The pause changed certain assessment requirements in federal contracts, but it did not remove the process by which cybersecurity requirements reach subcontractors. Prime contractors are still responsible for managing supplier risk and verifying that subcontractors can adequately protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
As contract modifications move through the acquisition chain, subcontractors may find themselves in a confusing position: hearing that CMMC Phase 2 has been paused while simultaneously receiving supplier questionnaires, SPRS requests, or requests for evidence of NIST SP 800-171 implementation.
Understanding how flowdown requirements work can help explain why those requests are continuing.
Key Takeaways
- The Phase 2 pause does not remove the NIST SP 800-171 obligations that your subcontract carries.
- A prime can ask for your SPRS score, system security plan evidence, and affirmations of continuous compliance until a formal modification says otherwise.
Table of Contents
What the CMMC Phase 2 Pause Changed
The Department of War suspended Phase 2 on July 13, 2026. Phase 2 was scheduled to start November 10, 2026, and would have required contractors that handle Controlled Unclassified Information (CUI) to pass an assessment by an independent certified third-party assessor organization (C3PAO) before contract award.
A September 3 class deviation then went further than the memo. A class deviation is an approved exception that lets contracting officers follow different rules than the standard acquisition regulation. According to Washington Technology, the deviation directs contracting officers to follow the Revolutionary FAR Overhaul instead of the final CMMC rule clauses. It also removes the third-party assessment requirements from contracts. Because it is a deviation and no longer a suspension, reversing it is a more involved process.
How Requirements Flow Down to Subcontractors
Contracting officers have been directed to modify existing contracts to remove suspended requirements before the next option period or scheduled administrative modification. Those changes do not automatically update every subcontract in the defense supply chain.
Historically, DFARS 252.204-7021 served as the mechanism for flowing CMMC requirements to subcontractors that handle FCI or CUI. Understanding what that clause requires helps explain why subcontractors may continue receiving compliance requests even while the government revises assessment requirements.
What DFARS 252.204-7021 Required Before the Pause
Before the Phase 2 pause, DFARS 252.204-7021 served as the primary mechanism for flowing CMMC requirements to subcontractors that handle FCI or CUI. In practical terms, the clause required three things:
- Flowdown: Primes had to include the substance of the clause in applicable subcontracts.
- Verification: Primes had to confirm subcontractors met the required CMMC level before award.
- Annual affirmations: Contractors and subcontractors had to maintain affirmations of continuous compliance.
Those requirements helped create a chain of accountability from the government to the prime contractor and down through the supply chain.
The question now is what happens to those obligations when assessment requirements are suspended, but existing contracts and subcontracts have not yet been updated.
Why the flowdown matters during the pause.
The government can modify a prime contract, but those changes still have to work their way through the supply chain. A subcontract is a separate legal agreement between the prime and the subcontractor. Until the prime amends that agreement, the language already in place generally remains the governing requirement for that subcontract.
That means subcontractors may continue receiving supplier questionnaires, SPRS requests, affirmations, or requests for supporting documentation even while contracting officers work through contract modifications.
The most important rule for subcontractors is simple: treat your own subcontract as the controlling document until your prime formally tells you otherwise.
Why subcontractors may hear different messages.
Conflicting guidance is expected in a layered system. There are two reasons behind it.
1. Contracting offices move at different speeds.
The prime has to read the change, decide what it means for each supplier, and issue amendments. Some suppliers will receive new terms within weeks. Others will receive nothing, and their old terms remain in force.
2. Primes interpret supplier risk differently.
The clause tells a prime to verify and collect affirmations. It does not tell the prime how much evidence is enough. One prime may accept a posted SPRS status. Another may also ask for the System Security Plan. Yet another may keep its supplier requirements at “Level 2” strength because its own eligibility depends you having strong cybersecurity.
How to Respond When Requirements Change
When a modification to your contract requirements arrives, you should:
Identify exactly which requirement(s) were removed.
Third-party assessment language is different from the safeguarding clause.
Confirm who issued it.
The government modifies its contract with the prime. Your subcontract changes only when your prime issues its own modification to you.
Ask the prime to put everything in writing.
Have them clarify whether any supplier requirement it set separately still applies. Keep the reply for your records.
Keep a file of your compliance journey.
Save any letters of modification, dated, next to records of your remediation efforts, and POA&M. This documentation may be critical in any future FCA dispute or reinstatement scenario.
The 4 Things Primes Commonly Request
Most Prime requests will fall into four groups:
1. Your current SPRS score and date.
Primes use SPRS information as a quick indicator of a subcontractor’s documented NIST SP 800-171 assessment status and overall cybersecurity posture.
2. SSP evidence.
The SSP is a written description of how you meet each requirement. Expect requests for screenshots, policies, and configuration records that match what the SSP claims.
3. Affirmation of continuous compliance.
This is a yearly statement, signed by a named senior official, that you remain compliant at the required level.
4. Scope and managed service provider involvement.
Primes want to know where CUI is stored and whether an outside managed IT provider touches those systems. A provider that cannot demonstrate its knowledge of NIST requirements or strength in compliance frameworks introduces risk in your compliance journey.
What Hasn’t Changed Since the Phase 2 Pause Began
Phase 1 remains in full effect, including:
- Self-assessments
- DFARS 252.204-7012
- NIST SP 800-171 Revision 2 compliance
- SPRS score postings
- Annual affirmations
DFARS 252.204-7012
DFARS 7012 is the contract clause that requires you to protect covered defense information and report cyber incidents. The 72-hour incident reporting requirement remains operative.
NIST SP 800-171
SPRS
Holland & Knight, a prominent law firm, advises contractors not to stop compliance activities on their existing contracts merely because the Phase 2 deadline was suspended. They state that “the suspension does not eliminate the risk of a government-led assessment under CMMC Phase I discretionary authority. Pausing or slowing compliance activities may create gaps that will be difficult and expensive to close later.”
The Takeaway After the CMMC Pause
The most important thing to understand about the Phase 2 pause is that contract changes like this do not move through the defense supply chain overnight. Contract changes do not move through the defense supply chain overnight. That is why many subcontractors will continue receiving questionnaires, evidence requests, and compliance reviews even during the Phase 2 pause.
The assessment requirements may have changed, but the flowdown relationship between primes and subcontractors remains.
If you need assistance strengthening your security or compiling evidence for your Prime, speak with one of our advisors.
- We’re a CMMC-focused managed IT services provider
- We’re Level 2 certified
- We’ve supported regulated businesses for over 25 years
