The CMMC Phase 2 Pause Did Not End Flowdown Requirements 

The pause changed certain assessment requirements in federal contracts, but it did not remove the process by which cybersecurity requirements reach subcontractors. Prime contractors are still responsible for managing supplier risk and verifying that subcontractors can adequately protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).  As contract modifications move through the acquisition chain, […]