If you're a subcontractor who got the "We still need your CMMC" email from your prime, you're not alone. But can a prime require CMMC during the pause? Yes, and ignoring this comes with risks.
Though the July 13th pause put third-party (C3PAO) Level 2 assessments on hold, it did not remove the requirements in your contract. This means NIST SP 800-171, SPRS scores, annual affirmations, and the risks of False Claims all still apply.
To cut through the confusion, primes are free to make certification a condition of sharing CUI with subs. We are finding that many primes are managing their own risk.
Nothing in the July 13th memo tells them to drop supplier requirements, such as;
FAR 52.204-21 - the requirement for basic safeguarding of FCI
DFARS 252.204-7012 requires NIST SP 800-171 for CUI, plus 72-hour incident reporting
DFARS 252.204-7019/7020 require a current SPRS score
Because the requirements from contract clauses did not change, primes are playing it safe.
At the present moment, there is dissonance between what's enforced by assessors and what's required by contract. While some businesses have chosen the wait-and-see position, others are trying to guess at what's next.
Companies stuck in that gap face a few risks:
Lost work. Primes select suppliers they trust with CUI. If a competitor can show a clean SPRS score and a defined CUI boundary, they win the work. An indefensible SPRS score and shaky boundary is never a winning position.
Now that the 60-day review period has come and gone, we're left with speculation.
Our recommendation is to make use of this window of opportunity. Take the necessary steps so that you are prepared for the logical scenarios.
Confirm the requirements with your prime
Validate your SPRS score
Shrink your CUI scope with an Enclave
Get a readiness/gap assessment to see what's missing
If you need suggestions on where to begin, reach out to our team today.