrative' exclusion

A system handles CUI occasionally, when someone emails a contract document through a shared inbox, or when a program manager saves a deliverable to a general file share. Because the system is 'mostly used for other things,' it gets excluded from scope. The boundary is drawn around the purpose of the system, not the data that actually flows through it. Under NIST SP 800-171 and DFARS 252.204-7012, the data is what determines scope, not the system's primary function.

The inherited compliance assumption

An organization uses a cloud platform that holds FedRAMP authorization and assumes that means their CUI environment is covered. FedRAMP authorization establishes that the cloud service provider meets a defined security baseline. It does not mean the contractor's configuration of that service, their access controls, their data handling practices, or their boundary documentation meets NIST SP 800-171. The contractor's obligations do not transfer to the provider.

The subcontractor blind spot

A prime contractor scopes their own environment carefully but does not account for CUI that flows to subcontractors or teaming partners during contract performance. If CUI touches a subcontractor's systems, that subcontractor's environment is in scope for NIST SP 800-171 requirements and CMMC obligations under DFARS 252.204-7021 flowdown. A prime with a clean certification and an unvetted subcontractor has a compliance gap whether or not the gap shows up on their own assessment.

The Four Scoping Errors and What They Cost

TABLE 1. COMMON NIST SP 800-171 SCOPING ERRORS AND DOWNSTREAM COSTS

Scoping Error	What It Looks Like	What It Costs
Over-scoping	Including all enterprise IT systems regardless of CUI contact	Assessment scope inflated 30-50%; unnecessary remediation investment; longer C3PAO timelines
Under-scoping	Excluding systems that transmit or process CUI because they are 'mostly administrative'	Compliance gaps in active controls; contract risk; potential False Claims Act exposure
CUI not identified	Organization does not know where CUI lives or how it flows through the environment	Boundary cannot be drawn; SSP is incomplete; assessment fails or is delayed
Boundary drift	Scope defined at assessment; CUI flows into new systems post-assessment without review	Certification covers a boundary that no longer reflects reality; annual affirmation becomes a liability

Scoping as a Strategic Decision

The organizations that manage CMMC readiness costs most effectively are not the ones that find the cheapest assessor or the fastest path to a passing score. They are the ones that make deliberate scoping decisions early, with executive involvement, and then build their compliance architecture around a defined and defensible boundary.

That means the scoping conversation belongs in the boardroom, not just the server room. A CEO or COO deciding how to structure a compliance investment needs to understand that boundary definition is a lever. A well-segmented CUI enclave can reduce assessment scope by half. That reduction translates directly into lower remediation costs, shorter assessment timelines, and a more manageable annual compliance burden.

It also means that scoping decisions need to be documented with the same rigor as the controls themselves. Your System Security Plan must describe the boundary, justify what is included and excluded, and reflect the actual flow of CUI through your environment. An SSP that describes a boundary your assessor cannot verify is not a compliance document. It is a liability.

One practical benchmark worth knowing: DoD data projects the three-year CMMC Level 2 compliance cost for a small business at approximately $487,000, with the largest variable being internal labor and sustainment. Organizations that scope precisely and maintain that scope through disciplined boundary management consistently come in below that benchmark. Those that do not consistently exceed it.

Where to Start

• Conduct a CUI discovery exercise before drawing any boundary. Identify every contract that requires CUI handling, every system that touches it, and every person with access. This is not an IT project. It requires input from contracts, program management, IT, and legal.

• Map data flows, not just system inventories. A static list of systems is not a boundary. You need to trace how CUI enters your environment, where it moves, where it is stored, and how it exits. Email, collaboration platforms, shared drives, removable media, and third-party portals all need to be accounted for.

• Evaluate network segmentation before committing to an assessment scope. If CUI currently flows across your enterprise environment, architectural changes that isolate it may be the highest-ROI investment you make before engaging a C3PAO.

• Document the boundary in your SSP with the specificity your assessor will need. System names, data flows, boundary justifications, and exclusion rationale all belong in the SSP. Vague boundary descriptions are the first thing a thorough assessor will challenge.

• Build a boundary review into your annual affirmation process. CUI environments change. New contracts, new tools, new personnel, new subcontractors. A boundary that was accurate at certification may not be accurate twelve months later. Annual affirmation under DFARS 252.204-7021 requires that your SPRS status reflect your current posture. That requirement has teeth.

Frequently Asked Questions

How do we know which systems are in scope for NIST SP 800-171?

Any system that processes, stores, or transmits CUI is in scope. That determination requires a CUI identification exercise first: know what CUI you receive, in what form, and under which contracts. Then trace its flow through your environment. Systems that CUI touches are in scope. Systems that CUI never reaches, and can be architecturally isolated from systems that do, can be excluded with documented justification in your SSP.

Can we reduce our CMMC assessment scope after we have already started remediation?

Yes, but scope reduction is most cost-effective before remediation begins. If you have already invested in remediating systems that should not have been in scope, the remediation is done. Going forward, you can implement segmentation to prevent those systems from re-entering scope in future assessment cycles. Engage a qualified advisor before finalizing any boundary change to ensure the exclusion is documentable and defensible.

Does using Microsoft 365 GCC High mean our environment is automatically NIST SP 800-171 compliant?

No. GCC High provides a platform that supports NIST SP 800-171 compliance, but the contractor is responsible for configuring that platform correctly, controlling access, managing CUI data flows, and documenting compliance in an SSP. The provider's authorization does not transfer compliance status to the contractor. This is one of the most common inherited compliance assumptions in the Defense Industrial Base and one of the most frequently cited gaps in C3PAO assessments.

What happens if our boundary was wrong when we submitted our SPRS score?

If your SPRS score reflects a boundary that excluded systems that should have been in scope, your self-attestation may be inaccurate. Under the False Claims Act, knowing submission of a materially false compliance attestation carries significant legal exposure. The appropriate step is to reassess with an accurate boundary, update your SPRS record, and document the correction. Engaging legal counsel before making that update is advisable if the gap is material.

Scoping is where CMMC readiness is won or lost, and most organizations do not treat it with the seriousness it deserves until the cost overruns are already in motion. Getting the boundary right at the start is the highest-leverage decision in the entire compliance process. Contact us today to learn more.

DFARS 252.204-7012: What It Still Requires in 2026

There is a version of the compliance conversation happening inside defense contracting organizations right now that goes something like this: CMMC covers our cybersecurity obligations, so we just need to get our CMMC Level 2 assessment done and we are covered. It is a reasonable assumption. It is also wrong.

DFARS 252.204-7012 has not been replaced by CMMC. It has not been absorbed into DFARS 252.204-7021. It has not been modified under the Revolutionary FAR Overhaul. The clause is in effect exactly as written, and it imposes obligations that CMMC does not address.

Contractors conflating the two frameworks are leaving real compliance gaps in active contracts, gaps that carry cyber incident reporting liability, cloud security exposure, and potential False Claims Act risk.

What DFARS 252.204-7012 Actually Covers

DFARS 252.204-7012 is titled Safeguarding Covered Defense Information and Cyber Incident Reporting. Its scope is broader than the name suggests.

The clause applies when a contractor's information system processes, stores, or transmits Covered Defense Information (CDI), or when the contractor provides operationally critical support. CDI is defined to include Controlled Unclassified Information (CUI) that is collected, developed, received, transmitted, used, or stored by or on behalf of a contractor in performance of a contract.

When the clause applies, it imposes four distinct requirements:

• Adequate security. The contractor must apply security requirements in NIST SP 800-171 to all covered contractor information systems. This is the same technical baseline that CMMC Level 2 maps to. The difference is in how compliance is validated and enforced.

• Cyber incident reporting. The contractor must report cyber incidents to the DoD within 72 hours of discovery via the DCISE portal at DC3. This is a standalone obligation under 7012 with no equivalent provision in CMMC.

• Malicious software submission. If malicious software is discovered and isolated in connection with a reported cyber incident, the contractor must submit it to the DoD Cyber Crime Center (DC3).

• Media preservation and protection. Following a cyber incident, the contractor must preserve images of all known affected systems and relevant monitoring and packet capture data for at least 90 days, available for potential DoD forensic analysis.

• Cloud service provider requirements. Any cloud service used to process, store, or transmit CDI must meet security requirements equivalent to FedRAMP Moderate, or a higher standard agreed upon with the contracting officer.

None of these obligations disappear when a contractor achieves CMMC Level 2 certification. They are parallel requirements under a separate clause.

How 7012 and CMMC Relate to Each Other

CMMC Level 2, enforced through DFARS 252.204-7021, establishes whether a contractor holds a qualifying assessment status to handle CUI on a given program. It draws on the same 110 security requirements from NIST SP 800-171 that 7012 references.

But the two clauses serve different functions. CMMC is an assessment and certification framework. It answers the question: has this contractor's security posture been evaluated against a defined standard, and is that status recorded in SPRS? DFARS 252.204-7012 is an operational obligation framework. It answers the question: when a contractor handles CDI or supports critical operations, what must they do and what must they report?

Achieving CMMC Level 2 certification demonstrates that your controls are in place. DFARS 252.204-7012 governs what you are required to do when something goes wrong, or when you move CDI into the cloud, regardless of your CMMC status.

TABLE 1. DFARS 252.204-7012 VS. CMMC LEVEL 2: KEY DISTINCTIONS

	DFfffARS 252.204-7f012	CMMC Level 2 / DFARS 252.204-7021vv
Trigger	Receipt or transmission of Covered Defense Information on contractor IT systems	Processing, storing, or transmitting CUI on contractor IT systems
Core requirement	Adequate security aligned to NIST SP 800-171; cyber incident reporting; media preservation	Qualifying CMMC Level 2 assessment status recorded in SPRS; annual affirmation
Incident reporting	Required. 72-hour window to report to DoD.	Not separately addressed. 7012 governs.
Cloud requirement	Cloud providers must meet FedRAMP Moderate or equivalent	No separate cloud provision. 7012 governs.
Media preservation	Required for 90 days following cyber incident	Not addressed
Status in 2026	Unchanged. Fully in effect.	Unchanged. Phased enforcement through 2028.

Where Contractors Are Getting the Scope Wrong

The most common scoping error is assuming that if CMMC applies to a program, 7012 does not need separate attention. In practice, the clauses appear together in solicitations precisely because they cover different ground.

Three specific areas where conflation creates compliance risk:

Cloud environments

Many contractors have moved workloads to Microsoft 365 GCC High, Azure Government, or AWS GovCloud. These environments support CMMC evidence collection and can help demonstrate NIST SP 800-171 control implementation. But DFARS 252.204-7012 independently requires that any cloud service processing CDI meet FedRAMP Moderate or equivalent. The contractor is responsible for verifying and documenting that requirement, not assuming it is satisfied by the cloud provider's general compliance posture. That verification needs to be explicit in your System Security Plan.

Incident reporting timelines

CMMC does not establish a cyber incident reporting requirement. DFARS 252.204-7012 does, and the 72-hour window runs from discovery, not from the time an investigation is complete or a root cause is identified. Contractors that treat incident response as a compliance exercise rather than an operational one routinely miss this window. The consequence is not a CMMC finding. It is a contract violation with potential False Claims Act exposure under DFARS.

Subcontractor flowdown

DFARS 252.204-7012 requires prime contractors to flow the clause down to subcontractors when CDI will be processed, stored, or transmitted on subcontractor systems, or when the subcontract involves operationally critical support. This flowdown obligation exists independently of CMMC flowdown requirements under 252.204-7021. A prime that manages CMMC flowdown carefully but ignores 7012 flowdown is still out of compliance with its prime contract.

The False Claims Act Exposure Is Real

The Department of Justice Civil Cyber-Fraud Initiative has made clear that misrepresentations about cybersecurity compliance in federal contracting are actionable under the False Claims Act (31 U.S.C. § 3729 et seq.). That exposure is not limited to CMMC attestations.

A contractor that certifies compliance with contract terms, including DFARS 252.204-7012, while operating a cloud environment that does not meet FedRAMP Moderate, or that fails to report a cyber incident within 72 hours, has made a potentially material misrepresentation to the government. The fact that CMMC certification is in order does not resolve that exposure.

Compliance officers and program managers on active DoD contracts should be asking whether their contract compliance certifications accurately reflect 7012 obligations, not just CMMC status.

Practical Steps for Active Contracts

• Review every active DoD contract for the presence of DFARS 252.204-7012. If CDI is in scope, confirm that your System Security Plan explicitly addresses each of the clause's five requirement areas.

• Verify your cloud service providers against the FedRAMP Moderate baseline or document an equivalent standard agreed upon with your contracting officer. Do not assume compliance based on the provider's general certifications.

• Confirm your incident response plan includes the 72-hour reporting window, names the DCISE portal at DC3 (dc3.mil) as the reporting destination, and assigns clear ownership for that obligation. Test the process before you need it.

• Audit your subcontract agreements for 7012 flowdown. If a subcontractor is handling CDI and the clause is not flowed down, that is a prime contract compliance gap, not a subcontractor problem.

• Do not treat CMMC certification as a substitute for 7012 compliance documentation. Both need to be current, accurate, and defensible.

Frequently Asked Questions

Does achieving CMMC Level 2 certification satisfy DFARS 252.204-7012?

No. CMMC Level 2 certification confirms that your security posture has been assessed against NIST SP 800-171 requirements and that status is recorded in SPRS. DFARS 252.204-7012 imposes separate obligations, including 72-hour cyber incident reporting, media preservation, malicious software submission, and FedRAMP Moderate requirements for cloud services. These are independent contract requirements that remain in effect regardless of CMMC status.

Has DFARS 252.204-7012 been changed under the Revolutionary FAR Overhaul?

No. As of the current class deviations implementing the FAR overhaul, DFARS 252.204-7012 and its companion provision DFARS 252.204-7008 are unchanged. The overhaul restructured and renumbered several related clauses, including provisions tied to NIST self-assessments and CMMC, but 7012 remains in its current form and fully in effect.

What is the difference between CUI and Covered Defense Information under 7012?

Covered Defense Information (CDI) is the term used in DFARS 252.204-7012 and is defined to include CUI as well as other unclassified information marked or identified in the contract that requires safeguarding. In most current DoD contracts, CDI and CUI overlap substantially, but the 7012 definition is contractually specific. Review your contract's definition of CDI against what your organization actually processes.

If a cyber incident occurs, what specifically must be reported and to whom?

Under DFARS 252.204-7012, contractors must report cyber incidents to the DoD within 72 hours of discovery using the DCISE portal, operated by the DoD Cyber Crime Center (DC3) at dc3.mil. The report must include a description of the technique or method used in the incident, a description of the CDI compromised, any identified compromised systems, and other details defined in the clause. Contractors should also preserve system images and relevant monitoring data for at least 90 days pending potential DoD forensic review. DFARS 252.204-7012 is not a legacy requirement waiting to be replaced. It is an active contract obligation governing how your organization handles incidents, manages cloud environments, and flows compliance requirements to subcontractors. Getting CMMC right matters. Getting 7012 right matters just as much. Contact us today to learn more.

CMMC Level 2: Build Your Capture Strategy Now

Most defense contractors treat compliance and business development as separate functions. Compliance lives with the IT team. BD lives with the capture managers. The two converge, if at all, somewhere around contract award. That sequencing no longer works.

CMMC Level 2 requirements are now evaluated before award, not after. Your Supplier Performance Risk System (SPRS) score is visible to contracting officers during source selection. Subcontractor flowdown obligations are being scrutinized during teaming conversations. Compliance posture has become a competitive filter, and BD teams that do not account for it are walking into solicitations with a structural disadvantage.

This is not a compliance problem. It is a capture strategy problem.

CMMC Status Is Now a Pre-Award Requirement

Under DFARS 252.204-7021, contractors handling Controlled Unclassified Information (CUI) must hold a qualifying CMMC Level 2 status at the time of contract award. Contracting officers can verify that status through SPRS before a proposal ever reaches evaluation.

That means the question is no longer whether your organization will get compliant. The question is whether you will be compliant in time to compete for the contracts already in your pipeline.

For Level 2, the DoD distinguishes between two paths. Contracts assessed as lower risk may allow a self-assessment with annual executive affirmation recorded in SPRS. Contracts deemed critical to national security require third-party certification by a CMMC Third-Party Assessment Organization (C3PAO). Both paths require documented status in SPRS. Neither happens overnight.

The practical implication: capture teams need to know their organization's current SPRS status before they submit a teaming agreement, not before they submit a proposal.

Your SPRS Score Is Part of Your Competitive Profile

The Supplier Performance Risk System is not a compliance formality. It is a database that acquisition officials consult during source selection. A score that reflects incomplete implementation or an expired assessment does not just create legal risk under the False Claims Act. It can remove you from consideration before the evaluation board ever sees your technical approach.

SPRS scoring evaluates implementation of the 110 security requirements in NIST SP 800-171. Full implementation earns a score of 110. Deficiencies reduce that number, and scores can go negative under a DoD assessment. Contractors with unresolved gaps may qualify for conditional CMMC Level 2 status if deficiencies are documented in an approved Plan of Action and Milestones (POA&M), but final certification requires all 110 requirements met and all POA&Ms closed.

BD leaders reviewing their pipeline should be asking: what is our current SPRS score, when was it last updated, and does our compliance posture match the programs we are pursuing?

These are not IT questions. They are pipeline qualification questions.

Subcontractor Flowdown Is a Teaming Negotiation Issue

Prime contractors are increasingly verifying CMMC posture before they formalize teaming arrangements. A subcontractor that cannot demonstrate qualifying CMMC Level 2 status creates compliance liability for the prime and potential award risk for the entire team.

DFARS 252.204-7021 requires primes to flow CMMC requirements down to subcontractors that will process, store, or transmit CUI. That obligation does not begin at award. It begins the moment the prime needs to represent the team's compliance posture to the government.

For subcontractors, this means CMMC readiness is now a business development requirement, not just a performance requirement. For primes building teams, it means CMMC status should be a standard item in teaming due diligence alongside past performance and technical capability.

Three questions every BD team should ask before finalizing a teaming arrangement:

• Does each subcontractor handling CUI hold a qualifying CMMC Level 2 status or have a documented path to certification before award?

• Have subcontractor SPRS scores been verified, not self-reported?

• Is the compliance scope clearly defined across the team so no subcontractor is surprised by flowdown obligations post-award?

A teaming agreement that does not address these questions is an agreement built on an unverified assumption.

Compliance Maturity as a Differentiator in Competitive Procurements

Defense contractors sometimes assume that CMMC compliance is a pass-fail threshold, not a differentiator. That assumption may hold in straightforward procurements. It does not hold in competitive ones.

When evaluators are choosing between offerors with comparable technical scores, a contractor that can demonstrate a final CMMC Level 2 certification, a current SPRS score of 110, a closed POA&M record, and documented continuous compliance governance is presenting a meaningfully lower risk profile than one that is still working toward conditional status.

In best-value source selections, risk is a scored factor. Cybersecurity posture speaks directly to program execution risk. A C3PAO-certified organization pursuing a CUI-intensive program can make that argument explicitly in its proposal narrative, in its past performance references, and in its management approach.

This is where compliance transitions from a cost center to a competitive asset. The investment in getting to full CMMC Level 2 certification pays dividends not just in contract eligibility but in the strength of the proposal itself.

Aligning Compliance Milestones to Your Pipeline Timeline

A well-run capture strategy maps key milestones against the anticipated acquisition timeline. CMMC compliance milestones belong on that same map.

The typical C3PAO assessment process, including pre-assessment readiness activities, evidence collection, the formal assessment, and any remediation window, can take three to six months for an organization that is well-prepared. Organizations that are still closing foundational NIST SP 800-171 gaps should plan for longer.

Practical sequencing for BD and compliance teams:

• Eighteen to twenty-four months before anticipated RFP: Confirm CMMC Level 2 applicability and establish current SPRS baseline.

• Twelve to eighteen months out: Complete gap analysis against all 110 NIST SP 800-171 requirements. Initiate remediation and document POA&Ms.

• Six to twelve months out: Begin pre-assessment readiness review. Engage a C3PAO if third-party certification is required for target programs.

• Three to six months out: Complete formal assessment. Resolve any findings within the remediation window. Update SPRS with final or conditional status.

• At proposal submission: Confirm SPRS status is current and accurate. Verify subcontractor compliance posture.

Organizations that begin this process in response to an RFP release are already behind. The compliance timeline does not compress to fit a proposal schedule.

Tactical Recommendations for BD and Capture Teams

• Establish CMMC status as a standing agenda item in pipeline reviews. Know your organization's current SPRS score and assessment date before every BD meeting.

• Add compliance posture verification to your teaming due diligence checklist. Treat an unverified SPRS score the same way you would treat unverified past performance.

• Map your target programs against the DLA clauses RD004 and RD005. Programs involving export-controlled CUI will trend toward C3PAO certification requirements regardless of size.

• Engage your compliance team in capture planning, not just proposal development. The compliance questions that matter in a competitive procurement are strategic questions, not technical ones.

• If your organization is pursuing a C3PAO certification, build that milestone into your BD forecast. A certification in progress is not a certification in hand.

Frequently Asked Questions

Can we submit a proposal if our CMMC Level 2 assessment is still in progress?

It depends on the solicitation. If DFARS 252.204-7021 is included and requires qualifying CMMC status at award, you must hold that status before the contract is executed. An assessment in progress does not satisfy the requirement. Review the specific solicitation language and confirm with your contracting officer.

How does our SPRS score affect our position in source selection?

Contracting officers can access SPRS records during the pre-award phase. A current, accurate SPRS record demonstrating CMMC Level 2 status reduces perceived risk. An expired, missing, or low score raises questions that evaluators may not ask you to explain before making an award decision.

What do primes typically require from subcontractors on CUI contracts?

Requirements vary, but primes on CUI-intensive programs increasingly require subcontractors to verify SPRS status, demonstrate a documented compliance posture, and confirm CMMC Level 2 eligibility before teaming agreements are finalized. Expect this standard to tighten as CMMC enforcement phases in through 2028.

At what point should we engage a C3PAO for third-party certification?

Engage a C3PAO after completing a structured gap analysis and closing your most significant control deficiencies. Organizations that enter formal assessment with open gaps face remediation timelines that can delay certification for months. Pre-assessment readiness work is not optional. It is the difference between a clean assessment and an extended remediation window.Compliance posture and business development strategy are now the same conversation. If your pipeline includes DoD programs with CUI requirements, your CMMC readiness timeline is a BD planning document. Contact us today to learn more

The Death of the Self-Assessment: Is Your Infrastructure Ready for 252.240-7997?

Executive Summary: The End of the "Honesty System"

For years, the Defense Industrial Base (DIB) operated under a "trust but verify" model that leaned heavily on the former. Small and mid-sized contractors could maintain eligibility by submitting a basic self-assessment into the Supplier Performance Risk System (SPRS), often with the promise of future remediation. That era is officially over.

With the full implementation of the Revolutionary FAR Overhaul as of February 1, 2026, the Department of Defense has fundamentally shifted the goalposts. The legacy "check-the-box" mentality has been replaced by a rigorous validation requirement. The primary mechanism for this shift is the transition from the old DFARS 252.204-7020 (NIST SP 800-171 DoD Assessment Requirements) to the new, more stringent DFARS 252.240-7997 (formerly DFARS 252.204-7020). This change effectively eliminates the "Basic" self-assessment for any contract involving Controlled Unclassified Information (CUI). Now, validation is the only currency that matters. If your infrastructure cannot survive a third-party or government-led audit today, your firm is likely facing immediate exclusion from the 2026 bidding cycle.

What Happened to DFARS 252.204-7020?

The "Revolutionary FAR Overhaul" has introduced a massive reclassification of cybersecurity clauses into the new FAR Part 40 framework. As part of this reorganization, the legacy assessment clause DFARS 252.204-7020 has been renumbered to DFARS 252.240-7997 (formerly DFARS 252.204-7020).

While a number change might seem administrative, the policy shift behind it is seismic. Under the new DFARS 252.240-7997, the DoD has removed the option for "Basic" self-assessments for Level 2 CUI handling. Instead, the government now mandates that contractors must have a "Medium" or "High" assessment conducted by the Defense Contract Management Agency’s (DCMA) DIBCAC assessment 2026 team or a certified third party (C3PAO).

The "Ghost Clause" of the past—where a contractor could simply upload a score and hope for the best—has been exorcised. The new framework demands that a CMMC Level 2 audit readiness posture be established before the contract is even awarded.

From "Check-the-Box" to "Prove Your Security"

In 2026, a "perfect" SPRS score is no longer something you simply claim; it is something you prove through artifacts. The DoD’s current defense contract bidding requirements now include a "Current in SPRS" gate. If your score was uploaded under the old 7019/7020 rules and hasn't been validated under the new DFARS 252.240-7997 (formerly DFARS 252.204-7020) standards, your status may be flagged as "expired" by the Contracting Officer.

The shift toward verification has significant implications for your internal IT infrastructure:

Artifact-Driven Compliance: Every one of the 110 controls in NIST 800-171 (now often referenced under FAR 52.240-93, formerly FAR 52.204-21) must be backed by persistent evidence.
Executive Liability: We have entered the era of the mandatory cyber affirmation for executives. A senior official must now sign off on the accuracy of the SPRS score.
False Claims Act Exposure: The Department of Justice has significantly increased its use of the Civil Cyber-Fraud Initiative. There are severe penalties for false SPRS score affirmation, including treble damages and criminal prosecution if a contractor knowingly misrepresents their security posture to win a contract.

Infrastructure in Austere and Tactical Environments

One of the most overlooked aspects of the Revolutionary FAR Overhaul is its impact on OCONUS and tactical edge operations. If your firm provides IT services or hardware in austere environments, the compliance burden has doubled.

The DoD is no longer granting "tactical exceptions" for non-compliant hardware. Under the new CUI safeguarding requirements, any system that processes, stores, or transmits protected data—whether it’s in a climate-controlled data center in Virginia or a ruggedized server in a forward operating base—must meet the full CMMC Level 2 audit readiness standard.

Atlantic Digital specializes in optimizing infrastructure for these high-stakes environments. We understand that if your tactical edge isn't compliant, you're not just a security risk—you're a liability to the mission. We bridge the gap between "field-ready" and "audit-ready," ensuring your technical performance doesn't cost you your contract.

The Atlantic Digital Edge: Pre-Audit Validation

The transition to DFARS 252.240-7997 (formerly DFARS 252.204-7020) means you cannot afford to "learn as you go" during a live DIBCAC or C3PAO assessment. The stakes are too high, and the window for remediation is closing.

Atlantic Digital provides the strategic "pre-read" your organization needs. Our team of certified professionals performs a deep-dive verification of subcontractor SPRS status and prime-level readiness. We don't just look at your policies; we stress-test your technical implementation to ensure it survives the scrutiny of 2026’s "Verification-First" culture.

We turn compliance from a hurdle into a "bid magnet." When you can show a prospective partner or a Contracting Officer a validated, audit-ready infrastructure, you move to the front of the line.

Tactical Recommendations for Defense Executives

To survive the death of the self-assessment, leadership must take three immediate steps:

Verify Your "Affirming Official": Identify the senior executive who will be legally responsible for the mandatory cyber affirmation for executives. Ensure they have a direct line of reporting to the CISO and have reviewed the evidence themselves.
Conduct a Gap "Kill-Chain" Analysis: Don't just look for missing controls; look for controls that lack automated evidence. In a DIBCAC assessment 2026 scenario, "we do this" is not an answer. "Here is the log that proves we do this" is the only answer.
Transition to FAR Part 40 Terminology: Ensure your internal compliance mapping reflects the renumbered clauses. Update your System Security Plan (SSP) to reference FAR 52.240-93 (formerly FAR 52.204-21) and DFARS 252.240-7997 (formerly DFARS 252.204-7020) to show auditors you are operating at the current regulatory speed.

Frequently Asked Questions

Is the basic self-assessment still allowed in 2026?

Technically, no. Under the Revolutionary FAR Overhaul, the "Basic" self-assessment previously allowed under the old DFARS 7019/7020 has been eliminated for any contract involving CUI. Contractors must now undergo a "Medium" or "High" assessment conducted by the government or a C3PAO to be eligible for award or option exercises under DFARS 252.240-7997 (formerly DFARS 252.204-7020).

What are the penalties for false SPRS score affirmation?

The penalties for false SPRS score affirmation are severe. Under the False Claims Act, the Department of Justice can pursue treble damages (three times the government's loss) and civil penalties. In cases of intentional misrepresentation, executives can face criminal prosecution under 18 U.S.C. § 1001 for making false statements to the federal government.

What is the role of a DIBCAC assessment in 2026?

The DIBCAC assessment 2026 remains the gold standard for high-level DoD validation. While C3PAOs handle the bulk of CMMC Level 2 certifications, the DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) focuses on "High" level assessments for major programs and sensitive technology. A successful DIBCAC assessment is often a prerequisite for the most lucrative and sensitive defense contracts.

How do CUI safeguarding requirements change under the new FAR Part 40?

The CUI safeguarding requirements themselves (NIST 800-171) remain largely consistent, but their location in the FAR has moved to Part 40. The major change is the level of enforcement. The "Revolutionary FAR Overhaul" has introduced stricter "Condition of Award" language, meaning the government will verify your compliance in SPRS before a contract is signed, rather than allowing for post-award remediation.

Is your infrastructure truly audit-ready, or are you still relying on "Ghost Clauses"? Contact Atlantic Digital today to schedule a pre-audit assessment and secure your position in the 2026 defense market.

Ghost Clauses: Why You’re Still Seeing DFARS 7019/7020 (And Why You Shouldn’t Trust Them)

Executive Summary: The Regulatory Duality of 2026

The federal procurement landscape is currently operating in a state of regulatory duality that is trapping even the most seasoned defense contractors. While the Revolutionary FAR Overhaul (RFO) officially launched on February 1, 2026, many contractors are finding that their current solicitations and active contracts still reference what we at Atlantic Digital call "Ghost Clauses"—specifically the legacy DFARS 252.204-7019 and 7020.

The confusion stems from a significant lag between the issuance of Revolutionary FAR Overhaul class deviations and formal rulemaking. While the Department of Defense (DoD) has issued sweeping deviations to move toward the new FAR Part 40 reorganization, these changes are not yet fully codified in the permanent Code of Federal Regulations (CFR). This creates a high-stakes gap for the Defense Industrial Base (DIB). If your team is preparing for a 7019/7020 self-assessment while the government has already transitioned to the FAR 52.240-93 (formerly FAR 52.204-21) and DFARS 252.240-7997 (formerly DFARS 252.204-7020) framework, you are effectively building your compliance strategy on quicksand. Atlantic Digital acts as the navigator through this regulatory noise, ensuring that your compliance posture aligns with the actual mission requirements of 2026 rather than legacy language that is technically slated for deletion.

Class Deviation vs. Rulemaking: Why the "Red Text" Matters

In high-authority reports from regulatory watchdogs and firms like Wiley Law, the "red text" is currently the most important part of any compliance document. This red text represents the language that has been "lined out" or replaced by the Revolutionary FAR Overhaul class deviation.

To understand why this is happening, one must understand the difference between the two primary ways the government changes its mind. Rulemaking is a slow, notice-and-comment process that can take years to reflect on standard portals like acquisition.gov 2026 updates. Class Deviations, however, are immediate. As of February 1, 2026, agencies were directed to bypass legacy text in favor of the overhauled structure to meet urgent national security needs regarding the supply chain.

The danger for contractors is that common search portals often show the codified rule—the old way—while the solicitation hitting your desk contains the Deviation—the new way. If you are searching for "Why is DFARS 252.204-7019 missing?", the answer is simple: it has been deleted and consolidated into a broader framework that prioritizes Supply Chain Risk Management (SCRM). Relying on the old numbers isn't just an academic error; it's a failure to recognize the current legal authority under which the Contracting Officer (CO) is operating.

The "Before and After" of the Renumbered Clauses

To maintain eligibility in the 2026 market, you must understand the new "Information Security and Supply Chain Security" geography. The RFO has consolidated dozens of scattered clauses into a streamlined, centralized framework.

Legacy Clause/Provision	New RFO Reference	Status & Primary Change
FAR 52.204-21	FAR 52.240-93 (formerly FAR 52.204-21)	Renumbered. Same 15 basic controls; now resides in FAR Part 40.
DFARS 252.204-7019	None	Deleted. Self-assessment notification is now consolidated under CMMC.
DFARS 252.204-7020	DFARS 252.240-7997 (formerly DFARS 252.204-7020)	Renumbered/Modified. Focus shifts from basic self-assessments to validated DIBCAC and C3PAO assessments for Level 2 compliance.
FAR 52.204-23/24/25	FAR 40.202	Consolidated. Combined prohibitions on foreign adversary tech.

The transition to FAR 52.240-93 (formerly FAR 52.204-21) is particularly critical. While the technical requirements of the 15 basic safeguarding controls remain consistent, the administrative 'hook' has moved into the new FAR Part 40. In the current 2026 oversight climate, your System Security Plan (SSP) acts as your first impression. If your documentation still points to the obsolete 204-series, you are effectively telling a C3PAO or DIBCAC auditor that your compliance program is reactive rather than proactive. At Atlantic Digital, we ensure your SSP is mapped to the current regulatory landscape, signaling to the government that your infrastructure is managed by experts who move at the speed of the mission.

Why Ghost Clauses Are Haunting Your Pipeline

A Ghost Clause is an administrative phantom. It appears in contract templates because they haven't been updated, or it lingers in active contracts that were awarded prior to the February deadline. The most prominent examples are DFARS 7019 replacement clauses and the aging 7020 requirements.

Under the new overhaul, 7019 has been largely deleted because the requirement to notify the government of an assessment is now consolidated under the broader CMMC 2.0 framework. Meanwhile, 7020 has been renumbered and modified into DFARS 252.240-7997 (formerly DFARS 252.204-7020).

This is not merely an exercise in terminology. When a Contracting Officer sees a proposal that references legacy clauses, it signals a lack of regulatory maturity. In a high-stakes defense environment, that signal suggests that your firm may also be behind on its actual cybersecurity technical controls. Atlantic Digital helps firms purge these ghosts by mapping legacy requirements directly to the new FAR Part 40 structure, ensuring that your proposals speak the language of the modern acquisition officer.

The Atlantic Digital Edge: Mission Impact for CONUS and OCONUS

At Atlantic Digital, we don't just read the regulations; we understand the mission impact of these deviations for both domestic and overseas operations. The impact of February 1, 2026 FAR changes on contractors varies significantly based on where the mission is executed.

For CONUS (Continental United States) operations, the primary risk is "Clause Mismatch." If a prime contractor flows down a ghost clause like 7019 to a subcontractor, but the government auditor or the prime's own compliance team expects the new FAR 52.240-93 (formerly FAR 52.204-21) standards, the resulting discrepancy can stall payments or trigger a "Notice of Non-Compliance."

For OCONUS (Outside the Continental United States) operations, the stakes are exponentially higher. The RFO includes new, centralized prohibitions on specific foreign-adversary telecommunications and satellite services that were once hidden in the deep sub-parts of the FAR. Under the new FAR Part 40 reorganization, these exclusions are strictly enforced. A failure to recognize that a "Ghost Clause" has been replaced by a more stringent SCRM requirement could lead to an immediate contract termination for default. Atlantic Digital bridges this gap, ensuring that your technical performance in the field isn't undermined by administrative obsolescence.

Tactical Recommendations: Managing the Transition

To stop chasing ghosts and start winning bids, Atlantic Digital recommends the following executive actions:

Audit Your Flow-Downs: Immediately review your subcontracting templates. If you are still flowing down DFARS 252.204-7019, you are asking your subcontractors to comply with a defunct standard. Update these to the DFARS 252.240-7997 (formerly DFARS 252.204-7020) framework.
Bridge the BD and Legal Gap: Ensure your Business Development team knows that the absence of 7019 in a new RFP isn't a mistake—it's the new standard. They should be looking for FAR 52.240-93 (formerly FAR 52.204-21) as the primary security marker.
Verify SPRS Entry Logic: The Supplier Performance Risk System is being updated to reflect these changes. Ensure your "Date of Assessment" and "Clause Reference" in SPRS align with the renumbered requirements to avoid system-generated flags.
Subscribe to Deviations: Because the CFR takes time to catch up, the only way to stay current is to track Class Deviations. These are the true "maps" of the 2026 regulatory storm.

Frequently Asked Questions

Why is DFARS 252.204-7019 missing from my new solicitation?

As of February 1, 2026, DFARS 252.204-7019 has been largely phased out under the Revolutionary FAR Overhaul. The DoD determined that the requirement to notify the government of a NIST 800-171 assessment was redundant given the implementation of the CMMC 2.0 framework and the centralized reporting now required under DFARS 252.240-7997 (formerly DFARS 252.204-7020).

What is the impact of February 1, 2026 FAR changes on contractors?

The primary impact is a massive reorganization of security and supply chain requirements into a new FAR Part 40 reorganization. This means many cybersecurity, supply chain, and prohibited telecommunications clauses have been renumbered or merged. Contractors must update their internal systems, legal templates, and training to reflect these new references to remain compliant during audits.

What is a "Ghost Clause"?

A "Ghost Clause" refers to legacy FAR or DFARS clauses (like 7019 or 7020) that still appear in older contracts or un-updated templates but have been officially replaced or deleted by a Revolutionary FAR Overhaul class deviation. Relying on the instructions in a ghost clause can lead to reporting errors, as the government has changed the required platform or method of compliance under the new Part 40 structure.

How does clause renumbering affect my current active contracts?

For most existing contracts, the legacy numbers remain in effect unless the government issues a formal contract modification. However, for any new task orders, contract renewals, or options being exercised, Contracting Officers are now directed to use the renumbered clauses, such as FAR 52.240-93 (formerly FAR 52.204-21) and DFARS 252.240-7997 (formerly DFARS 252.204-7020).

Automation Over Agony: How Dynamic Mapping Solves the SPRS 88+ Requirement

Executive Summary: The New Threshold of Entry

In the current federal contracting landscape, compliance is no longer a post-award administrative task. It is the primary filter for pre-award eligibility. With the implementation of the Revolutionary FAR Overhaul and the finalization of CMMC 2.0, the Department of Defense (DoD) has shifted from trust to verification. Specifically, the Supplier Performance Risk System (SPRS) score has evolved into a digital gatekeeper.

For defense contractors, an SPRS score 88 plus is the new baseline for competitiveness. Falling below this threshold or failing to maintain an accurate, real-time score effectively eliminates a firm from the competitive range before a single word of their technical proposal is read. The challenge lies in the volatility of the regulatory environment. As FAR clause renumbering and NIST revisions take effect, manual compliance tracking via static spreadsheets has become a liability. Atlantic Digital leverages IntelliGRC CMMC mapping to transform compliance from a reactive burden into a proactive bid magnet, ensuring that your organization remains visible, eligible, and preferred in high-stakes defense acquisitions.

The Gatekeeper Effect: Why 88 is the New Zero

The Defense Industrial Base (DIB) has entered an era of compliance-first procurement. Contracting Officers (COs) are increasingly utilizing SPRS scores as a definitive risk metric. While a perfect score of 110 remains the objective, the industry has seen a clear trend. An SPRS score 88 plus is frequently the internal cutoff for a low-risk classification.

When a firm’s score sits below this mark, it signals to the government that critical NIST 800-171 compliance controls are either missing or inadequately documented. These often include controls related to Multi-Factor Authentication (MFA), FIPS-validated encryption, and incident response. In a crowded market, the government will not take a risk on a contractor with a Medium or High risk rating in SPRS. Achieving and maintaining an automated SPRS self-assessment is not just about following the rules. It is about maintaining your license to operate in the defense market.

The Danger of Static Spreadsheets in a Dynamic Regulatory Era

Many GovCon firms still rely on manual spreadsheets to track their NIST 800-171 dynamic mapping. In 2026, this approach is a recipe for failure. The Revolutionary FAR Overhaul has introduced a systemic restructuring of how clauses are organized and audited.

The real danger of the spreadsheet method is its inability to scale across multiple regulatory frameworks. As defense contractors expand, business needs often dictate compliance with more than just NIST 800-171. If your organization is also pursuing ISO 27001 for international work or managing HIPAA requirements for healthcare-adjacent federal contracts, a static spreadsheet becomes a fragmented liability. Atlantic Digital uses IntelliGRC to bridge these gaps, ensuring that a single technical implementation fulfills multiple regulatory requirements simultaneously.

Manual entry errors lead to:

Stale Data: SPRS scores that do not reflect recent remediations lead to lost bid opportunities.
Audit Failure: Discrepancies between the System Security Plan (SSP) and current requirements cause immediate red flags.
False Claims Act Exposure: Submitting an inaccurate SPRS score to acquisition.gov can trigger investigations if the reported score cannot be validated by an audit.

The Atlantic Digital Edge: Dynamic Mapping via IntelliGRC

Atlantic Digital solves the agony of manual tracking by deploying IntelliGRC as the backbone of our clients' compliance architecture. We do not just provide a tool. We architect a system where policy and operational execution are natively linked.

1. Automated Control Mapping

When cybersecurity frameworks undergo structural changes or new requirements are introduced, our IntelliGRC CMMC mapping updates the underlying control associations automatically. While the government may shift the administrative hooks in the FAR or DFARS, IntelliGRC focuses on the technical and cybersecurity controls themselves. If a requirement is updated or a new sub-control is introduced, the system maps your existing evidence to the new regulatory reference. You no longer have to start over from scratch when a regulation is restructured; the system bridges the gap between policy language and technical evidence for you.

2. Real-Time SPRS Score Improvement

Instead of a quarterly check-in, our approach provides a live dashboard of your Supplier Performance Risk System score improvement. As Plan of Action and Milestones (POA&Ms) are closed out, the score updates in real time. This allows Business Development (BD) leaders to see exactly when they cross the 88+ threshold, enabling them to pursue contracts that were previously out of reach.

3. Evidence-Backed Positioning

We use GRC automation for DoD contractors to link every control to a specific, timestamped piece of evidence. When a prime contractor or a government auditor asks for proof of your CMMC 2.0 requirements readiness, you are not digging through folders. You are providing a validated, exportable report that proves you are a low-risk partner.

Turning Compliance into a Bid Magnet

In the 2026 defense market, being compliant is the bare minimum. Being demonstrably compliant at scale is a competitive advantage. Large primes are currently scrubbing their supply chains and removing subcontractors who pose a cybersecurity risk.

By utilizing Atlantic Digital’s dynamic mapping strategy, you position your firm as a safe bet. You can walk into a teaming meeting and prove with data that your NIST 800-171 compliance is managed, automated, and audit-ready. This level of sophistication transitions your compliance department from a cost center into a revenue-enabling asset.

Frequently Asked Questions

What is the FAR overhaul and how does it affect my compliance?

The FAR overhaul is a comprehensive restructuring of the Federal Acquisition Regulation designed to modernize procurement for 2026 and beyond. A major component is FAR clause renumbering which relocates essential cybersecurity and supply chain risk clauses into the new updated NIST 800-171 Rev 3 requirements. For contractors, this means existing contracts and internal compliance maps must be updated to reflect these new designations to avoid administrative non-compliance.

What SPRS score do you need to win DoD contracts?

While any positive score technically allows for participation, an SPRS score 88 plus is widely considered the threshold for competitive eligibility in 2026. Scoring below this indicates gaps in high-priority NIST 800-171 controls. Major defense agencies and prime contractors now view scores below 88 as an unacceptable security risk.

How do I reach an SPRS 88 score for defense bidding?

Reaching an 88 requires the successful implementation and documentation of the most heavily weighted controls in NIST 800-171. This typically includes robust access controls, encryption, and incident response capabilities. Using IntelliGRC vs manual compliance tracking for updated NIST 800-171 Rev 3 requirements. allows you to identify exactly which controls are suppressing your score and prioritize their remediation to cross the 88-point line quickly.

Is CMMC 2.0 mandatory for all defense contractors in 2026?

Yes, the CMMC 2.0 final rule is now a mandatory requirement for contracts involving Controlled Unclassified Information (CUI). Contractors must demonstrate their maturity level through a verified assessment depending on the sensitivity of the work. An accurate and high SPRS score is a mandatory prerequisite for this certification and overall contract eligibility.

Frequently Asked Questions

What is the FAR overhaul and how does it affect my compliance?

What SPRS score do you need to win DoD contracts?

How do I reach an SPRS 88 score for defense bidding?

Is CMMC 2.0 mandatory for all defense contractors in 2026?

CMMC Level 2 & DLA RD004/RD005

What Defense Contractors Must Know Now

The Department of Defense (DoD) and the Defense Logistics Agency (DLA) have entered a new enforcement phase. Updated CMMC Level 2 requirements and DLA clauses RD004 and RD005 now determine whether contractors are eligible to compete for and retain contracts involving Controlled Unclassified Information (CUI).

If your organization handles CUI, qualifying Level 2 status is required when CMMC clauses appear in solicitations. Cybersecurity eligibility is also increasingly verified prior to award, not addressed solely post-award.

What Changed

1. CMMC Is Now Embedded into Contract Eligibility

This means contractors must demonstrate qualifying CMMC status at time of award.¹

For companies handling CUI, CMMC Level 2 is now the primary compliance mechanism aligned to NIST SP 800-171.²

Unlike legacy NIST “self-attestation” concepts, compliance must now be:

Documented
Assessed under defined criteria
Recorded in SPRS
Annually affirmed

2. Clause Renumbering Is Creating Confusion

Simultaneously, the government is restructuring and renumbering portions of the FAR under the Revolutionary FAR Overhaul (RFO).³ A detailed crosswalk of legacy clauses, their renumbered counterparts, and their practical compliance implications is provided in Appendix 1.

This means:

“Old” and “new” clause numbers may both appear in solicitations
For new solicitations where CMMC applies, standalone NIST self-assessment reporting has largely been incorporated into the CMMC framework.
Primes and contracting officers are translating compliance requirements differently in questionnaires.

The technical controls may look familiar, but the enforcement mechanism has fundamentally changed.

CMMC Level 2 Requirements

CMMC Level 2 applies to contractors that store, process, or transmit CUI on non-federal systems.

It aligns to the 110 security requirements in NIST SP 800-171, with additional formal assessment structure defined in federal regulation.²

Under DFARS 252.204-7021, contractors must:

Hold a qualifying Level 2 status (Self-Assessment or C3PAO Assessment)
Record status in SPRS
Perform annual affirmation of continuous compliance (not older than 1 year)¹

SPRS now reflects compliance status, not just a raw NIST score. This status can determine award eligibility.

DLA RD004 and RD005 Requirements

The Defense Logistics Agency separates CMMC enforcement into two clauses:

RD004 – non-export-controlled CUI
RD005 – Export-controlled CUI

This distinction reflects increased national security sensitivity for export-controlled information.

DLA Phase-In Timeline

Clause	Applies To	Optional Phase	Mandatory Phase
RD004	Non-export-controlled CUI	11/10/2025–11/10/2028: Level 2 self-assessment may be used	After 11/10/2028: Level 2 self-assessment required in SPRS
RD005	Export-controlled CUI	11/10/2025–11/10/2028: C3PAO certification may be used	After 11/10/2028: C3PAO certification required in SPRS

These clauses apply to DLA-administered contracts and are reflected in DLA acquisition guidance.^4, ⁵

Important: Requiring activities retain discretion. Higher-risk programs may mandate stricter validation earlier.

Practical Implications for Defense Contractors

If your organization handles CUI:

Cybersecurity questionnaires now act as go/no-go gates
CMMC status can be verified prior to proposal evaluation¹
Self-assessments must meet SPRS criteria for Conditional or Final status¹
Export-controlled CUI programs will generally trend toward C3PAO certification^{2, 4}
Annual affirmation is mandatory under current rule structure¹

Being “secure in principle” is no longer sufficient. Compliance must be provable, consistent, and current.

Secure. Comply. Excel.

How Atlantic Digital Helps

Atlantic Digital aligns cybersecurity compliance to business strategy through a three-tier model built for defense contractors.

SECURE

Secure Start — Establish the Right Foundation: For organizations beginning or recalibrating their compliance posture.

We help you:

Confirm whether CUI and/or export-controlled data is in scope
Determine the correct CMMC target level
Define the appropriate assessment pathway
Avoid costly rework caused by mis-scoping

Outcome: A clear roadmap aligned to eligibility requirements.

COMPLY

ADvantage — Operationalize Compliance: For contractors who need defensible, repeatable execution.

We support:

Evidence mapping to CMMC Level 2 controls
RD004/RD005 applicability analysis
Questionnaire response standardization
Ongoing compliance monitoring

Outcome: A stable, audit-ready posture that holds up under scrutiny.

EXCEL

Premium — Executive Governance & Competitive Positioning: For organizations that treat compliance as strategic infrastructure.

We provide:

Ongoing vCISO oversight
Continuous compliance governance
C3PAO certification readiness planning
Executive reporting aligned to board and acquisition expectations

Outcome: Sustained eligibility and competitive differentiation.

Next Steps

If you handle CUI or pursue DoD/DLA contracts:

Confirm whether CMMC Level 2 applies
Determine whether RD004 or RD005 governs your contracts
Validate your SPRS status
Standardize cybersecurity questionnaire responses
Build a roadmap toward sustained compliance

Schedule a CMMC Eligibility Review

Sources

DFARS (in https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.
Code of Federal Regulations (in https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-170).
FAR Overhaul – FAR Part Deviation Guidance (in https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52)
DLA Cybersecurity Resources for Suppliers (in https://www.dla.mil/Small-Business/Resource-Center/Cybersecurity-Resources/)
DLA Master List of Technical and Quality Requirements (in https://www.dla.mil/Portals/104/Documents/J7Acquisition/DLA_Master_List_of_TQ_Requirements_December_01_2025_Rev_41.pdf)

Appendix 1

Original clause or term	What It Maps To	What It Really Means
FAR 52.204-21	FAR 52.240-93 (class deviation under FAR overhaul)	Same 15 basic safeguarding requirements; clause number renumbered under the FAR overhaul (Acquisition 3).
DFARS 252.204-7019	No longer prescribed for new solicitations where CMMC applies; functionally superseded (may still appear on legacy contracts)	Previously required contractors to perform a NIST SP 800-171 self-assessment and upload a score to SPRS as a condition of award. This requirement has been eliminated as a standalone clause and absorbed into the CMMC framework, where self-assessments now support CMMC Level 1 or Level 2 status under DFARS 252.204-7021. (Acquisition 4; Acquisition 5).
DFARS 252.204-7020	DFARS 252.240-7997 (class deviation)	Formerly governed DoD Medium and High NIST SP 800-171 assessments and associated SPRS reporting. Under the FAR/DFARS restructuring, this clause was renumbered or replaced via class deviation, and its remaining assessment concepts are now aligned with CMMC Level 2 assessment types. Contractor-performed “basic assessments” were removed from this clause and are now addressed under DFARS 252.204-7021. (Wiley; Acquisition 4; Acquisition 5).
DFARS 252.204-7021	Unchanged	CMMC Level 2 requirement for systems handling CUI and linkage to CMMC assessments recorded in SPRS (Acquisition 4).
NIST SP 800-171 compliance	CMMC Level 2	Same 110 security requirements, plus formalized CMMC Level 2 assessment and documentation.
SPRS assessment record	CMMC Level 2 assessment status	Your posted NIST/CMMC score and whether it meets DoD criteria for “current” or “conditional” status in SPRS.

DoD Clarifies CMMC Applicability for Paper only CUI: What Contractors Need to Know

Earlier this month, the U.S. Department of Defense updated its Cybersecurity Maturity Model Certification (CMMC) Frequently Asked Questions (FAQ) to clarify the applicability of CMMC assessments when an organization handles Controlled Unclassified Information (CUI) in paper/hardcopy form only. This paper examines the substance of that clarification, its practical implications for defense contractors, and Atlantic Digital’s interpretation of the guidance in light of ongoing industry debate.

Executive Summary

The Department of Defense recently clarified that organizations handling Controlled Unclassified Information (CUI) exclusively in hardcopy form are not required to undergo a CMMC assessment, provided the CUI is never processed, stored, or transmitted on a contractor-owned information system. This clarification affects assessment applicability, not safeguarding obligations. Contractors should review contract language carefully and approach “paper-only” scenarios with caution, as routine business practices often introduce digital CUI exposure.

What the DoD CMMC FAQ Says About Hard Copy CUI

The authoritative DoD CMMC FAQ (Version 4) explicitly includes the following question and answer, which is reproduced verbatim:

"CQ10: Are CMMC assessments required for organizations that only handle hardcopy CUI?"

"CA10: No. Organizations that only handle hardcopy CUI should not be required to complete a CMMC Assessment. CMMC assessment requirements address cybersecurity related risk to CUI and apply only when the CUI is processed, stored, or transmitted on a contractor owned information technology system. Nonetheless, contractors are required to protect the hardcopy CUI. Per DoDI 5200.48, paragraph 1.1(b), any contractor or subcontractor that receives CUI is required to safeguard that information with Government training and safeguarding requirements.

Additionally, if a contractor who was only provided hardcopy CUI plans to place the hardcopy CUI on an information technology system (e.g., scanned, entered, photographed, uploaded, printed, emailed), then that information technology system is subject to the applicable CMMC assessment requirements prior to the CUI being placed on the system.

For organizations that handle paper CUI in addition to processing, storing, or transmitting CUI in a contractor owned information technology system, the necessary CMMC assessment will address both the paper CUI and the digital CUI, in accordance with the applicable NIST SP 800171 security requirements..." (Defense CIO)

While the FAQ states that CMMC assessments will address both paper and digital CUI when an information system is in scope, this does not mean that hardcopy CUI is independently assessed outside the context of a contractor-owned information system. Rather, applicable NIST SP 800-171 controls (such as Physical Protection and Media Protection) are evaluated as they relate to safeguarding CUI within the assessed system boundary, while hardcopy-only CUI safeguarding requirements continue to be governed primarily by DoDI 5200.48 and contractual obligations.

In summary, the FAQ clarifies that CMMC assessment requirements are tied to cybersecurity risk on contractor-owned IT systems. If CUI never touches such a system, a formal CMMC assessment is not required. However, this does not eliminate the safeguarding obligation: contractors handling only paper CUI remain responsible for complying with applicable physical protection and training requirements.

Business Processes Implications

For many defense contractors, particularly those that do not handle CUI at all, the FAQ has limited practical impact, because the FAQ addresses assessment applicability, not contract scoping. In such cases, DFARS clause 252.204-7012 and the associated NIST SP 800-171 requirements generally do not apply because Covered Defense Information (including CUI) is neither processed, stored, nor transmitted on the contractor’s information systems. DFARS 252.204-7012 requires contractors to provide adequate security only when covered defense information resides on or transits through a contractor-owned information system or network (DFARS).

NIST SP 800-171 establishes security requirements specifically for the protection of CUI when it is processed, stored, or transmitted by nonfederal information systems operated by organizations. While organizations may have separate obligations to safeguard CUI in physical form under other authorities, such as DoDI 5200.48, NIST SP 800-171 does not function as a comprehensive safeguarding standard for paper-only CUI absent an information system context (NIST).

Consequently, organizations that neither receive CUI nor process covered defense information on their systems may fall outside the scope of these cybersecurity requirements. Applicability ultimately depends on contract language and the scope defined by the contracting officer, not solely on operational practices (Acquisition).

For contractors that receive CUI exclusively in hardcopy form and do not process, store, or transmit that CUI on any contractor-owned information technology system, the FAQ indicates that a CMMC assessment is not required. This clarification does not create a new self-attestation pathway, nor does it negate obligations imposed DFARS clauses such as 252.204-7019 or 252.204-7020 when those clauses are included in a contract or flowdown. Whether self-assessment or certification is required remains dependent on solicitation language, contract requirements, and prime contractor flowdowns. (Defense CIO).

Risk and Practicality: Atlantic Digital’s Perspective

While the FAQ may appear to reduce assessment burden in narrowly defined scenarios, Atlantic Digital advises contractors to approach this guidance cautiously.

The DoD’s clarification should not be interpreted as a determination that paper CUI is inherently low risk. Physical compromise, including theft, loss, or unauthorized access to printed technical data, remains a documented and credible threat vector. The FAQ reflects a scoping decision about assessment applicability, not a reduction in safeguarding expectations.

At the same time, the DoD appears to be balancing mission risk against practical constraints within the Defense Industrial Base (DIB), particularly for very small or specialized organizations. By limiting third-party assessment requirements to scenarios involving contractor-owned IT systems, the DoD is attempting to reduce compliance friction where cyber risk exposure is comparatively limited.

This balance between defense-in-depth principles and practical scalability is at the heart of the current industry debate. Contractors should not assume that “paper-only” CUI handling constitutes a safe harbor, as contract terms, prime contractor requirements, and routine business practices frequently introduce digital CUI exposure.

Atlantic Digital Guidance to Contractors

Atlantic Digital recommends that organizations:

Do not rely on the FAQ as a standalone compliance determination; contract language, solicitation requirements, and prime contractor flowdowns remain controlling.

Treat paper-only CUI scenarios as fragile and easily invalidated by routine practices such as scanning, emailing, or collaboration.

Maintain awareness of applicable Physical Protection and Media Protection obligations even when a third-party CMMC assessment is not required.

Make deliberate scoping decisions to avoid unintended digitization that could trigger assessment requirements.

The DoD CMMC FAQ does not modify DFARS clauses, override solicitation requirements, redefine CMMC levels, or create new compliance pathways. It is interpretive guidance intended to clarify assessment applicability, not a binding regulatory change.

Important Note

This article is provided for informational purposes only and reflects Atlantic Digital’s interpretation of publicly available DoD guidance. It does not constitute legal advice and does not replace contract-specific requirements, solicitation language, or direction from a contracting officer.

Conclusion

The DoD’s statement that a third-party CMMC assessment is not required for organizations handling only hardcopy CUI must be read with nuance. Assessment requirements are tied to cybersecurity risk on contractor-owned information technology systems. Hardcopy CUI remains subject to safeguarding obligations under DoDI 5200.48 and any applicable DFARS or NIST requirements when contractually required. Contractors should verify contract language and prime expectations carefully, recognizing that the FAQ provides clarification, not exemption, from security responsibilities. When uncertainty exists, deliberate scoping and early validation are far less costly than remediation later.