If you're a subcontractor who got the "We still need your CMMC" email from your prime, you're not alone. But can a prime require CMMC during the pause? Yes, and ignoring this comes with risks.
The Pause
Though the July 13th pause put third-party (C3PAO) Level 2 assessments on hold, it did not remove the requirements in your contract. This means NIST SP 800-171, SPRS scores, annual affirmations, and the risks of False Claims all still apply.
Primes May Still Require CMMC of Their Subs
To cut through the confusion, primes are free to make certification a condition of sharing CUI with subs. We are finding that many primes are managing their own risk.
Nothing in the July 13th memo tells them to drop supplier requirements, such as;
-
FAR 52.204-21 - the requirement for basic safeguarding of FCI
-
DFARS 252.204-7012 requires NIST SP 800-171 for CUI, plus 72-hour incident reporting
-
DFARS 252.204-7019/7020 require a current SPRS score
Because the requirements from contract clauses did not change, primes are playing it safe.
"Wait and See"
At the present moment, there is dissonance between what's enforced by assessors and what's required by contract. While some businesses have chosen the wait-and-see position, others are trying to guess at what's next.
Companies stuck in that gap face a few risks:
-
Lost work. Primes select suppliers they trust with CUI. If a competitor can show a clean SPRS score and a defined CUI boundary, they win the work. An indefensible SPRS score and shaky boundary is never a winning position.
- What if the Pause Changes Nothing. It is possible that the pause is eventually lifted, nothing changes, and the bottleneck to certification resumes. This leads to another potential problem.
- The Readiness Crunch. if the above scenario plays out, thousands of companies will compete for a limited number of C3PAOs. Getting ready takes months, not weeks.
Now that the 60-day review period has come and gone, we're left with speculation.
What You Can Do Now
Our recommendation is to make use of this window of opportunity. Take the necessary steps so that you are prepared for the logical scenarios.
-
Confirm the requirements with your prime
-
Validate your SPRS score
-
Shrink your CUI scope with an Enclave
-
Get a readiness/gap assessment to see what's missing
- Close gaps
If you need suggestions on where to begin, reach out to our team today.
