Advanced CMMC Guide & Compliance Checklist
Phase 2 got paused. DFARS 252.204-7012 didn’t.
On July 13, 2026, the Department of War suspended CMMC Phase 2 and opened a 60-day review that could bring it back, revise it, or end it. That’s in flux.
But what is in flux is DFARS 252.204-7012. That’s the clause that has been sitting in your contract before CMMC existed. It requires you to protect covered defense information and implement NIST SP 800-171.
What's inside
- Whether you’re a Level 1 or Level 2 subcontractor, based on whether your work touches CUI.
- What CMMC Level 2 costs. A realistic year-one range of $60,000–$275,000, compared against the DoW’s own published estimate.
- False Claims Act exposure. Four real DOJ settlements, including one triggered by a whistleblower complaint with no breach involved – a risk tied to what you’ve already attested, regardless of whether you need a certification or not.
- The Level 2 challenge: scoping CUI. Why most Level 2 findings come from not knowing where your data lives, not from missing technology.
- A Level 2 pre-assessment checklist and an MSP evaluation checklist, including the exact question to ask any MSP about their own DFARS 252.204-7012 and NIST SP 800-171 track record.
Certification is a moment. Contract eligibility is a posture.
A certification deadline is simply a date on your calendar…and right now that date is unresolved. You may never have one. However, DFARS 252.204-7012 doesn’t require a date.
It’s a standing obligation that was in your contract before Phase 2 existed and stays there no matter what the 60-day review decides. Building toward Level 2 readiness now protects you against the clause that never paused.
Download the 2026 CMMC Level 2 guide and checklist to see what your DFARS 252.204-7012 obligation requires, independent of where Phase 2 lands.