Topic · dfars-7012

DFARS 252.204-7012

DFARS clause 252.204-7012 specifically — the CUI safeguarding and incident-reporting clause that drives most CMMC obligations.

RSS feed ↗

trade-press
CMMC Certification Pauses, but 7012 Doesn't
DoD's class deviation suspends third-party assessments without touching the underlying DFARS safeguarding clause, the NIST 800-171 baseline, or the annual affirmation requirement, and conflating the two is how contractors lose their seat at the table.
The Pentagon issued a class deviation suspending CMMC third-party certification requirements (no more C3PAO assessments for Level 2, no Level 3) but left every underlying cybersecurity obligation intact. DFARS 252.204-7012 safeguarding requirements remain. NIST SP 800-171 Revision 2 controls remain. SPRS scoring remains. And contractors must still file annual affirmations of continuous compliance. Contracting officers have been instructed to update active solicitations to reflect the changes. The Phase 2 transition toward mandatory outside assessments, originally set to ramp up, is now on hold while DoD's 60-day top-to-bottom review of the program concludes.
SAT
trade-press
CMMC's architects make the case for pressing on
Two of the program's builders argue the threat hasn't paused, and neither have the contractors who've already decided the July suspension means they can stop spending.
Stacy Bostjanick and Tara Lemieux, both central to CMMC's development and now at Cybersec Investment, published an opinion piece in Federal News Network arguing the Pentagon's July 2026 phase-two suspension shouldn't be read as permission to abandon compliance. They point to real DIB breach cases as the cost of inaction, cite $20,000, $50,000 in annual sunk compliance investment by small firms, and warn that contractors publicly posting on Reddit that they've halted spending are betting wrong on the direction of the review. The piece is advocacy from the compliance community, not a DoD signal, but with the 60-day review window launched July 13 now closing, the argument lands while the program's fate is genuinely unsettled.
SEP 9
trade-press
CMMC program operational despite phase-two pause, Cyber AB says
The pause is tactical, not strategic, but the task force's mandate to "drastically reduce costs" could reshape level two for small and non-traditional shops before anything becomes contractually mandatory.
CMMC's phase-two implementation timeline is on hold after DoD's July 13 pause and 60-day task-force review, but Cyber AB CEO Matthew Travis told a July 28 town hall that the program itself remains operational: C3PAOs are conducting level two certifications, DFARS 252.204-7012 compliance is still in force, and both CMMC portals remain open. Travis framed certification as "the best insurance policy against False Claims Act risk" and urged contractors to respond to DoD's RFI by the Aug. 14 deadline. The task force's authority to alter the rule's cost, scope, or timing remains undefined, and the Cyber AB hasn't been contacted for tier-four participation yet.
AUG 25
trade-press
NDIA: DoD's own CUI marking failures drive CMMC costs
The comment-period pause gives industry a rare opening to name the Pentagon's own CUI marking failures as the hidden cost driver in CMMC, not contractor immaturity.
NDIA told DoD during the CMMC reform comment window that inconsistent Pentagon CUI marking is the root cause of compliance costs running $100K to $5M+ for individual contractors. Nearly half of NDIA's survey respondents spent over $100,000 implementing NIST 800-171, costs that can't be amortized across contracts for small firms. The filing names what contractors have said quietly for years: you can't protect information the government itself can't consistently label.
AUG 19
trade-press
DoD CMMC pause leaves NIST SP 800-171 burden intact
The audit calendar moved; the control stack and executive signature risk did not, which is the part contractors actually pay for.
Federal News Network reports DoD paused Phase 2 third-party Cybersecurity Maturity Model Certification reviews, but defense contractors still must implement NIST SP 800-171 under DFARS 252.204-7012 and provide senior-official affirmations. Primes, subs and certified third-party assessment organizations get timeline uncertainty, not a compliance holiday. The expensive work remains the 110-plus controls, with False Claims Act and whistleblower exposure waiting for contractors that read “pause” as “stop.”
JUL 21
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18

DFARS 252.204-7012

CMMC Certification Pauses, but 7012 Doesn't

CMMC's architects make the case for pressing on

CMMC program operational despite phase-two pause, Cyber AB says

NDIA: DoD's own CUI marking failures drive CMMC costs

DoD CMMC pause leaves NIST SP 800-171 burden intact

LOGZONE pays $507,144 over Navy DFARS cyber failures